February 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:0392-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 27 Feb '15

27 Feb '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0392-1 Rating: important References: #592934 #891700 #901223 #904889 #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: java-1_6_0-ibm has been updated to version 1.6.0_sr16.3 to fix 30 security issues: * CVE-2014-8891: Unspecified vulnerability (bnc#916266) * CVE-2014-8892: Unspecified vulnerability (bnc#916265) * CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allowed local users to execute arbitrary code via vectors related to the shared classes cache (bnc#904889). * CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, used nondeterministic CBC padding, which made it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). * CVE-2014-6513: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (bnc#904889). * CVE-2014-6503: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (bnc#904889). * CVE-2014-6532: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (bnc#904889). * CVE-2014-4288: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (bnc#904889). * CVE-2014-6493: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (bnc#904889). * CVE-2014-6492: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#904889). * CVE-2014-6458: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#904889). * CVE-2014-6466: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#904889). * CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#904889). * CVE-2014-6515: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allowed remote attackers to affect integrity via unknown vectors related to Deployment (bnc#904889). * CVE-2014-6511: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bnc#904889). * CVE-2014-6531: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allowed remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#904889). * CVE-2014-6512: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allowed remote attackers to affect integrity via unknown vectors related to Libraries (bnc#904889). * CVE-2014-6457: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allowed remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#904889). * CVE-2014-6502: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allowed remote attackers to affect integrity via unknown vectors related to Libraries (bnc#904889). * CVE-2014-6558: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allowed remote attackers to affect integrity via unknown vectors related to Security (bnc#904889). * CVE-2014-4227: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#891700). * CVE-2014-4262: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#891700). * CVE-2014-4219: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#891700). * CVE-2014-4209: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality and integrity via vectors related to JMX (bnc#891700). * CVE-2014-4268: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#891700). * CVE-2014-4218: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allowed remote attackers to affect integrity via unknown vectors related to Libraries (bnc#891700). * CVE-2014-4252: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allowed remote attackers to affect confidentiality via unknown vectors related to Security (bnc#891700). * CVE-2014-4265: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allowed remote attackers to affect integrity via unknown vectors related to Deployment (bnc#891700). * CVE-2014-4263: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement (bnc#891700). * CVE-2014-4244: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Security (bnc#891700). This non-security bug has also been fixed: * Fix update-alternatives list (bnc#592934) Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_6_0-ibm=10353 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_6_0-ibm=10354 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.5 java-1_6_0-ibm-devel-1.6.0_sr16.3-0.4.5 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.5 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.5 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.5 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.5 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.5 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.5 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.5 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/592934 https://bugzilla.suse.com/891700 https://bugzilla.suse.com/901223 https://bugzilla.suse.com/904889 https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=96da2c614827c23087d5b86b253… http://download.suse.com/patch/finder/?keywords=cfef74a50dd3fd4a378c3d05db3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0386-1: important: Security update for Samba
by opensuse-security＠opensuse.org 27 Feb '15

27 Feb '15

SUSE Security Update: Security update for Samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0386-1 Rating: important References: #872912 #882356 #883870 #886193 #898031 #899558 #913001 #917376 Cross-References: CVE-2015-0240 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: Samba has been updated to fix one security issue: * CVE-2015-0240: Don't call talloc_free on an uninitialized pointer (bnc#917376). Additionally, these non-security issues have been fixed: * Realign the winbind request structure following require_membership_of field expansion (bnc#913001). * Reuse connections derived from DFS referrals (bso#10123, fate#316512). * Set domain/workgroup based on authentication callback value (bso#11059). * Fix spoolss error response marshalling (bso#10984). * Fix spoolss EnumJobs and GetJob responses (bso#10905, bnc#898031). * Fix handling of bad EnumJobs levels (bso#10898). * Fix small memory-leak in the background print process (bnc#899558). * Prune idle or hung connections older than "winbind request timeout" (bso#3204, bnc#872912). * Build: disable mmap on s390 systems (bnc#886193, bnc#882356). * Only update the printer share inventory when needed (bnc#883870). * Avoid double-free in get_print_db_byname (bso#10699). Security Issues: * CVE-2015-0240 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-cifs-mount=10346 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): ldapsmb-1.34b-12.33.43.1 libldb1-3.6.3-0.33.43.1 libsmbclient0-3.6.3-0.33.43.1 libtalloc1-3.4.3-1.54.39 libtalloc2-3.6.3-0.33.43.1 libtdb1-3.6.3-0.33.43.1 libtevent0-3.6.3-0.33.43.1 libwbclient0-3.6.3-0.33.43.1 samba-3.6.3-0.33.43.1 samba-client-3.6.3-0.33.43.1 samba-krb-printing-3.6.3-0.33.43.1 samba-winbind-3.6.3-0.33.43.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libsmbclient0-32bit-3.6.3-0.33.43.1 libtalloc1-32bit-3.4.3-1.54.39 libtalloc2-32bit-3.6.3-0.33.43.1 libtdb1-32bit-3.6.3-0.33.43.1 libtevent0-32bit-3.6.3-0.33.43.1 libwbclient0-32bit-3.6.3-0.33.43.1 samba-32bit-3.6.3-0.33.43.1 samba-client-32bit-3.6.3-0.33.43.1 samba-winbind-32bit-3.6.3-0.33.43.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (noarch): samba-doc-3.6.3-0.33.43.1 References: http://support.novell.com/security/cve/CVE-2015-0240.html https://bugzilla.suse.com/872912 https://bugzilla.suse.com/882356 https://bugzilla.suse.com/883870 https://bugzilla.suse.com/886193 https://bugzilla.suse.com/898031 https://bugzilla.suse.com/899558 https://bugzilla.suse.com/913001 https://bugzilla.suse.com/917376 http://download.suse.com/patch/finder/?keywords=d8d66713b0b31cf585ddfd4a751… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0382-1: important: Security update for snack
by opensuse-security＠opensuse.org 26 Feb '15

26 Feb '15

openSUSE Security Update: Security update for snack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0382-1 Rating: important References: #793860 Cross-References: CVE-2012-6303 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: snack was updated to fix one security issue. This security issue was fixed: - CVE-2012-6303: Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allowed remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file (bnc#793860). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-183=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-183=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): snack-2.2.10-212.4.1 snack-debuginfo-2.2.10-212.4.1 snack-debugsource-2.2.10-212.4.1 - openSUSE 13.1 (i586 x86_64): snack-2.2.10-210.4.1 snack-debuginfo-2.2.10-210.4.1 snack-debugsource-2.2.10-210.4.1 References: http://support.novell.com/security/cve/CVE-2012-6303.html https://bugzilla.suse.com/793860 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0376-1: important: Security update for java-1_5_0-ibm
by opensuse-security＠opensuse.org 25 Feb '15

25 Feb '15

SUSE Security Update: Security update for java-1_5_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0376-1 Rating: important References: #891699 #901223 #901239 #904889 #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: java-1_5_0-ibm has been updated to fix 19 security issues: * CVE-2014-8891: Unspecified vulnerability (bnc#916266). * CVE-2014-8892: Unspecified vulnerability (bnc#916265). * CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache (bnc#904889). * CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). * CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6511: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (bnc#901239). * CVE-2014-6531: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6512: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6457: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#901239). * CVE-2014-6502: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6558: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (bnc#901239). * CVE-2014-4262: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#891699). * CVE-2014-4219: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#891699). * CVE-2014-4209: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX (bnc#891699). * CVE-2014-4268: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#891699). * CVE-2014-4218: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#891699). * CVE-2014-4252: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security (bnc#891699). * CVE-2014-4263: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement (bnc#891699). * CVE-2014-4244: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security (bnc#891699). Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.9-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.9-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.9-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.9-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.9-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.9-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.9-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.9-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.9-0.6.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/891699 https://bugzilla.suse.com/901223 https://bugzilla.suse.com/901239 https://bugzilla.suse.com/904889 https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=2c3b79e944e87fd633df27d6879… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0343-2: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 25 Feb '15

25 Feb '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0343-2 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-ibm has been updated to fix two security issues: * CVE-2014-8891: Unspecified vulnerability * CVE-2014-8892: Unspecified vulnerability Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-java-1_6_0-ibm=10303 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-devel-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=0b2166799c8f437f2e8b9f49922… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0375-1: important: Security update for samba
by opensuse-security＠opensuse.org 25 Feb '15

