February 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:0344-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 21 Feb '15

21 Feb '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0344-1 Rating: important References: #891701 #901223 #901239 #904889 #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: java-1_7_0-ibm was updated to version 1.7.0_sr7.3 to fix 37 security issues: * CVE-2014-8891: Unspecified vulnerability (bnc#916266) * CVE-2014-8892: Unspecified vulnerability (bnc#916265) * CVE-2014-3065: Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache (bnc#904889). * CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). * CVE-2014-6513: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (bnc#901239). * CVE-2014-6456: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors (bnc#901239). * CVE-2014-6503: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (bnc#901239). * CVE-2014-6532: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (bnc#901239). * CVE-2014-4288: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6493: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (bnc#901239). * CVE-2014-6492: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6458: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6466: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6506: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6476: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527 (bnc#901239). * CVE-2014-6515: Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment (bnc#901239). * CVE-2014-6511: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (bnc#901239). * CVE-2014-6531: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6512: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6457: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#901239). * CVE-2014-6527: Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476 (bnc#901239). * CVE-2014-6502: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#901239). * CVE-2014-6558: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (bnc#901239). * CVE-2014-4227: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bnc#891701). * CVE-2014-4262: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4219: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#891701). * CVE-2014-4209: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality and integrity via vectors related to JMX (bnc#891701). * CVE-2014-4220: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4208 (bnc#891701). * CVE-2014-4268: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#891701). * CVE-2014-4218: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4252: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Security (bnc#891701). * CVE-2014-4266: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Serviceability (bnc#891701). * CVE-2014-4265: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment (bnc#891701). * CVE-2014-4221: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#891701). * CVE-2014-4263: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to "Diffie-Hellman key agreement (bnc#891701). * CVE-2014-4244: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security (bnc#891701). * CVE-2014-4208: Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4220 (bnc#891701). Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_7_0-ibm=10324 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_7_0-ibm-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.4 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.4 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x): java-1_7_0-ibm-1.7.0_sr8.10-0.6.5 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.5 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.5 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/891701 https://bugzilla.suse.com/901223 https://bugzilla.suse.com/901239 https://bugzilla.suse.com/904889 https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=89dfde7681a3e8ac7832df50d44… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0343-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 21 Feb '15

21 Feb '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0343-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_7_0-ibm was updated to fix two security issues: * CVE-2014-8891: Unspecified vulnerability * CVE-2014-8892: Unspecified vulnerability Security Issues: * CVE-2014-8892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8892> * CVE-2014-8891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8891> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_6_0-ibm=10299 sdksp3-java-1_7_0-ibm=10300 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_6_0-ibm=10299 slessp3-java-1_7_0-ibm=10300 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_6_0-ibm=10299 slessp3-java-1_7_0-ibm=10300 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-devel-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-0.4.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-0.4.1 java-1_7_0-ibm-alsa-1.7.0_sr8.10-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr8.10-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.3-0.4.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 http://download.suse.com/patch/finder/?keywords=d0fabcb64d4c31a5f5c8a208549… http://download.suse.com/patch/finder/?keywords=dd24d5afde779e1651d8cfeb6cd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0336-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 19 Feb '15