25 Feb '15

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0375-1 Rating: important References: #914279 #917376 Cross-References: CVE-2014-8143 CVE-2015-0240 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: samba was updated to fix two security issues. These security issues were fixed: - CVE-2015-0240: Ensure we don't call talloc_free on an uninitialized pointer (bnc#917376). - CVE-2014-8143: Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller (AD DC) is configured, allowed remote authenticated users to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation (bnc#914279). Several non-security issues were fixed, please refer to the changes file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-179=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-179=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libdcerpc-atsvc-devel-4.1.17-5.1 libdcerpc-atsvc0-4.1.17-5.1 libdcerpc-atsvc0-debuginfo-4.1.17-5.1 libdcerpc-binding0-4.1.17-5.1 libdcerpc-binding0-debuginfo-4.1.17-5.1 libdcerpc-devel-4.1.17-5.1 libdcerpc-samr-devel-4.1.17-5.1 libdcerpc-samr0-4.1.17-5.1 libdcerpc-samr0-debuginfo-4.1.17-5.1 libdcerpc0-4.1.17-5.1 libdcerpc0-debuginfo-4.1.17-5.1 libgensec-devel-4.1.17-5.1 libgensec0-4.1.17-5.1 libgensec0-debuginfo-4.1.17-5.1 libndr-devel-4.1.17-5.1 libndr-krb5pac-devel-4.1.17-5.1 libndr-krb5pac0-4.1.17-5.1 libndr-krb5pac0-debuginfo-4.1.17-5.1 libndr-nbt-devel-4.1.17-5.1 libndr-nbt0-4.1.17-5.1 libndr-nbt0-debuginfo-4.1.17-5.1 libndr-standard-devel-4.1.17-5.1 libndr-standard0-4.1.17-5.1 libndr-standard0-debuginfo-4.1.17-5.1 libndr0-4.1.17-5.1 libndr0-debuginfo-4.1.17-5.1 libnetapi-devel-4.1.17-5.1 libnetapi0-4.1.17-5.1 libnetapi0-debuginfo-4.1.17-5.1 libpdb-devel-4.1.17-5.1 libpdb0-4.1.17-5.1 libpdb0-debuginfo-4.1.17-5.1 libregistry-devel-4.1.17-5.1 libregistry0-4.1.17-5.1 libregistry0-debuginfo-4.1.17-5.1 libsamba-credentials-devel-4.1.17-5.1 libsamba-credentials0-4.1.17-5.1 libsamba-credentials0-debuginfo-4.1.17-5.1 libsamba-hostconfig-devel-4.1.17-5.1 libsamba-hostconfig0-4.1.17-5.1 libsamba-hostconfig0-debuginfo-4.1.17-5.1 libsamba-policy-devel-4.1.17-5.1 libsamba-policy0-4.1.17-5.1 libsamba-policy0-debuginfo-4.1.17-5.1 libsamba-util-devel-4.1.17-5.1 libsamba-util0-4.1.17-5.1 libsamba-util0-debuginfo-4.1.17-5.1 libsamdb-devel-4.1.17-5.1 libsamdb0-4.1.17-5.1 libsamdb0-debuginfo-4.1.17-5.1 libsmbclient-devel-4.1.17-5.1 libsmbclient-raw-devel-4.1.17-5.1 libsmbclient-raw0-4.1.17-5.1 libsmbclient-raw0-debuginfo-4.1.17-5.1 libsmbclient0-4.1.17-5.1 libsmbclient0-debuginfo-4.1.17-5.1 libsmbconf-devel-4.1.17-5.1 libsmbconf0-4.1.17-5.1 libsmbconf0-debuginfo-4.1.17-5.1 libsmbldap-devel-4.1.17-5.1 libsmbldap0-4.1.17-5.1 libsmbldap0-debuginfo-4.1.17-5.1 libsmbsharemodes-devel-4.1.17-5.1 libsmbsharemodes0-4.1.17-5.1 libsmbsharemodes0-debuginfo-4.1.17-5.1 libtevent-util-devel-4.1.17-5.1 libtevent-util0-4.1.17-5.1 libtevent-util0-debuginfo-4.1.17-5.1 libwbclient-devel-4.1.17-5.1 libwbclient0-4.1.17-5.1 libwbclient0-debuginfo-4.1.17-5.1 samba-4.1.17-5.1 samba-client-4.1.17-5.1 samba-client-debuginfo-4.1.17-5.1 samba-core-devel-4.1.17-5.1 samba-debuginfo-4.1.17-5.1 samba-debugsource-4.1.17-5.1 samba-libs-4.1.17-5.1 samba-libs-debuginfo-4.1.17-5.1 samba-pidl-4.1.17-5.1 samba-python-4.1.17-5.1 samba-python-debuginfo-4.1.17-5.1 samba-test-4.1.17-5.1 samba-test-debuginfo-4.1.17-5.1 samba-test-devel-4.1.17-5.1 samba-winbind-4.1.17-5.1 samba-winbind-debuginfo-4.1.17-5.1 - openSUSE 13.2 (x86_64): libdcerpc-atsvc0-32bit-4.1.17-5.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.17-5.1 libdcerpc-binding0-32bit-4.1.17-5.1 libdcerpc-binding0-debuginfo-32bit-4.1.17-5.1 libdcerpc-samr0-32bit-4.1.17-5.1 libdcerpc-samr0-debuginfo-32bit-4.1.17-5.1 libdcerpc0-32bit-4.1.17-5.1 libdcerpc0-debuginfo-32bit-4.1.17-5.1 libgensec0-32bit-4.1.17-5.1 libgensec0-debuginfo-32bit-4.1.17-5.1 libndr-krb5pac0-32bit-4.1.17-5.1 libndr-krb5pac0-debuginfo-32bit-4.1.17-5.1 libndr-nbt0-32bit-4.1.17-5.1 libndr-nbt0-debuginfo-32bit-4.1.17-5.1 libndr-standard0-32bit-4.1.17-5.1 libndr-standard0-debuginfo-32bit-4.1.17-5.1 libndr0-32bit-4.1.17-5.1 libndr0-debuginfo-32bit-4.1.17-5.1 libnetapi0-32bit-4.1.17-5.1 libnetapi0-debuginfo-32bit-4.1.17-5.1 libpdb0-32bit-4.1.17-5.1 libpdb0-debuginfo-32bit-4.1.17-5.1 libregistry0-32bit-4.1.17-5.1 libregistry0-debuginfo-32bit-4.1.17-5.1 libsamba-credentials0-32bit-4.1.17-5.1 libsamba-credentials0-debuginfo-32bit-4.1.17-5.1 libsamba-hostconfig0-32bit-4.1.17-5.1 libsamba-hostconfig0-debuginfo-32bit-4.1.17-5.1 libsamba-policy0-32bit-4.1.17-5.1 libsamba-policy0-debuginfo-32bit-4.1.17-5.1 libsamba-util0-32bit-4.1.17-5.1 libsamba-util0-debuginfo-32bit-4.1.17-5.1 libsamdb0-32bit-4.1.17-5.1 libsamdb0-debuginfo-32bit-4.1.17-5.1 libsmbclient-raw0-32bit-4.1.17-5.1 libsmbclient-raw0-debuginfo-32bit-4.1.17-5.1 libsmbclient0-32bit-4.1.17-5.1 libsmbclient0-debuginfo-32bit-4.1.17-5.1 libsmbconf0-32bit-4.1.17-5.1 libsmbconf0-debuginfo-32bit-4.1.17-5.1 libsmbldap0-32bit-4.1.17-5.1 libsmbldap0-debuginfo-32bit-4.1.17-5.1 libtevent-util0-32bit-4.1.17-5.1 libtevent-util0-debuginfo-32bit-4.1.17-5.1 libwbclient0-32bit-4.1.17-5.1 libwbclient0-debuginfo-32bit-4.1.17-5.1 samba-32bit-4.1.17-5.1 samba-client-32bit-4.1.17-5.1 samba-client-debuginfo-32bit-4.1.17-5.1 samba-debuginfo-32bit-4.1.17-5.1 samba-libs-32bit-4.1.17-5.1 samba-libs-debuginfo-32bit-4.1.17-5.1 samba-winbind-32bit-4.1.17-5.1 samba-winbind-debuginfo-32bit-4.1.17-5.1 - openSUSE 13.2 (noarch): samba-doc-4.1.17-5.1 - openSUSE 13.1 (i586 x86_64): libdcerpc-atsvc-devel-4.1.17-3.30.1 libdcerpc-atsvc0-4.1.17-3.30.1 libdcerpc-atsvc0-debuginfo-4.1.17-3.30.1 libdcerpc-binding0-4.1.17-3.30.1 libdcerpc-binding0-debuginfo-4.1.17-3.30.1 libdcerpc-devel-4.1.17-3.30.1 libdcerpc-samr-devel-4.1.17-3.30.1 libdcerpc-samr0-4.1.17-3.30.1 libdcerpc-samr0-debuginfo-4.1.17-3.30.1 libdcerpc0-4.1.17-3.30.1 libdcerpc0-debuginfo-4.1.17-3.30.1 libgensec-devel-4.1.17-3.30.1 libgensec0-4.1.17-3.30.1 libgensec0-debuginfo-4.1.17-3.30.1 libndr-devel-4.1.17-3.30.1 libndr-krb5pac-devel-4.1.17-3.30.1 libndr-krb5pac0-4.1.17-3.30.1 libndr-krb5pac0-debuginfo-4.1.17-3.30.1 libndr-nbt-devel-4.1.17-3.30.1 libndr-nbt0-4.1.17-3.30.1 libndr-nbt0-debuginfo-4.1.17-3.30.1 libndr-standard-devel-4.1.17-3.30.1 libndr-standard0-4.1.17-3.30.1 libndr-standard0-debuginfo-4.1.17-3.30.1 libndr0-4.1.17-3.30.1 libndr0-debuginfo-4.1.17-3.30.1 libnetapi-devel-4.1.17-3.30.1 libnetapi0-4.1.17-3.30.1 libnetapi0-debuginfo-4.1.17-3.30.1 libpdb-devel-4.1.17-3.30.1 libpdb0-4.1.17-3.30.1 libpdb0-debuginfo-4.1.17-3.30.1 libregistry-devel-4.1.17-3.30.1 libregistry0-4.1.17-3.30.1 libregistry0-debuginfo-4.1.17-3.30.1 libsamba-credentials-devel-4.1.17-3.30.1 libsamba-credentials0-4.1.17-3.30.1 libsamba-credentials0-debuginfo-4.1.17-3.30.1 libsamba-hostconfig-devel-4.1.17-3.30.1 libsamba-hostconfig0-4.1.17-3.30.1 libsamba-hostconfig0-debuginfo-4.1.17-3.30.1 libsamba-policy-devel-4.1.17-3.30.1 libsamba-policy0-4.1.17-3.30.1 libsamba-policy0-debuginfo-4.1.17-3.30.1 libsamba-util-devel-4.1.17-3.30.1 libsamba-util0-4.1.17-3.30.1 libsamba-util0-debuginfo-4.1.17-3.30.1 libsamdb-devel-4.1.17-3.30.1 libsamdb0-4.1.17-3.30.1 libsamdb0-debuginfo-4.1.17-3.30.1 libsmbclient-devel-4.1.17-3.30.1 libsmbclient-raw-devel-4.1.17-3.30.1 libsmbclient-raw0-4.1.17-3.30.1 libsmbclient-raw0-debuginfo-4.1.17-3.30.1 libsmbclient0-4.1.17-3.30.1 libsmbclient0-debuginfo-4.1.17-3.30.1 libsmbconf-devel-4.1.17-3.30.1 libsmbconf0-4.1.17-3.30.1 libsmbconf0-debuginfo-4.1.17-3.30.1 libsmbldap-devel-4.1.17-3.30.1 libsmbldap0-4.1.17-3.30.1 libsmbldap0-debuginfo-4.1.17-3.30.1 libsmbsharemodes-devel-4.1.17-3.30.1 libsmbsharemodes0-4.1.17-3.30.1 libsmbsharemodes0-debuginfo-4.1.17-3.30.1 libtevent-util-devel-4.1.17-3.30.1 libtevent-util0-4.1.17-3.30.1 libtevent-util0-debuginfo-4.1.17-3.30.1 libwbclient-devel-4.1.17-3.30.1 libwbclient0-4.1.17-3.30.1 libwbclient0-debuginfo-4.1.17-3.30.1 samba-4.1.17-3.30.1 samba-client-4.1.17-3.30.1 samba-client-debuginfo-4.1.17-3.30.1 samba-core-devel-4.1.17-3.30.1 samba-debuginfo-4.1.17-3.30.1 samba-debugsource-4.1.17-3.30.1 samba-libs-4.1.17-3.30.1 samba-libs-debuginfo-4.1.17-3.30.1 samba-pidl-4.1.17-3.30.1 samba-python-4.1.17-3.30.1 samba-python-debuginfo-4.1.17-3.30.1 samba-test-4.1.17-3.30.1 samba-test-debuginfo-4.1.17-3.30.1 samba-test-devel-4.1.17-3.30.1 samba-winbind-4.1.17-3.30.1 samba-winbind-debuginfo-4.1.17-3.30.1 - openSUSE 13.1 (x86_64): libdcerpc-atsvc0-32bit-4.1.17-3.30.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.17-3.30.1 libdcerpc-binding0-32bit-4.1.17-3.30.1 libdcerpc-binding0-debuginfo-32bit-4.1.17-3.30.1 libdcerpc-samr0-32bit-4.1.17-3.30.1 libdcerpc-samr0-debuginfo-32bit-4.1.17-3.30.1 libdcerpc0-32bit-4.1.17-3.30.1 libdcerpc0-debuginfo-32bit-4.1.17-3.30.1 libgensec0-32bit-4.1.17-3.30.1 libgensec0-debuginfo-32bit-4.1.17-3.30.1 libndr-krb5pac0-32bit-4.1.17-3.30.1 libndr-krb5pac0-debuginfo-32bit-4.1.17-3.30.1 libndr-nbt0-32bit-4.1.17-3.30.1 libndr-nbt0-debuginfo-32bit-4.1.17-3.30.1 libndr-standard0-32bit-4.1.17-3.30.1 libndr-standard0-debuginfo-32bit-4.1.17-3.30.1 libndr0-32bit-4.1.17-3.30.1 libndr0-debuginfo-32bit-4.1.17-3.30.1 libnetapi0-32bit-4.1.17-3.30.1 libnetapi0-debuginfo-32bit-4.1.17-3.30.1 libpdb0-32bit-4.1.17-3.30.1 libpdb0-debuginfo-32bit-4.1.17-3.30.1 libregistry0-32bit-4.1.17-3.30.1 libregistry0-debuginfo-32bit-4.1.17-3.30.1 libsamba-credentials0-32bit-4.1.17-3.30.1 libsamba-credentials0-debuginfo-32bit-4.1.17-3.30.1 libsamba-hostconfig0-32bit-4.1.17-3.30.1 libsamba-hostconfig0-debuginfo-32bit-4.1.17-3.30.1 libsamba-policy0-32bit-4.1.17-3.30.1 libsamba-policy0-debuginfo-32bit-4.1.17-3.30.1 libsamba-util0-32bit-4.1.17-3.30.1 libsamba-util0-debuginfo-32bit-4.1.17-3.30.1 libsamdb0-32bit-4.1.17-3.30.1 libsamdb0-debuginfo-32bit-4.1.17-3.30.1 libsmbclient-raw0-32bit-4.1.17-3.30.1 libsmbclient-raw0-debuginfo-32bit-4.1.17-3.30.1 libsmbclient0-32bit-4.1.17-3.30.1 libsmbclient0-debuginfo-32bit-4.1.17-3.30.1 libsmbconf0-32bit-4.1.17-3.30.1 libsmbconf0-debuginfo-32bit-4.1.17-3.30.1 libsmbldap0-32bit-4.1.17-3.30.1 libsmbldap0-debuginfo-32bit-4.1.17-3.30.1 libtevent-util0-32bit-4.1.17-3.30.1 libtevent-util0-debuginfo-32bit-4.1.17-3.30.1 libwbclient0-32bit-4.1.17-3.30.1 libwbclient0-debuginfo-32bit-4.1.17-3.30.1 samba-32bit-4.1.17-3.30.1 samba-client-32bit-4.1.17-3.30.1 samba-client-debuginfo-32bit-4.1.17-3.30.1 samba-debuginfo-32bit-4.1.17-3.30.1 samba-libs-32bit-4.1.17-3.30.1 samba-libs-debuginfo-32bit-4.1.17-3.30.1 samba-winbind-32bit-4.1.17-3.30.1 samba-winbind-debuginfo-32bit-4.1.17-3.30.1 - openSUSE 13.1 (noarch): samba-doc-4.1.17-3.30.1 References: http://support.novell.com/security/cve/CVE-2014-8143.html http://support.novell.com/security/cve/CVE-2015-0240.html https://bugzilla.suse.com/914279 https://bugzilla.suse.com/917376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0371-1: important: Security update for Samba
by opensuse-security＠opensuse.org 25 Feb '15

25 Feb '15

SUSE Security Update: Security update for Samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0371-1 Rating: important References: #872912 #898031 #899558 #913001 #917376 Cross-References: CVE-2015-0240 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: Samba has been updated to fix one security issue: * CVE-2015-0240: Don't call talloc_free on an uninitialized pointer (bnc#917376). Additionally, these non-security issues have been fixed: * Realign the winbind request structure following require_membership_of field expansion (bnc#913001). * Reuse connections derived from DFS referrals (bso#10123, fate#316512). * Set domain/workgroup based on authentication callback value (bso#11059). * Fix spoolss error response marshalling (bso#10984). * Fix spoolss EnumJobs and GetJob responses (bso#10905, bnc#898031). * Fix handling of bad EnumJobs levels (bso#10898). * Fix small memory-leak in the background print process; (bnc#899558). * Prune idle or hung connections older than "winbind request timeout" (bso#3204, bnc#872912). Security Issues: * CVE-2015-0240 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-samba-20150217=10321 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-samba-20150217=10321 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-samba-20150217=10321 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-samba-20150217=10321 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libldb-devel-3.6.3-0.56.1 libnetapi-devel-3.6.3-0.56.1 libnetapi0-3.6.3-0.56.1 libsmbclient-devel-3.6.3-0.56.1 libsmbsharemodes-devel-3.6.3-0.56.1 libsmbsharemodes0-3.6.3-0.56.1 libtalloc-devel-3.6.3-0.56.1 libtdb-devel-3.6.3-0.56.1 libtevent-devel-3.6.3-0.56.1 libwbclient-devel-3.6.3-0.56.1 samba-devel-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): ldapsmb-1.34b-12.56.1 libldb1-3.6.3-0.56.1 libsmbclient0-3.6.3-0.56.1 libtalloc2-3.6.3-0.56.1 libtdb1-3.6.3-0.56.1 libtevent0-3.6.3-0.56.1 libwbclient0-3.6.3-0.56.1 samba-3.6.3-0.56.1 samba-client-3.6.3-0.56.1 samba-krb-printing-3.6.3-0.56.1 samba-winbind-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libsmbclient0-32bit-3.6.3-0.56.1 libtalloc2-32bit-3.6.3-0.56.1 libtdb1-32bit-3.6.3-0.56.1 libtevent0-32bit-3.6.3-0.56.1 libwbclient0-32bit-3.6.3-0.56.1 samba-32bit-3.6.3-0.56.1 samba-client-32bit-3.6.3-0.56.1 samba-winbind-32bit-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (noarch): samba-doc-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): ldapsmb-1.34b-12.56.1 libldb1-3.6.3-0.56.1 libsmbclient0-3.6.3-0.56.1 libtalloc2-3.6.3-0.56.1 libtdb1-3.6.3-0.56.1 libtevent0-3.6.3-0.56.1 libwbclient0-3.6.3-0.56.1 samba-3.6.3-0.56.1 samba-client-3.6.3-0.56.1 samba-krb-printing-3.6.3-0.56.1 samba-winbind-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libsmbclient0-32bit-3.6.3-0.56.1 libtalloc2-32bit-3.6.3-0.56.1 libtdb1-32bit-3.6.3-0.56.1 libtevent0-32bit-3.6.3-0.56.1 libwbclient0-32bit-3.6.3-0.56.1 samba-32bit-3.6.3-0.56.1 samba-client-32bit-3.6.3-0.56.1 samba-winbind-32bit-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 (noarch): samba-doc-3.6.3-0.56.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libsmbclient0-x86-3.6.3-0.56.1 libtalloc2-x86-3.6.3-0.56.1 libtdb1-x86-3.6.3-0.56.1 libwbclient0-x86-3.6.3-0.56.1 samba-client-x86-3.6.3-0.56.1 samba-winbind-x86-3.6.3-0.56.1 samba-x86-3.6.3-0.56.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): libldb1-3.6.3-0.56.1 libsmbclient0-3.6.3-0.56.1 libtalloc2-3.6.3-0.56.1 libtdb1-3.6.3-0.56.1 libtevent0-3.6.3-0.56.1 libwbclient0-3.6.3-0.56.1 samba-3.6.3-0.56.1 samba-client-3.6.3-0.56.1 samba-krb-printing-3.6.3-0.56.1 samba-winbind-3.6.3-0.56.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libldb1-32bit-3.6.3-0.56.1 libsmbclient0-32bit-3.6.3-0.56.1 libtalloc2-32bit-3.6.3-0.56.1 libtdb1-32bit-3.6.3-0.56.1 libtevent0-32bit-3.6.3-0.56.1 libwbclient0-32bit-3.6.3-0.56.1 samba-32bit-3.6.3-0.56.1 samba-client-32bit-3.6.3-0.56.1 samba-winbind-32bit-3.6.3-0.56.1 - SUSE Linux Enterprise Desktop 11 SP3 (noarch): samba-doc-3.6.3-0.56.1 References: http://support.novell.com/security/cve/CVE-2015-0240.html https://bugzilla.suse.com/872912 https://bugzilla.suse.com/898031 https://bugzilla.suse.com/899558 https://bugzilla.suse.com/913001 https://bugzilla.suse.com/917376 http://download.suse.com/patch/finder/?keywords=ef17b59d6389957b18b3a77d2e9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0365-1: important: Security update for php5
by opensuse-security＠opensuse.org 24 Feb '15

24 Feb '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0365-1 Rating: important References: #907519 #910659 #911664 #914690 Cross-References: CVE-2014-8142 CVE-2014-9427 CVE-2015-0231 CVE-2015-0232 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: php5 was updated to fix four security issues. These security issues were fixed: - CVE-2015-0231: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (bnc#910659). - CVE-2014-9427: sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, did not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which caused an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping (bnc#911664). - CVE-2015-0232: The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image (bnc#914690). - CVE-2014-8142: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allowed remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019 (bnc#910659). Additionally a fix was included that protects against a possible NULL pointer use (bnc#910659). This non-security issue was fixed: - php53 ignored default_socket_timeout on outgoing SSL connection (bnc#907519). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-94=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-94=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-11.3 php5-debugsource-5.5.14-11.3 php5-devel-5.5.14-11.3 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php5-5.5.14-11.3 apache2-mod_php5-debuginfo-5.5.14-11.3 php5-5.5.14-11.3 php5-bcmath-5.5.14-11.3 php5-bcmath-debuginfo-5.5.14-11.3 php5-bz2-5.5.14-11.3 php5-bz2-debuginfo-5.5.14-11.3 php5-calendar-5.5.14-11.3 php5-calendar-debuginfo-5.5.14-11.3 php5-ctype-5.5.14-11.3 php5-ctype-debuginfo-5.5.14-11.3 php5-curl-5.5.14-11.3 php5-curl-debuginfo-5.5.14-11.3 php5-dba-5.5.14-11.3 php5-dba-debuginfo-5.5.14-11.3 php5-debuginfo-5.5.14-11.3 php5-debugsource-5.5.14-11.3 php5-dom-5.5.14-11.3 php5-dom-debuginfo-5.5.14-11.3 php5-enchant-5.5.14-11.3 php5-enchant-debuginfo-5.5.14-11.3 php5-exif-5.5.14-11.3 php5-exif-debuginfo-5.5.14-11.3 php5-fastcgi-5.5.14-11.3 php5-fastcgi-debuginfo-5.5.14-11.3 php5-fileinfo-5.5.14-11.3 php5-fileinfo-debuginfo-5.5.14-11.3 php5-fpm-5.5.14-11.3 php5-fpm-debuginfo-5.5.14-11.3 php5-ftp-5.5.14-11.3 php5-ftp-debuginfo-5.5.14-11.3 php5-gd-5.5.14-11.3 php5-gd-debuginfo-5.5.14-11.3 php5-gettext-5.5.14-11.3 php5-gettext-debuginfo-5.5.14-11.3 php5-gmp-5.5.14-11.3 php5-gmp-debuginfo-5.5.14-11.3 php5-iconv-5.5.14-11.3 php5-iconv-debuginfo-5.5.14-11.3 php5-intl-5.5.14-11.3 php5-intl-debuginfo-5.5.14-11.3 php5-json-5.5.14-11.3 php5-json-debuginfo-5.5.14-11.3 php5-ldap-5.5.14-11.3 php5-ldap-debuginfo-5.5.14-11.3 php5-mbstring-5.5.14-11.3 php5-mbstring-debuginfo-5.5.14-11.3 php5-mcrypt-5.5.14-11.3 php5-mcrypt-debuginfo-5.5.14-11.3 php5-mysql-5.5.14-11.3 php5-mysql-debuginfo-5.5.14-11.3 php5-odbc-5.5.14-11.3 php5-odbc-debuginfo-5.5.14-11.3 php5-openssl-5.5.14-11.3 php5-openssl-debuginfo-5.5.14-11.3 php5-pcntl-5.5.14-11.3 php5-pcntl-debuginfo-5.5.14-11.3 php5-pdo-5.5.14-11.3 php5-pdo-debuginfo-5.5.14-11.3 php5-pgsql-5.5.14-11.3 php5-pgsql-debuginfo-5.5.14-11.3 php5-pspell-5.5.14-11.3 php5-pspell-debuginfo-5.5.14-11.3 php5-shmop-5.5.14-11.3 php5-shmop-debuginfo-5.5.14-11.3 php5-snmp-5.5.14-11.3 php5-snmp-debuginfo-5.5.14-11.3 php5-soap-5.5.14-11.3 php5-soap-debuginfo-5.5.14-11.3 php5-sockets-5.5.14-11.3 php5-sockets-debuginfo-5.5.14-11.3 php5-sqlite-5.5.14-11.3 php5-sqlite-debuginfo-5.5.14-11.3 php5-suhosin-5.5.14-11.3 php5-suhosin-debuginfo-5.5.14-11.3 php5-sysvmsg-5.5.14-11.3 php5-sysvmsg-debuginfo-5.5.14-11.3 php5-sysvsem-5.5.14-11.3 php5-sysvsem-debuginfo-5.5.14-11.3 php5-sysvshm-5.5.14-11.3 php5-sysvshm-debuginfo-5.5.14-11.3 php5-tokenizer-5.5.14-11.3 php5-tokenizer-debuginfo-5.5.14-11.3 php5-wddx-5.5.14-11.3 php5-wddx-debuginfo-5.5.14-11.3 php5-xmlreader-5.5.14-11.3 php5-xmlreader-debuginfo-5.5.14-11.3 php5-xmlrpc-5.5.14-11.3 php5-xmlrpc-debuginfo-5.5.14-11.3 php5-xmlwriter-5.5.14-11.3 php5-xmlwriter-debuginfo-5.5.14-11.3 php5-xsl-5.5.14-11.3 php5-xsl-debuginfo-5.5.14-11.3 php5-zip-5.5.14-11.3 php5-zip-debuginfo-5.5.14-11.3 php5-zlib-5.5.14-11.3 php5-zlib-debuginfo-5.5.14-11.3 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-11.3 References: http://support.novell.com/security/cve/CVE-2014-8142.html http://support.novell.com/security/cve/CVE-2014-9427.html http://support.novell.com/security/cve/CVE-2015-0231.html http://support.novell.com/security/cve/CVE-2015-0232.html https://bugzilla.suse.com/907519 https://bugzilla.suse.com/910659 https://bugzilla.suse.com/911664 https://bugzilla.suse.com/914690 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0353-1: important: Security update for samba
by opensuse-security＠opensuse.org 23 Feb '15