19 Feb '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0336-1 Rating: important References: #914041 Cross-References: CVE-2014-3566 CVE-2014-6549 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 CVE-2015-0421 CVE-2015-0437 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. It includes one version update. Description: java-1_7_0-openjdk was updated to fix 19 security issues. Details are available at http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#A ppendixJAVA <http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html# AppendixJAVA> Security Issues: * CVE-2014-6601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6601> * CVE-2015-0412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0412> * CVE-2014-6549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6549> * CVE-2015-0408 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0408> * CVE-2015-0395 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0395> * CVE-2015-0437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0437> * CVE-2015-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0403> * CVE-2015-0421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0421> * CVE-2015-0406 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0406> * CVE-2015-0383 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0383> * CVE-2015-0400 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0400> * CVE-2015-0407 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0407> * CVE-2015-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410> * CVE-2014-6587 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6587> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-6593 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593> * CVE-2014-6585 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6585> * CVE-2014-6591 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6591> * CVE-2015-0413 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0413> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk=10286 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.7.0.75]: java-1_7_0-openjdk-1.7.0.75-0.7.1 java-1_7_0-openjdk-demo-1.7.0.75-0.7.1 java-1_7_0-openjdk-devel-1.7.0.75-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-6549.html http://support.novell.com/security/cve/CVE-2014-6585.html http://support.novell.com/security/cve/CVE-2014-6587.html http://support.novell.com/security/cve/CVE-2014-6591.html http://support.novell.com/security/cve/CVE-2014-6593.html http://support.novell.com/security/cve/CVE-2014-6601.html http://support.novell.com/security/cve/CVE-2015-0383.html http://support.novell.com/security/cve/CVE-2015-0395.html http://support.novell.com/security/cve/CVE-2015-0400.html http://support.novell.com/security/cve/CVE-2015-0403.html http://support.novell.com/security/cve/CVE-2015-0406.html http://support.novell.com/security/cve/CVE-2015-0407.html http://support.novell.com/security/cve/CVE-2015-0408.html http://support.novell.com/security/cve/CVE-2015-0410.html http://support.novell.com/security/cve/CVE-2015-0412.html http://support.novell.com/security/cve/CVE-2015-0413.html http://support.novell.com/security/cve/CVE-2015-0421.html http://support.novell.com/security/cve/CVE-2015-0437.html https://bugzilla.suse.com/914041 http://download.suse.com/patch/finder/?keywords=8d9a18b0ce3289f724b64f4b4dc… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0322-1: important: Security update for xntp
by opensuse-security＠opensuse.org 19 Feb '15