23 Feb '15

SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0353-1 Rating: important References: #872912 #873922 #876312 #889175 #898031 #908627 #913238 #917376 Cross-References: CVE-2015-0240 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: samba was updated to fix one security issue. This security issue was fixed: - CVE-2015-0240: Don't call talloc_free on an uninitialized pointer (bnc#917376). These non-security issues were fixed: - Fix vfs_snapper DBus string handling (bso#11055, bnc#913238). - Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals (bso#10123). + Set domain/workgroup based on authentication callback value (bso#11059). - pam_winbind: Fix warn_pwd_expire implementation (bso#9056). - nsswitch: Fix soname of linux nss_*.so.2 modules (bso#9299). - Fix profiles tool (bso#9629). - s3-lib: Do not require a password with --use-ccache (bso#10279). - s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control (bso#10949). - s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses (bso#10952). - s3:smb2_server: Allow reauthentication without signing (bso#10958). - s3-smbclient: Return success if we listed the shares (bso#10960). - s3-smbstatus: Fix exit code of profile output (bso#10961). - libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does (bso#10966). - s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention (bso#10982). - Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions' (bso#11006). - idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo (bso#11006). - winbind: Retry LogonControl RPC in ping-dc after session expiration (bso#11034). - yast2-samba-client should be able to specify osName and osVer on AD domain join (bnc#873922). - Lookup FSRVP share snums at runtime rather than storing them persistently (bnc#908627). - Specify soft dependency for network-online.target in Winbind systemd service file (bnc#889175). - Fix spoolss error response marshalling; (bso#10984). - pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state (bso#10472). - s4-dns: Add support for BIND 9.10 (bso#10620). - nmbd fails to accept "--piddir" option; (bso#10711). - S3: source3/smbd/process.c::srv_send_smb() returns true on the error path (bso#10880). - vfs_glusterfs: Remove "integer fd" code and store the glfs pointers (bso#10889). - s3-nmbd: Fix netbios name truncation (bso#10896). - spoolss: Fix handling of bad EnumJobs levels (bso#10898). - spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). - s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). - s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). - pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). - s3-keytab: Fix keytab array NULL termination; (bso#10933). - Cleanup add_string_to_array and usage; (bso#10942). - Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312). - Use the upstream tar ball, as signature verification is now able to handle compressed archives. - Fix leak when closing file descriptor returned from dirfd; (bso#10918). - Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898). - Remove dependency on gpg-offline as signature checking is implemented in the source validator. - s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). - s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). - s3-libads: Add all machine account principals to the keytab; (bso#9985). - s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). - Fix unstrcpy; (bso#10735). - pthreadpool: Slightly serialize jobs; (bso#10779). - s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). - s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). - vfs_media_harmony: Fix a crash bug; (bso#10813). - docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). - nmbd: Send waiting status to systemd; (bso#10816). - libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). - nsswitch: Skip groups we were not able to map; (bso#10824). - s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). - s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). - s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). - idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). - s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). - s3: smb2cli: Query info return length check was reversed; (bso#10848). - registry: Don't leave dangling transactions; (bso#10860). - Prune idle or hung connections older than "winbind request timeout"; (bso#3204); (bnc#872912). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-91=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-91=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-91=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libdcerpc-atsvc-devel-4.1.12-16.1 libdcerpc-atsvc0-4.1.12-16.1 libdcerpc-atsvc0-debuginfo-4.1.12-16.1 libdcerpc-devel-4.1.12-16.1 libdcerpc-samr-devel-4.1.12-16.1 libdcerpc-samr0-4.1.12-16.1 libdcerpc-samr0-debuginfo-4.1.12-16.1 libgensec-devel-4.1.12-16.1 libndr-devel-4.1.12-16.1 libndr-krb5pac-devel-4.1.12-16.1 libndr-nbt-devel-4.1.12-16.1 libndr-standard-devel-4.1.12-16.1 libnetapi-devel-4.1.12-16.1 libpdb-devel-4.1.12-16.1 libregistry-devel-4.1.12-16.1 libsamba-credentials-devel-4.1.12-16.1 libsamba-hostconfig-devel-4.1.12-16.1 libsamba-policy-devel-4.1.12-16.1 libsamba-policy0-4.1.12-16.1 libsamba-policy0-debuginfo-4.1.12-16.1 libsamba-util-devel-4.1.12-16.1 libsamdb-devel-4.1.12-16.1 libsmbclient-devel-4.1.12-16.1 libsmbclient-raw-devel-4.1.12-16.1 libsmbconf-devel-4.1.12-16.1 libsmbldap-devel-4.1.12-16.1 libsmbsharemodes-devel-4.1.12-16.1 libsmbsharemodes0-4.1.12-16.1 libsmbsharemodes0-debuginfo-4.1.12-16.1 libtevent-util-devel-4.1.12-16.1 libwbclient-devel-4.1.12-16.1 samba-core-devel-4.1.12-16.1 samba-debuginfo-4.1.12-16.1 samba-debugsource-4.1.12-16.1 samba-test-devel-4.1.12-16.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libdcerpc-binding0-4.1.12-16.1 libdcerpc-binding0-debuginfo-4.1.12-16.1 libdcerpc0-4.1.12-16.1 libdcerpc0-debuginfo-4.1.12-16.1 libgensec0-4.1.12-16.1 libgensec0-debuginfo-4.1.12-16.1 libndr-krb5pac0-4.1.12-16.1 libndr-krb5pac0-debuginfo-4.1.12-16.1 libndr-nbt0-4.1.12-16.1 libndr-nbt0-debuginfo-4.1.12-16.1 libndr-standard0-4.1.12-16.1 libndr-standard0-debuginfo-4.1.12-16.1 libndr0-4.1.12-16.1 libndr0-debuginfo-4.1.12-16.1 libnetapi0-4.1.12-16.1 libnetapi0-debuginfo-4.1.12-16.1 libpdb0-4.1.12-16.1 libpdb0-debuginfo-4.1.12-16.1 libregistry0-4.1.12-16.1 libregistry0-debuginfo-4.1.12-16.1 libsamba-credentials0-4.1.12-16.1 libsamba-credentials0-debuginfo-4.1.12-16.1 libsamba-hostconfig0-4.1.12-16.1 libsamba-hostconfig0-debuginfo-4.1.12-16.1 libsamba-util0-4.1.12-16.1 libsamba-util0-debuginfo-4.1.12-16.1 libsamdb0-4.1.12-16.1 libsamdb0-debuginfo-4.1.12-16.1 libsmbclient-raw0-4.1.12-16.1 libsmbclient-raw0-debuginfo-4.1.12-16.1 libsmbclient0-4.1.12-16.1 libsmbclient0-debuginfo-4.1.12-16.1 libsmbconf0-4.1.12-16.1 libsmbconf0-debuginfo-4.1.12-16.1 libsmbldap0-4.1.12-16.1 libsmbldap0-debuginfo-4.1.12-16.1 libtevent-util0-4.1.12-16.1 libtevent-util0-debuginfo-4.1.12-16.1 libwbclient0-4.1.12-16.1 libwbclient0-debuginfo-4.1.12-16.1 samba-4.1.12-16.1 samba-client-4.1.12-16.1 samba-client-debuginfo-4.1.12-16.1 samba-debuginfo-4.1.12-16.1 samba-debugsource-4.1.12-16.1 samba-libs-4.1.12-16.1 samba-libs-debuginfo-4.1.12-16.1 samba-winbind-4.1.12-16.1 samba-winbind-debuginfo-4.1.12-16.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libdcerpc-binding0-32bit-4.1.12-16.1 libdcerpc-binding0-debuginfo-32bit-4.1.12-16.1 libdcerpc0-32bit-4.1.12-16.1 libdcerpc0-debuginfo-32bit-4.1.12-16.1 libgensec0-32bit-4.1.12-16.1 libgensec0-debuginfo-32bit-4.1.12-16.1 libndr-krb5pac0-32bit-4.1.12-16.1 libndr-krb5pac0-debuginfo-32bit-4.1.12-16.1 libndr-nbt0-32bit-4.1.12-16.1 libndr-nbt0-debuginfo-32bit-4.1.12-16.1 libndr-standard0-32bit-4.1.12-16.1 libndr-standard0-debuginfo-32bit-4.1.12-16.1 libndr0-32bit-4.1.12-16.1 libndr0-debuginfo-32bit-4.1.12-16.1 libnetapi0-32bit-4.1.12-16.1 libnetapi0-debuginfo-32bit-4.1.12-16.1 libpdb0-32bit-4.1.12-16.1 libpdb0-debuginfo-32bit-4.1.12-16.1 libsamba-credentials0-32bit-4.1.12-16.1 libsamba-credentials0-debuginfo-32bit-4.1.12-16.1 libsamba-hostconfig0-32bit-4.1.12-16.1 libsamba-hostconfig0-debuginfo-32bit-4.1.12-16.1 libsamba-util0-32bit-4.1.12-16.1 libsamba-util0-debuginfo-32bit-4.1.12-16.1 libsamdb0-32bit-4.1.12-16.1 libsamdb0-debuginfo-32bit-4.1.12-16.1 libsmbclient-raw0-32bit-4.1.12-16.1 libsmbclient-raw0-debuginfo-32bit-4.1.12-16.1 libsmbclient0-32bit-4.1.12-16.1 libsmbclient0-debuginfo-32bit-4.1.12-16.1 libsmbconf0-32bit-4.1.12-16.1 libsmbconf0-debuginfo-32bit-4.1.12-16.1 libsmbldap0-32bit-4.1.12-16.1 libsmbldap0-debuginfo-32bit-4.1.12-16.1 libtevent-util0-32bit-4.1.12-16.1 libtevent-util0-debuginfo-32bit-4.1.12-16.1 libwbclient0-32bit-4.1.12-16.1 libwbclient0-debuginfo-32bit-4.1.12-16.1 samba-32bit-4.1.12-16.1 samba-client-32bit-4.1.12-16.1 samba-client-debuginfo-32bit-4.1.12-16.1 samba-debuginfo-32bit-4.1.12-16.1 samba-libs-32bit-4.1.12-16.1 samba-libs-debuginfo-32bit-4.1.12-16.1 samba-winbind-32bit-4.1.12-16.1 samba-winbind-debuginfo-32bit-4.1.12-16.1 - SUSE Linux Enterprise Server 12 (noarch): samba-doc-4.1.12-16.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libdcerpc-binding0-32bit-4.1.12-16.1 libdcerpc-binding0-4.1.12-16.1 libdcerpc-binding0-debuginfo-32bit-4.1.12-16.1 libdcerpc-binding0-debuginfo-4.1.12-16.1 libdcerpc0-32bit-4.1.12-16.1 libdcerpc0-4.1.12-16.1 libdcerpc0-debuginfo-32bit-4.1.12-16.1 libdcerpc0-debuginfo-4.1.12-16.1 libgensec0-32bit-4.1.12-16.1 libgensec0-4.1.12-16.1 libgensec0-debuginfo-32bit-4.1.12-16.1 libgensec0-debuginfo-4.1.12-16.1 libndr-krb5pac0-32bit-4.1.12-16.1 libndr-krb5pac0-4.1.12-16.1 libndr-krb5pac0-debuginfo-32bit-4.1.12-16.1 libndr-krb5pac0-debuginfo-4.1.12-16.1 libndr-nbt0-32bit-4.1.12-16.1 libndr-nbt0-4.1.12-16.1 libndr-nbt0-debuginfo-32bit-4.1.12-16.1 libndr-nbt0-debuginfo-4.1.12-16.1 libndr-standard0-32bit-4.1.12-16.1 libndr-standard0-4.1.12-16.1 libndr-standard0-debuginfo-32bit-4.1.12-16.1 libndr-standard0-debuginfo-4.1.12-16.1 libndr0-32bit-4.1.12-16.1 libndr0-4.1.12-16.1 libndr0-debuginfo-32bit-4.1.12-16.1 libndr0-debuginfo-4.1.12-16.1 libnetapi0-32bit-4.1.12-16.1 libnetapi0-4.1.12-16.1 libnetapi0-debuginfo-32bit-4.1.12-16.1 libnetapi0-debuginfo-4.1.12-16.1 libpdb0-32bit-4.1.12-16.1 libpdb0-4.1.12-16.1 libpdb0-debuginfo-32bit-4.1.12-16.1 libpdb0-debuginfo-4.1.12-16.1 libregistry0-4.1.12-16.1 libregistry0-debuginfo-4.1.12-16.1 libsamba-credentials0-32bit-4.1.12-16.1 libsamba-credentials0-4.1.12-16.1 libsamba-credentials0-debuginfo-32bit-4.1.12-16.1 libsamba-credentials0-debuginfo-4.1.12-16.1 libsamba-hostconfig0-32bit-4.1.12-16.1 libsamba-hostconfig0-4.1.12-16.1 libsamba-hostconfig0-debuginfo-32bit-4.1.12-16.1 libsamba-hostconfig0-debuginfo-4.1.12-16.1 libsamba-util0-32bit-4.1.12-16.1 libsamba-util0-4.1.12-16.1 libsamba-util0-debuginfo-32bit-4.1.12-16.1 libsamba-util0-debuginfo-4.1.12-16.1 libsamdb0-32bit-4.1.12-16.1 libsamdb0-4.1.12-16.1 libsamdb0-debuginfo-32bit-4.1.12-16.1 libsamdb0-debuginfo-4.1.12-16.1 libsmbclient-raw0-32bit-4.1.12-16.1 libsmbclient-raw0-4.1.12-16.1 libsmbclient-raw0-debuginfo-32bit-4.1.12-16.1 libsmbclient-raw0-debuginfo-4.1.12-16.1 libsmbclient0-32bit-4.1.12-16.1 libsmbclient0-4.1.12-16.1 libsmbclient0-debuginfo-32bit-4.1.12-16.1 libsmbclient0-debuginfo-4.1.12-16.1 libsmbconf0-32bit-4.1.12-16.1 libsmbconf0-4.1.12-16.1 libsmbconf0-debuginfo-32bit-4.1.12-16.1 libsmbconf0-debuginfo-4.1.12-16.1 libsmbldap0-32bit-4.1.12-16.1 libsmbldap0-4.1.12-16.1 libsmbldap0-debuginfo-32bit-4.1.12-16.1 libsmbldap0-debuginfo-4.1.12-16.1 libtevent-util0-32bit-4.1.12-16.1 libtevent-util0-4.1.12-16.1 libtevent-util0-debuginfo-32bit-4.1.12-16.1 libtevent-util0-debuginfo-4.1.12-16.1 libwbclient0-32bit-4.1.12-16.1 libwbclient0-4.1.12-16.1 libwbclient0-debuginfo-32bit-4.1.12-16.1 libwbclient0-debuginfo-4.1.12-16.1 samba-32bit-4.1.12-16.1 samba-4.1.12-16.1 samba-client-32bit-4.1.12-16.1 samba-client-4.1.12-16.1 samba-client-debuginfo-32bit-4.1.12-16.1 samba-client-debuginfo-4.1.12-16.1 samba-debuginfo-32bit-4.1.12-16.1 samba-debuginfo-4.1.12-16.1 samba-debugsource-4.1.12-16.1 samba-libs-32bit-4.1.12-16.1 samba-libs-4.1.12-16.1 samba-libs-debuginfo-32bit-4.1.12-16.1 samba-libs-debuginfo-4.1.12-16.1 samba-winbind-32bit-4.1.12-16.1 samba-winbind-4.1.12-16.1 samba-winbind-debuginfo-32bit-4.1.12-16.1 samba-winbind-debuginfo-4.1.12-16.1 - SUSE Linux Enterprise Desktop 12 (noarch): samba-doc-4.1.12-16.1 References: http://support.novell.com/security/cve/CVE-2015-0240.html https://bugzilla.suse.com/872912 https://bugzilla.suse.com/873922 https://bugzilla.suse.com/876312 https://bugzilla.suse.com/889175 https://bugzilla.suse.com/898031 https://bugzilla.suse.com/908627 https://bugzilla.suse.com/913238 https://bugzilla.suse.com/917376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0345-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 21 Feb '15

21 Feb '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0345-1 Rating: important References: #901223 #901239 #904889 #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: java-1_6_0-ibm was updated to version 1.6.0_sr16.3 to fix 20 security issues: * CVE-2014-8891: Unspecified vulnerability (bnc#916266) * CVE-2014-8892: Unspecified vulnerability (bnc#916265) * CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache (bnc#904889). * CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). * CVE-2014-6513: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (bnc#901239). * CVE-2014-6503: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (bnc#901239). * CVE-2014-6532: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (bnc#901239). * CVE-2014-4288: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6493: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6492: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6458: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6466: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6515: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6511: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (bnc#901239). * CVE-2014-6531: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6512: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6457: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#901239). * CVE-2014-6502: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6558: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (bnc#901239). Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.9.1 java-1_6_0-ibm-devel-1.6.0_sr16.3-0.9.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.9.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.9.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.3-0.9.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.3-0.9.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.9.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.3-0.9.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.3-0.9.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.9.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/901223 https://bugzilla.suse.com/901239 https://bugzilla.suse.com/904889 https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=a992e300008dd2cf884e0b1fa92… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0344-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 21 Feb '15

21 Feb '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0344-1 Rating: important References: #891701 #901223 #901239 #904889 #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: java-1_7_0-ibm was updated to version 1.7.0_sr7.3 to fix 37 security issues: * CVE-2014-8891: Unspecified vulnerability (bnc#916266) * CVE-2014-8892: Unspecified vulnerability (bnc#916265) * CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache (bnc#904889). * CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). * CVE-2014-6513: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (bnc#901239). * CVE-2014-6456: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors (bnc#901239). * CVE-2014-6503: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (bnc#901239). * CVE-2014-6532: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (bnc#901239). * CVE-2014-4288: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6493: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6492: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6458: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6466: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6476: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527 (bnc#901239). * CVE-2014-6515: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6511: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (bnc#901239). * CVE-2014-6531: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6512: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6457: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#901239). * CVE-2014-6527: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476 (bnc#901239). * CVE-2014-6502: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6558: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (bnc#901239). * CVE-2014-4227: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#891701). * CVE-2014-4262: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4219: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#891701). * CVE-2014-4209: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX (bnc#891701). * CVE-2014-4220: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208 (bnc#891701). * CVE-2014-4268: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#891701). * CVE-2014-4218: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4252: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security (bnc#891701). * CVE-2014-4266: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability (bnc#891701). * CVE-2014-4265: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment (bnc#891701). * CVE-2014-4221: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4263: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement (bnc#891701). * CVE-2014-4244: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security (bnc#891701). * CVE-2014-4208: Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220 (bnc#891701). Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_7_0-ibm=10324 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_7_0-ibm-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.4 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x): java-1_7_0-ibm-1.7.0_sr8.10-0.6.5 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.5 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.5 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/891701 https://bugzilla.suse.com/901223 https://bugzilla.suse.com/901239 https://bugzilla.suse.com/904889 https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=89dfde7681a3e8ac7832df50d44… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0343-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 21 Feb '15

21 Feb '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0343-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_7_0-ibm was updated to fix two security issues: * CVE-2014-8891: Unspecified vulnerability * CVE-2014-8892: Unspecified vulnerability Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_6_0-ibm=10299 sdksp3-java-1_7_0-ibm=10300 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_6_0-ibm=10299 slessp3-java-1_7_0-ibm=10300 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_6_0-ibm=10299 slessp3-java-1_7_0-ibm=10300 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=d0fabcb64d4c31a5f5c8a208549… http://download.suse.com/patch/finder/?keywords=dd24d5afde779e1651d8cfeb6cd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0336-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 19 Feb '15

19 Feb '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0336-1 Rating: important References: #914041 Cross-References: CVE-2014-3566 CVE-2014-6549 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 CVE-2015-0421 CVE-2015-0437 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. It includes one version update. Description: java-1_7_0-openjdk was updated to fix 19 security issues. Details are available at http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#A ppendixJAVA <http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html# AppendixJAVA> Security Issues: * CVE-2014-6601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6601> * CVE-2015-0412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412> * CVE-2014-6549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549> * CVE-2015-0408 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408> * CVE-2015-0395 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395> * CVE-2015-0437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437> * CVE-2015-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403> * CVE-2015-0421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0421> * CVE-2015-0406 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406> * CVE-2015-0383 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0383> * CVE-2015-0400 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400> * CVE-2015-0407 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407> * CVE-2015-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410> * CVE-2014-6587 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-6593 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593> * CVE-2014-6585 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585> * CVE-2014-6591 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591> * CVE-2015-0413 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0413> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk=10286 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.7.0.75]: java-1_7_0-openjdk-1.7.0.75-0.7.1 java-1_7_0-openjdk-demo-1.7.0.75-0.7.1 java-1_7_0-openjdk-devel-1.7.0.75-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-6549.html http://support.novell.com/security/cve/CVE-2014-6585.html http://support.novell.com/security/cve/CVE-2014-6587.html http://support.novell.com/security/cve/CVE-2014-6591.html http://support.novell.com/security/cve/CVE-2014-6593.html http://support.novell.com/security/cve/CVE-2014-6601.html http://support.novell.com/security/cve/CVE-2015-0383.html http://support.novell.com/security/cve/CVE-2015-0395.html http://support.novell.com/security/cve/CVE-2015-0400.html http://support.novell.com/security/cve/CVE-2015-0403.html http://support.novell.com/security/cve/CVE-2015-0406.html http://support.novell.com/security/cve/CVE-2015-0407.html http://support.novell.com/security/cve/CVE-2015-0408.html http://support.novell.com/security/cve/CVE-2015-0410.html http://support.novell.com/security/cve/CVE-2015-0412.html http://support.novell.com/security/cve/CVE-2015-0413.html http://support.novell.com/security/cve/CVE-2015-0421.html http://support.novell.com/security/cve/CVE-2015-0437.html https://bugzilla.suse.com/914041 http://download.suse.com/patch/finder/?keywords=8d9a18b0ce3289f724b64f4b4dc… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0322-1: important: Security update for xntp
by opensuse-security＠opensuse.org 19 Feb '15

19 Feb '15

SUSE Security Update: Security update for xntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0322-1 Rating: important References: #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: xntp has been updated to fix two security issues: * CVE-2014-9298: ::1 can be spoofed on some OSes, so ACLs based on IPv6 ::1 addresses can be bypassed (bnc#911792). * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential info leak (bnc#911792). Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): xntp-4.2.4p3-48.27.1 xntp-doc-4.2.4p3-48.27.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/911792 http://download.suse.com/patch/finder/?keywords=8c2302f77b01413a386c6a33bf8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0306-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0306-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-ibm was updated to fix two security issues. These security issues were fixed: - CVE-2014-8892: Unspecified vulnerability (bnc#916265). - CVE-2014-8891: Unspecified vulnerability (bnc#916266). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-79=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-12.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-12.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-12.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-12.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0304-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0304-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_7_1-ibm was updated to fix two security issues. These security issues were fixed: - CVE-2014-8892: Unspecified vulnerability (bnc#916265). - CVE-2014-8891: Unspecified vulnerability (bnc#916266). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-80=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-80=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr2.10-8.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr2.10-8.1 java-1_7_1-ibm-jdbc-1.7.1_sr2.10-8.1 - SUSE Linux Enterprise Server 12 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr2.10-8.1 java-1_7_1-ibm-plugin-1.7.1_sr2.10-8.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0298-1: important: Security update for clamav
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0298-1 Rating: important References: #915512 #916214 #916215 #916217 Cross-References: CVE-2014-9328 CVE-2015-1461 CVE-2015-1462 CVE-2015-1463 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: clamav was updated to version 0.98.6 to fix four security issues. These security issues have been fixed: * CVE-2015-1462: ClamAV allowed remote attackers to have unspecified impact via a crafted upx packer file, related to a heap out of bounds condition (bnc#916214). * CVE-2015-1463: ClamAV allowed remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an incorrect compiler optimization (bnc#916215). * CVE-2014-9328: ClamAV allowed remote attackers to have unspecified impact via a crafted upack packer file, related to a heap out of bounds condition (bnc#915512). * CVE-2015-1461: ClamAV allowed remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a heap out of bounds condition (bnc#916217). Security Issues: * CVE-2015-1462 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1462> * CVE-2014-9328 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9328> * CVE-2015-1463 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1463> * CVE-2015-1461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1461> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-clamav=10283 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-clamav=10283 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-clamav=10285 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-clamav=10284 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-clamav=10283 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 References: http://support.novell.com/security/cve/CVE-2014-9328.html http://support.novell.com/security/cve/CVE-2015-1461.html http://support.novell.com/security/cve/CVE-2015-1462.html http://support.novell.com/security/cve/CVE-2015-1463.html https://bugzilla.suse.com/915512 https://bugzilla.suse.com/916214 https://bugzilla.suse.com/916215 https://bugzilla.suse.com/916217 http://download.suse.com/patch/finder/?keywords=2f44be276ad7a4e53a81812520e… http://download.suse.com/patch/finder/?keywords=b856018fc4dcd95c039167b1ea1… http://download.suse.com/patch/finder/?keywords=b857e6f07106efda6eeb4c84264… http://download.suse.com/patch/finder/?keywords=cabd1033f09ef394f7aad5c3fbd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0259-3: important: Security update for ntp
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0259-3 Rating: important References: #910764 #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: ntp has been updated to fix four security issues: * CVE-2014-9294: ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9293: The config_auth function, when an auth key is not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9298: ::1 can be spoofed on some operating systems, so ACLs based on IPv6 ::1 addresses could be bypassed. (bsc#910764) * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential information leak. (bsc#910764) Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-ntp=10307 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/910764 https://bugzilla.suse.com/911792 http://download.suse.com/patch/finder/?keywords=900e7482290b4309d9dd461085b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0011-2: important: Security update for bind
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0011-2 Rating: important References: #743758 #882511 #908994 Cross-References: CVE-2014-8500 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: This update provides bind 9.9.6P1, which fixes a defect in delegation handling that could be exploited to crash named. (CVE-2014-8500, bsc#908994) Additionally, two non-security issues have been fixed: * Fix handling of TXT records in ldapdump. (bsc#743758) * Fix a multithread issue with IXFR. (bsc#882511) Security Issues: * CVE-2014-8500 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500> Indications: Everybody should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-bind=10203 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.5.5 bind-chrootenv-9.9.6P1-0.5.5 bind-devel-9.9.6P1-0.5.5 bind-doc-9.9.6P1-0.5.5 bind-libs-9.9.6P1-0.5.5 bind-utils-9.9.6P1-0.5.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.5.5 References: http://support.novell.com/security/cve/CVE-2014-8500.html https://bugzilla.suse.com/743758 https://bugzilla.suse.com/882511 https://bugzilla.suse.com/908994 http://download.suse.com/patch/finder/?keywords=93a0d67b3fb1cddabb9d852b78c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0290-2: important: Security update for krb5
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0290-2 Rating: important References: #897874 #898439 #912002 Cross-References: CVE-2014-5351 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Build System Kit 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: MIT kerberos krb5 was updated to fix several security issues and bugs. Security issues fixed: CVE-2014-5351: The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) sent old keys in a response to a -randkey -keepold request, which allowed remote authenticated users to forge tickets by leveraging administrative access. CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller was left with a security context handle containing a dangling pointer. Further uses of this handle would have resulted in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind were vulnerable as they can be instructed to call gss_process_context_token(). CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may have performed use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications might also been vulnerable if they contain insufficiently defensive XDR functions. CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepted authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm. CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients. Bugs fixed: - Work around replay cache creation race; (bnc#898439). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-74=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-74=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-74=1 - SUSE Linux Enterprise Build System Kit 12: zypper in -t patch SUSE-SLE-BSK-12-2015-74=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): krb5-debuginfo-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-devel-1.12.1-9.1 - SUSE Linux Enterprise Server 12 (x86_64): krb5-1.12.1-9.1 krb5-32bit-1.12.1-9.1 krb5-client-1.12.1-9.1 krb5-client-debuginfo-1.12.1-9.1 krb5-debuginfo-1.12.1-9.1 krb5-debuginfo-32bit-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-doc-1.12.1-9.1 krb5-plugin-kdb-ldap-1.12.1-9.1 krb5-plugin-kdb-ldap-debuginfo-1.12.1-9.1 krb5-plugin-preauth-otp-1.12.1-9.1 krb5-plugin-preauth-otp-debuginfo-1.12.1-9.1 krb5-plugin-preauth-pkinit-1.12.1-9.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.1-9.1 krb5-server-1.12.1-9.1 krb5-server-debuginfo-1.12.1-9.1 - SUSE Linux Enterprise Desktop 12 (x86_64): krb5-1.12.1-9.1 krb5-32bit-1.12.1-9.1 krb5-client-1.12.1-9.1 krb5-client-debuginfo-1.12.1-9.1 krb5-debuginfo-1.12.1-9.1 krb5-debuginfo-32bit-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 - SUSE Linux Enterprise Build System Kit 12 (x86_64): krb5-mini-1.12.1-9.1 krb5-mini-debuginfo-1.12.1-9.1 krb5-mini-debugsource-1.12.1-9.1 krb5-mini-devel-1.12.1-9.1 References: http://support.novell.com/security/cve/CVE-2014-5351.html http://support.novell.com/security/cve/CVE-2014-5352.html http://support.novell.com/security/cve/CVE-2014-9421.html http://support.novell.com/security/cve/CVE-2014-9422.html http://support.novell.com/security/cve/CVE-2014-9423.html https://bugzilla.suse.com/897874 https://bugzilla.suse.com/898439 https://bugzilla.suse.com/912002 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0290-1: important: Security update for krb5
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0290-1 Rating: important References: #897874 #898439 #912002 Cross-References: CVE-2014-5351 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Build System Kit 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: MIT kerberos krb5 was updated to fix several security issues and bugs. Security issues fixed: CVE-2014-5351: The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) sent old keys in a response to a -randkey -keepold request, which allowed remote authenticated users to forge tickets by leveraging administrative access. CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller was left with a security context handle containing a dangling pointer. Further uses of this handle would have resulted in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind were vulnerable as they can be instructed to call gss_process_context_token(). CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may have performed use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications might also been vulnerable if they contain insufficiently defensive XDR functions. CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepted authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm. CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients. Bugs fixed: - Work around replay cache creation race; (bnc#898439). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-74=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-74=1 - SUSE Linux Enterprise Build System Kit 12: zypper in -t patch SUSE-SLE-BSK-12-2015-74=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x): krb5-debuginfo-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-devel-1.12.1-9.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x): krb5-1.12.1-9.1 krb5-client-1.12.1-9.1 krb5-client-debuginfo-1.12.1-9.1 krb5-debuginfo-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-doc-1.12.1-9.1 krb5-plugin-kdb-ldap-1.12.1-9.1 krb5-plugin-kdb-ldap-debuginfo-1.12.1-9.1 krb5-plugin-preauth-otp-1.12.1-9.1 krb5-plugin-preauth-otp-debuginfo-1.12.1-9.1 krb5-plugin-preauth-pkinit-1.12.1-9.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.1-9.1 krb5-server-1.12.1-9.1 krb5-server-debuginfo-1.12.1-9.1 - SUSE Linux Enterprise Server 12 (s390x): krb5-32bit-1.12.1-9.1 krb5-debuginfo-32bit-1.12.1-9.1 - SUSE Linux Enterprise Build System Kit 12 (ppc64le s390x): krb5-mini-1.12.1-9.1 krb5-mini-debuginfo-1.12.1-9.1 krb5-mini-debugsource-1.12.1-9.1 krb5-mini-devel-1.12.1-9.1 References: http://support.novell.com/security/cve/CVE-2014-5351.html http://support.novell.com/security/cve/CVE-2014-5352.html http://support.novell.com/security/cve/CVE-2014-9421.html http://support.novell.com/security/cve/CVE-2014-9422.html http://support.novell.com/security/cve/CVE-2014-9423.html https://bugzilla.suse.com/897874 https://bugzilla.suse.com/898439 https://bugzilla.suse.com/912002 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0259-2: important: Security update for ntp
by opensuse-security＠opensuse.org 13 Feb '15

13 Feb '15

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0259-2 Rating: important References: #910764 #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: ntp has been updated to fix four security issues: * CVE-2014-9294: ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9293: The config_auth function, when an auth key is not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9298: ::1 can be spoofed on some operating systems, so ACLs based on IPv6 ::1 addresses could be bypassed. (bsc#910764) * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential information leak. (bsc#910764) Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-ntp=10308 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/910764 https://bugzilla.suse.com/911792 http://download.suse.com/patch/finder/?keywords=e5a9d59f9998dd1feedb5ea5b22… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0285-1: important: Security update for clamav
by opensuse-security＠opensuse.org 13 Feb '15

13 Feb '15

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0285-1 Rating: important References: #915512 #916214 #916215 #916217 Cross-References: CVE-2014-9328 CVE-2015-1461 CVE-2015-1462 CVE-2015-1463 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: clamav was updated to version 0.98.6 that fixes bugs and several security issues: * bsc#916217, CVE-2015-1461: Remote attackers can have unspecified impact via Yoda's crypter or mew packer files. * bsc#916214, CVE-2015-1462: Unspecified impact via acrafted upx packer file. * bsc#916215, CVE-2015-1463: Remote attackers can cause a denial of service via a crafted petite packer file. * bsc#915512, CVE-2014-9328: heap out of bounds condition with crafted upack packer files. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-147=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-147=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.98.6-2.13.1 clamav-debuginfo-0.98.6-2.13.1 clamav-debugsource-0.98.6-2.13.1 - openSUSE 13.1 (i586 x86_64): clamav-0.98.6-30.1 clamav-debuginfo-0.98.6-30.1 clamav-debugsource-0.98.6-30.1 References: http://support.novell.com/security/cve/CVE-2014-9328.html http://support.novell.com/security/cve/CVE-2015-1461.html http://support.novell.com/security/cve/CVE-2015-1462.html http://support.novell.com/security/cve/CVE-2015-1463.html https://bugzilla.suse.com/915512 https://bugzilla.suse.com/916214 https://bugzilla.suse.com/916215 https://bugzilla.suse.com/916217 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0274-1: important: Security update for ntp
by opensuse-security＠opensuse.org 12 Feb '15

12 Feb '15

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0274-1 Rating: important References: #910764 #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: ntp was updated to fix four security issues. These security issues were fixed: - CVE-2014-9294: util/ntp-keygen.c in ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack (bnc#910764 911792). - CVE-2014-9293: The config_auth function in ntpd, when an auth key was not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack (bnc#910764 911792). - CVE-2014-9298: ::1 can be spoofed on some OSes, so ACLs based on IPv6 ::1 addresses could be bypassed (bnc#911792). - CVE-2014-9297: Information leak by not properly checking a length in several places in ntp_crypto.c (bnc#911792). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-70=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-70=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ntp-4.2.6p5-37.2 ntp-debuginfo-4.2.6p5-37.2 ntp-debugsource-4.2.6p5-37.2 ntp-doc-4.2.6p5-37.2 - SUSE Linux Enterprise Desktop 12 (x86_64): ntp-4.2.6p5-37.2 ntp-debuginfo-4.2.6p5-37.2 ntp-debugsource-4.2.6p5-37.2 ntp-doc-4.2.6p5-37.2 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/910764 https://bugzilla.suse.com/911792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0259-1: important: Security update for ntp
by opensuse-security＠opensuse.org 12 Feb '15

12 Feb '15

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0259-1 Rating: important References: #910764 #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: ntp has been updated to fix four security issues: * CVE-2014-9294: ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9293: The config_auth function, when an auth key is not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9298: ::1 can be spoofed on some operating systems, so ACLs based on IPv6 ::1 addresses could be bypassed. (bsc#910764) * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential information leak. (bsc#910764) Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-ntp=10293 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-ntp=10293 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-ntp=10293 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/show_bug.cgi?id=910764 https://bugzilla.suse.com/show_bug.cgi?id=911792 http://download.suse.com/patch/finder/?keywords=3ac2fa202f513bac69fa58d8eb7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0257-1: important: Security update for krb5
by opensuse-security＠opensuse.org 11 Feb '15

11 Feb '15

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0257-1 Rating: important References: #872912 #906557 #912002 Cross-References: CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: krb5 has been updated to fix four security issues: * CVE-2014-5352: gss_process_context_token() incorrectly frees context (bsc#912002) * CVE-2014-9421: kadmind doubly frees partial deserialization results (bsc#912002) * CVE-2014-9422: kadmind incorrectly validates server principal name (bsc#912002) * CVE-2014-9423: libgssrpc server applications leak uninitialized bytes (bsc#912002) Additionally, these non-security issues have been fixed: * Winbind process hangs indefinitely without DC. (bsc#872912) * Hanging winbind processes. (bsc#906557) Security Issues: * CVE-2014-5352 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352> * CVE-2014-9421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421> * CVE-2014-9422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422> * CVE-2014-9423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-krb5-20150206=10282 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-krb5-20150206=10282 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-krb5-20150206=10282 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-krb5-20150206=10282 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): krb5-devel-1.6.3-133.49.66.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): krb5-devel-32bit-1.6.3-133.49.66.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): krb5-server-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): krb5-1.6.3-133.49.66.1 krb5-apps-clients-1.6.3-133.49.66.1 krb5-apps-servers-1.6.3-133.49.66.1 krb5-client-1.6.3-133.49.66.1 krb5-plugin-kdb-ldap-1.6.3-133.49.66.1 krb5-plugin-preauth-pkinit-1.6.3-133.49.66.1 krb5-server-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): krb5-32bit-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (noarch): krb5-doc-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): krb5-1.6.3-133.49.66.1 krb5-apps-clients-1.6.3-133.49.66.1 krb5-apps-servers-1.6.3-133.49.66.1 krb5-client-1.6.3-133.49.66.1 krb5-plugin-kdb-ldap-1.6.3-133.49.66.1 krb5-plugin-preauth-pkinit-1.6.3-133.49.66.1 krb5-server-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): krb5-32bit-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 (noarch): krb5-doc-1.6.3-133.49.66.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): krb5-x86-1.6.3-133.49.66.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): krb5-1.6.3-133.49.66.1 krb5-client-1.6.3-133.49.66.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): krb5-32bit-1.6.3-133.49.66.1 References: http://support.novell.com/security/cve/CVE-2014-5352.html http://support.novell.com/security/cve/CVE-2014-9421.html http://support.novell.com/security/cve/CVE-2014-9422.html http://support.novell.com/security/cve/CVE-2014-9423.html https://bugzilla.suse.com/show_bug.cgi?id=872912 https://bugzilla.suse.com/show_bug.cgi?id=906557 https://bugzilla.suse.com/show_bug.cgi?id=912002 http://download.suse.com/patch/finder/?keywords=127e426050f20989c3c73bc3d3c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0256-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 Feb '15

11 Feb '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0256-1 Rating: important References: #826717 #866902 #882089 #889526 #896023 #897906 #898772 #900292 #901317 #903357 #903359 #903850 #903967 #903970 #904255 #905465 #905467 #906439 #906996 #910681 Cross-References: CVE-2013-3495 CVE-2014-5146 CVE-2014-5149 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 CVE-2014-9065 CVE-2014-9066 CVE-2015-0361 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 9 fixes is now available. Description: The XEN virtualization was updated to fix bugs and security issues: Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use after free on hvm guest teardown CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation CVE-2014-9030: XSA-113: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode hypercall argument translation CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86 emulation of far branches CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU update hypercalls CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu operations are not preemptible Bugs fixed: - Restore missing fixes from block-dmmd script - bnc#904255 - XEN boot hangs in early boot on UEFI system - Fix missing banner by restoring figlet program - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore - bnc#903359 - Temporary migration name is not cleaned up after migration - bnc#903850 - Xen: guest user mode triggerable VM exits not handled by hypervisor - bnc#866902 - Xen save/restore of HVM guests cuts off disk and networking - bnc#901317 - increase limit domUloader to 32MB - bnc#898772 - SLES 12 RC3 - XEN Host crashes when assigning non-VF device (SR-IOV) to guest - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bsc#900292 - xl: change default dump directory - Update xen2libvirt.py to better detect and handle file formats - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bnc#897906 - libxc: check return values on mmap() and madvise() on xc_alloc_hypercall_buffer() - bnc#896023 - Adjust xentop column layout Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-129=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.1_08-9.1 xen-devel-4.4.1_08-9.1 xen-libs-4.4.1_08-9.1 xen-libs-debuginfo-4.4.1_08-9.1 xen-tools-domU-4.4.1_08-9.1 xen-tools-domU-debuginfo-4.4.1_08-9.1 - openSUSE 13.2 (x86_64): xen-4.4.1_08-9.1 xen-doc-html-4.4.1_08-9.1 xen-kmp-default-4.4.1_08_k3.16.7_7-9.1 xen-kmp-default-debuginfo-4.4.1_08_k3.16.7_7-9.1 xen-kmp-desktop-4.4.1_08_k3.16.7_7-9.1 xen-kmp-desktop-debuginfo-4.4.1_08_k3.16.7_7-9.1 xen-libs-32bit-4.4.1_08-9.1 xen-libs-debuginfo-32bit-4.4.1_08-9.1 xen-tools-4.4.1_08-9.1 xen-tools-debuginfo-4.4.1_08-9.1 References: http://support.novell.com/security/cve/CVE-2013-3495.html http://support.novell.com/security/cve/CVE-2014-5146.html http://support.novell.com/security/cve/CVE-2014-5149.html http://support.novell.com/security/cve/CVE-2014-8594.html http://support.novell.com/security/cve/CVE-2014-8595.html http://support.novell.com/security/cve/CVE-2014-8866.html http://support.novell.com/security/cve/CVE-2014-8867.html http://support.novell.com/security/cve/CVE-2014-9030.html http://support.novell.com/security/cve/CVE-2014-9065.html http://support.novell.com/security/cve/CVE-2014-9066.html http://support.novell.com/security/cve/CVE-2015-0361.html https://bugzilla.suse.com/show_bug.cgi?id=826717 https://bugzilla.suse.com/show_bug.cgi?id=866902 https://bugzilla.suse.com/show_bug.cgi?id=882089 https://bugzilla.suse.com/show_bug.cgi?id=889526 https://bugzilla.suse.com/show_bug.cgi?id=896023 https://bugzilla.suse.com/show_bug.cgi?id=897906 https://bugzilla.suse.com/show_bug.cgi?id=898772 https://bugzilla.suse.com/show_bug.cgi?id=900292 https://bugzilla.suse.com/show_bug.cgi?id=901317 https://bugzilla.suse.com/show_bug.cgi?id=903357 https://bugzilla.suse.com/show_bug.cgi?id=903359 https://bugzilla.suse.com/show_bug.cgi?id=903850 https://bugzilla.suse.com/show_bug.cgi?id=903967 https://bugzilla.suse.com/show_bug.cgi?id=903970 https://bugzilla.suse.com/show_bug.cgi?id=904255 https://bugzilla.suse.com/show_bug.cgi?id=905465 https://bugzilla.suse.com/show_bug.cgi?id=905467 https://bugzilla.suse.com/show_bug.cgi?id=906439 https://bugzilla.suse.com/show_bug.cgi?id=906996 https://bugzilla.suse.com/show_bug.cgi?id=910681 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0239-1: critical: Security update for flash-player, flash-player-gnome, flash-player-kde4
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

SUSE Security Update: Security update for flash-player, flash-player-gnome, flash-player-kde4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0239-1 Rating: critical References: #915918 Cross-References: CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. It includes one version update. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Security Issues: * CVE-2015-0313 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0313> * CVE-2015-0314 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0314> * CVE-2015-0315 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0315> * CVE-2015-0316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0316> * CVE-2015-0317 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0317> * CVE-2015-0318 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0318> * CVE-2015-0319 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0319> * CVE-2015-0320 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0320> * CVE-2015-0321 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0321> * CVE-2015-0322 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0322> * CVE-2015-0323 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0323> * CVE-2015-0324 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0324> * CVE-2015-0325 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0325> * CVE-2015-0326 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0326> * CVE-2015-0327 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0327> * CVE-2015-0328 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0328> * CVE-2015-0329 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0329> * CVE-2015-0330 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0330> Contraindications: Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player=10287 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.442]: flash-player-11.2.202.442-0.3.1 flash-player-gnome-11.2.202.442-0.3.1 flash-player-kde4-11.2.202.442-0.3.1 References: http://support.novell.com/security/cve/CVE-2015-0313.html http://support.novell.com/security/cve/CVE-2015-0314.html http://support.novell.com/security/cve/CVE-2015-0315.html http://support.novell.com/security/cve/CVE-2015-0316.html http://support.novell.com/security/cve/CVE-2015-0317.html http://support.novell.com/security/cve/CVE-2015-0318.html http://support.novell.com/security/cve/CVE-2015-0319.html http://support.novell.com/security/cve/CVE-2015-0320.html http://support.novell.com/security/cve/CVE-2015-0321.html http://support.novell.com/security/cve/CVE-2015-0322.html http://support.novell.com/security/cve/CVE-2015-0323.html http://support.novell.com/security/cve/CVE-2015-0324.html http://support.novell.com/security/cve/CVE-2015-0325.html http://support.novell.com/security/cve/CVE-2015-0326.html http://support.novell.com/security/cve/CVE-2015-0327.html http://support.novell.com/security/cve/CVE-2015-0328.html http://support.novell.com/security/cve/CVE-2015-0329.html http://support.novell.com/security/cve/CVE-2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918 http://download.suse.com/patch/finder/?keywords=7fb4ff1fae894ac722cc8e70ad3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0238-1: critical: update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0238-1 Rating: critical References: #915918 Cross-References: 2015-0313 2015-0314 2015-0315 2015-0316 2015-0317 2015-0318 2015-0319 2015-0320 2015-0321 2015-0322 2015-0323 2015-0324 2015-0325 2015-0326 2015-0327 2015-0328 2015-0329 2015-0330 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-7=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.442-147.1 flash-player-gnome-11.2.202.442-147.1 flash-player-kde4-11.2.202.442-147.1 References: http://support.novell.com/security/cve/2015-0313.html http://support.novell.com/security/cve/2015-0314.html http://support.novell.com/security/cve/2015-0315.html http://support.novell.com/security/cve/2015-0316.html http://support.novell.com/security/cve/2015-0317.html http://support.novell.com/security/cve/2015-0318.html http://support.novell.com/security/cve/2015-0319.html http://support.novell.com/security/cve/2015-0320.html http://support.novell.com/security/cve/2015-0321.html http://support.novell.com/security/cve/2015-0322.html http://support.novell.com/security/cve/2015-0323.html http://support.novell.com/security/cve/2015-0324.html http://support.novell.com/security/cve/2015-0325.html http://support.novell.com/security/cve/2015-0326.html http://support.novell.com/security/cve/2015-0327.html http://support.novell.com/security/cve/2015-0328.html http://support.novell.com/security/cve/2015-0329.html http://support.novell.com/security/cve/2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0237-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0237-1 Rating: critical References: #915918 Cross-References: CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-118=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.442-2.33.1 flash-player-gnome-11.2.202.442-2.33.1 flash-player-kde4-11.2.202.442-2.33.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.442-98.1 flash-player-gnome-11.2.202.442-98.1 flash-player-kde4-11.2.202.442-98.1 References: http://support.novell.com/security/cve/CVE-2015-0313.html http://support.novell.com/security/cve/CVE-2015-0314.html http://support.novell.com/security/cve/CVE-2015-0315.html http://support.novell.com/security/cve/CVE-2015-0316.html http://support.novell.com/security/cve/CVE-2015-0317.html http://support.novell.com/security/cve/CVE-2015-0318.html http://support.novell.com/security/cve/CVE-2015-0319.html http://support.novell.com/security/cve/CVE-2015-0320.html http://support.novell.com/security/cve/CVE-2015-0321.html http://support.novell.com/security/cve/CVE-2015-0322.html http://support.novell.com/security/cve/CVE-2015-0323.html http://support.novell.com/security/cve/CVE-2015-0324.html http://support.novell.com/security/cve/CVE-2015-0325.html http://support.novell.com/security/cve/CVE-2015-0326.html http://support.novell.com/security/cve/CVE-2015-0327.html http://support.novell.com/security/cve/CVE-2015-0328.html http://support.novell.com/security/cve/CVE-2015-0329.html http://support.novell.com/security/cve/CVE-2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0236-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0236-1 Rating: critical References: #915918 Cross-References: CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-58=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-58=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.442-67.1 flash-player-gnome-11.2.202.442-67.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.442-67.1 flash-player-gnome-11.2.202.442-67.1 References: http://support.novell.com/security/cve/CVE-2015-0313.html http://support.novell.com/security/cve/CVE-2015-0314.html http://support.novell.com/security/cve/CVE-2015-0315.html http://support.novell.com/security/cve/CVE-2015-0316.html http://support.novell.com/security/cve/CVE-2015-0317.html http://support.novell.com/security/cve/CVE-2015-0318.html http://support.novell.com/security/cve/CVE-2015-0319.html http://support.novell.com/security/cve/CVE-2015-0320.html http://support.novell.com/security/cve/CVE-2015-0321.html http://support.novell.com/security/cve/CVE-2015-0322.html http://support.novell.com/security/cve/CVE-2015-0323.html http://support.novell.com/security/cve/CVE-2015-0324.html http://support.novell.com/security/cve/CVE-2015-0325.html http://support.novell.com/security/cve/CVE-2015-0326.html http://support.novell.com/security/cve/CVE-2015-0327.html http://support.novell.com/security/cve/CVE-2015-0328.html http://support.novell.com/security/cve/CVE-2015-0329.html http://support.novell.com/security/cve/CVE-2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0226-1: important: Security update for xen
by opensuse-security＠opensuse.org 06 Feb '15

06 Feb '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0226-1 Rating: important References: #826717 #866902 #882089 #889526 #900292 #901317 #903357 #903359 #903850 #903967 #903970 #905465 #905467 #906439 #906996 #910681 Cross-References: CVE-2013-3495 CVE-2014-5146 CVE-2014-5149 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 CVE-2014-9065 CVE-2014-9066 CVE-2015-0361 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 5 fixes is now available. Description: The virtualization software XEN was updated to version 4.3.3 and also to fix bugs and security issues. Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use after free on hvm guest teardown CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation CVE-2014-9030: XSA-113: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode hypercall argument translation CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86 emulation of far branches CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU update hypercalls CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu operations are not preemptible Bugs fixed: - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore - bnc#903359 - Temporary migration name is not cleaned up after migration - bnc#903850 - VUL-0: Xen: guest user mode triggerable VM exits not handled by hypervisor - bnc#866902 - L3: Xen save/restore of HVM guests cuts off disk and networking - bnc#901317 - L3: increase limit domUloader to 32MB domUloader.py - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bsc#900292 - xl: change default dump directory - Update to Xen 4.3.3 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-113=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.3_04-34.1 xen-devel-4.3.3_04-34.1 xen-kmp-default-4.3.3_04_k3.11.10_25-34.1 xen-kmp-default-debuginfo-4.3.3_04_k3.11.10_25-34.1 xen-kmp-desktop-4.3.3_04_k3.11.10_25-34.1 xen-kmp-desktop-debuginfo-4.3.3_04_k3.11.10_25-34.1 xen-libs-4.3.3_04-34.1 xen-libs-debuginfo-4.3.3_04-34.1 xen-tools-domU-4.3.3_04-34.1 xen-tools-domU-debuginfo-4.3.3_04-34.1 - openSUSE 13.1 (x86_64): xen-4.3.3_04-34.1 xen-doc-html-4.3.3_04-34.1 xen-libs-32bit-4.3.3_04-34.1 xen-libs-debuginfo-32bit-4.3.3_04-34.1 xen-tools-4.3.3_04-34.1 xen-tools-debuginfo-4.3.3_04-34.1 xen-xend-tools-4.3.3_04-34.1 xen-xend-tools-debuginfo-4.3.3_04-34.1 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.3_04_k3.11.10_25-34.1 xen-kmp-pae-debuginfo-4.3.3_04_k3.11.10_25-34.1 References: http://support.novell.com/security/cve/CVE-2013-3495.html http://support.novell.com/security/cve/CVE-2014-5146.html http://support.novell.com/security/cve/CVE-2014-5149.html http://support.novell.com/security/cve/CVE-2014-8594.html http://support.novell.com/security/cve/CVE-2014-8595.html http://support.novell.com/security/cve/CVE-2014-8866.html http://support.novell.com/security/cve/CVE-2014-8867.html http://support.novell.com/security/cve/CVE-2014-9030.html http://support.novell.com/security/cve/CVE-2014-9065.html http://support.novell.com/security/cve/CVE-2014-9066.html http://support.novell.com/security/cve/CVE-2015-0361.html https://bugzilla.suse.com/show_bug.cgi?id=826717 https://bugzilla.suse.com/show_bug.cgi?id=866902 https://bugzilla.suse.com/show_bug.cgi?id=882089 https://bugzilla.suse.com/show_bug.cgi?id=889526 https://bugzilla.suse.com/show_bug.cgi?id=900292 https://bugzilla.suse.com/show_bug.cgi?id=901317 https://bugzilla.suse.com/show_bug.cgi?id=903357 https://bugzilla.suse.com/show_bug.cgi?id=903359 https://bugzilla.suse.com/show_bug.cgi?id=903850 https://bugzilla.suse.com/show_bug.cgi?id=903967 https://bugzilla.suse.com/show_bug.cgi?id=903970 https://bugzilla.suse.com/show_bug.cgi?id=905465 https://bugzilla.suse.com/show_bug.cgi?id=905467 https://bugzilla.suse.com/show_bug.cgi?id=906439 https://bugzilla.suse.com/show_bug.cgi?id=906996 https://bugzilla.suse.com/show_bug.cgi?id=910681 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 12.3 has reached end of SUSE support
by Benjamin Brunner 02 Feb '15

02 Feb '15

Hi all, with the release of flash-player on January 29th, 2015 the SUSE sponsored maintenance of openSUSE 12.3 has ended. openSUSE 12.3 is now officially discontinued and out of support by SUSE. openSUSE 12.3 was released on March 13th 2013, making it ca. 11 months of security and bugfix support. Here are some statistics of our released updates (compared to 12.2): Total updates: 909 (+160) Security: 468 (+116) Recommended: 439 (+43) Optional: 1 (0) Feature: 1 (+1) Fixed CVE-entries: 1581 (+250) Fixed Bugs (overall): 1861 (+505) A huge thanks to our awesome packagers, community and all involved people, who made the next great release possible! Your maintenance- and security-team -- Benjamin Brunner <bbrunner(a)suse.com>, SUSE MaintenanceSecurity SUSE LINUX GmbH, GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 1

[security-announce] openSUSE-SU-2015:0192-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0192-1 Rating: important References: #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669) * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - use GStreamer 1.0 from 13.2 on Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-92 - openSUSE 13.1: zypper in -t patch openSUSE-2015-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): seamonkey-2.32-8.2 seamonkey-debuginfo-2.32-8.2 seamonkey-debugsource-2.32-8.2 seamonkey-dom-inspector-2.32-8.2 seamonkey-irc-2.32-8.2 seamonkey-translations-common-2.32-8.2 seamonkey-translations-other-2.32-8.2 - openSUSE 13.1 (i586 x86_64): seamonkey-2.32-44.2 seamonkey-debuginfo-2.32-44.2 seamonkey-debugsource-2.32-44.2 seamonkey-dom-inspector-2.32-44.2 seamonkey-irc-2.32-44.2 seamonkey-translations-common-2.32-44.2 seamonkey-translations-other-2.32-44.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0190-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0190-1 Rating: important References: #914041 Cross-References: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and bugs: * Security fixes - S8046656: Update protocol support - S8047125, CVE-2015-0395: (ref) More phantom object references - S8047130: Fewer escapes from escape analysis - S8048035, CVE-2015-0400: Ensure proper proxy protocols - S8049253: Better GC validation - S8050807, CVE-2015-0383: Better performing performance data handling - S8054367, CVE-2015-0412: More references for endpoints - S8055304, CVE-2015-0407: More boxing for DirectoryComboBoxModel - S8055309, CVE-2015-0408: RMI needs better transportation considerations - S8055479: TLAB stability - S8055489, CVE-2014-6585: Better substitution formats - S8056264, CVE-2014-6587: Multicast support improvements - S8056276, CVE-2014-6591: Fontmanager feature improvements - S8057555, CVE-2014-6593: Less cryptic cipher suite management - S8058982, CVE-2014-6601: Better verification of an exceptional invokespecial - S8059485, CVE-2015-0410: Resolve parsing ambiguity - S8061210, CVE-2014-3566: Issues in TLS Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-91 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.75-4.1 java-1_7_0-openjdk-accessibility-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-debugsource-1.7.0.75-4.1 java-1_7_0-openjdk-demo-1.7.0.75-4.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-devel-1.7.0.75-4.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-headless-1.7.0.75-4.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-src-1.7.0.75-4.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.75-4.1 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-6585.html http://support.novell.com/security/cve/CVE-2014-6587.html http://support.novell.com/security/cve/CVE-2014-6591.html http://support.novell.com/security/cve/CVE-2014-6593.html http://support.novell.com/security/cve/CVE-2014-6601.html http://support.novell.com/security/cve/CVE-2015-0383.html http://support.novell.com/security/cve/CVE-2015-0395.html http://support.novell.com/security/cve/CVE-2015-0400.html http://support.novell.com/security/cve/CVE-2015-0407.html http://support.novell.com/security/cve/CVE-2015-0408.html http://support.novell.com/security/cve/CVE-2015-0410.html http://support.novell.com/security/cve/CVE-2015-0412.html https://bugzilla.suse.com/show_bug.cgi?id=914041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0184-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0184-1 Rating: critical References: #913646 Cross-References: CVE-2015-0235 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issue: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2015-84 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): glibc-2.17-4.17.1 glibc-debuginfo-2.17-4.17.1 glibc-debugsource-2.17-4.17.1 glibc-devel-2.17-4.17.1 glibc-devel-debuginfo-2.17-4.17.1 glibc-devel-static-2.17-4.17.1 glibc-extra-2.17-4.17.1 glibc-extra-debuginfo-2.17-4.17.1 glibc-locale-2.17-4.17.1 glibc-locale-debuginfo-2.17-4.17.1 glibc-profile-2.17-4.17.1 glibc-utils-2.17-4.17.1 glibc-utils-debuginfo-2.17-4.17.1 glibc-utils-debugsource-2.17-4.17.1 nscd-2.17-4.17.1 nscd-debuginfo-2.17-4.17.1 - openSUSE 12.3 (x86_64): glibc-utils-32bit-2.17-4.17.1 glibc-utils-debuginfo-32bit-2.17-4.17.1 - openSUSE 12.3 (noarch): glibc-html-2.17-4.17.1 glibc-i18ndata-2.17-4.17.1 glibc-info-2.17-4.17.1 - openSUSE 12.3 (i586): glibc-obsolete-2.17-4.17.1 glibc-obsolete-debuginfo-2.17-4.17.1 References: http://support.novell.com/security/cve/CVE-2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0