19 Feb '15

SUSE Security Update: Security update for xntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0322-1 Rating: important References: #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: xntp has been updated to fix two security issues: * CVE-2014-9298: ::1 can be spoofed on some OSes, so ACLs based on IPv6 ::1 addresses can be bypassed (bnc#911792). * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential info leak (bnc#911792). Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): xntp-4.2.4p3-48.27.1 xntp-doc-4.2.4p3-48.27.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/911792 http://download.suse.com/patch/finder/?keywords=8c2302f77b01413a386c6a33bf8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0306-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0306-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-ibm was updated to fix two security issues. These security issues were fixed: - CVE-2014-8892: Unspecified vulnerability (bnc#916265). - CVE-2014-8891: Unspecified vulnerability (bnc#916266). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-79=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.3-12.1 java-1_6_0-ibm-fonts-1.6.0_sr16.3-12.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.3-12.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.3-12.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0304-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0304-1 Rating: important References: #916265 #916266 Cross-References: CVE-2014-8891 CVE-2014-8892 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_7_1-ibm was updated to fix two security issues. These security issues were fixed: - CVE-2014-8892: Unspecified vulnerability (bnc#916265). - CVE-2014-8891: Unspecified vulnerability (bnc#916266). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-80=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-80=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr2.10-8.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr2.10-8.1 java-1_7_1-ibm-jdbc-1.7.1_sr2.10-8.1 - SUSE Linux Enterprise Server 12 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr2.10-8.1 java-1_7_1-ibm-plugin-1.7.1_sr2.10-8.1 References: http://support.novell.com/security/cve/CVE-2014-8891.html http://support.novell.com/security/cve/CVE-2014-8892.html https://bugzilla.suse.com/916265 https://bugzilla.suse.com/916266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0298-1: important: Security update for clamav
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0298-1 Rating: important References: #915512 #916214 #916215 #916217 Cross-References: CVE-2014-9328 CVE-2015-1461 CVE-2015-1462 CVE-2015-1463 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: clamav was updated to version 0.98.6 to fix four security issues. These security issues have been fixed: * CVE-2015-1462: ClamAV allowed remote attackers to have unspecified impact via a crafted upx packer file, related to a heap out of bounds condition (bnc#916214). * CVE-2015-1463: ClamAV allowed remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an incorrect compiler optimization (bnc#916215). * CVE-2014-9328: ClamAV allowed remote attackers to have unspecified impact via a crafted upack packer file, related to a heap out of bounds condition (bnc#915512). * CVE-2015-1461: ClamAV allowed remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a heap out of bounds condition (bnc#916217). Security Issues: * CVE-2015-1462 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1462> * CVE-2014-9328 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9328> * CVE-2015-1463 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1463> * CVE-2015-1461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1461> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-clamav=10283 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-clamav=10283 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-clamav=10285 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-clamav=10284 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-clamav=10283 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 0.98.6]: clamav-0.98.6-0.6.1 References: http://support.novell.com/security/cve/CVE-2014-9328.html http://support.novell.com/security/cve/CVE-2015-1461.html http://support.novell.com/security/cve/CVE-2015-1462.html http://support.novell.com/security/cve/CVE-2015-1463.html https://bugzilla.suse.com/915512 https://bugzilla.suse.com/916214 https://bugzilla.suse.com/916215 https://bugzilla.suse.com/916217 http://download.suse.com/patch/finder/?keywords=2f44be276ad7a4e53a81812520e… http://download.suse.com/patch/finder/?keywords=b856018fc4dcd95c039167b1ea1… http://download.suse.com/patch/finder/?keywords=b857e6f07106efda6eeb4c84264… http://download.suse.com/patch/finder/?keywords=cabd1033f09ef394f7aad5c3fbd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0259-3: important: Security update for ntp
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0259-3 Rating: important References: #910764 #911792 Cross-References: CVE-2014-9293 CVE-2014-9294 CVE-2014-9297 CVE-2014-9298 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: ntp has been updated to fix four security issues: * CVE-2014-9294: ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9293: The config_auth function, when an auth key is not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. (bsc#910764) * CVE-2014-9298: ::1 can be spoofed on some operating systems, so ACLs based on IPv6 ::1 addresses could be bypassed. (bsc#910764) * CVE-2014-9297: vallen is not validated in several places in ntp_crypto.c, leading to potential information leak. (bsc#910764) Security Issues: * CVE-2014-9294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294> * CVE-2014-9293 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293> * CVE-2014-9298 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9298> * CVE-2014-9297 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9297> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-ntp=10307 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): ntp-4.2.4p8-1.29.32.1 ntp-doc-4.2.4p8-1.29.32.1 References: http://support.novell.com/security/cve/CVE-2014-9293.html http://support.novell.com/security/cve/CVE-2014-9294.html http://support.novell.com/security/cve/CVE-2014-9297.html http://support.novell.com/security/cve/CVE-2014-9298.html https://bugzilla.suse.com/910764 https://bugzilla.suse.com/911792 http://download.suse.com/patch/finder/?keywords=900e7482290b4309d9dd461085b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0011-2: important: Security update for bind
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0011-2 Rating: important References: #743758 #882511 #908994 Cross-References: CVE-2014-8500 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: This update provides bind 9.9.6P1, which fixes a defect in delegation handling that could be exploited to crash named. (CVE-2014-8500, bsc#908994) Additionally, two non-security issues have been fixed: * Fix handling of TXT records in ldapdump. (bsc#743758) * Fix a multithread issue with IXFR. (bsc#882511) Security Issues: * CVE-2014-8500 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500> Indications: Everybody should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-bind=10203 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.5.5 bind-chrootenv-9.9.6P1-0.5.5 bind-devel-9.9.6P1-0.5.5 bind-doc-9.9.6P1-0.5.5 bind-libs-9.9.6P1-0.5.5 bind-utils-9.9.6P1-0.5.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.5.5 References: http://support.novell.com/security/cve/CVE-2014-8500.html https://bugzilla.suse.com/743758 https://bugzilla.suse.com/882511 https://bugzilla.suse.com/908994 http://download.suse.com/patch/finder/?keywords=93a0d67b3fb1cddabb9d852b78c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0290-2: important: Security update for krb5
by opensuse-security＠opensuse.org 16 Feb '15

16 Feb '15

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0290-2 Rating: important References: #897874 #898439 #912002 Cross-References: CVE-2014-5351 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Build System Kit 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: MIT kerberos krb5 was updated to fix several security issues and bugs. Security issues fixed: CVE-2014-5351: The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) sent old keys in a response to a -randkey -keepold request, which allowed remote authenticated users to forge tickets by leveraging administrative access. CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller was left with a security context handle containing a dangling pointer. Further uses of this handle would have resulted in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind were vulnerable as they can be instructed to call gss_process_context_token(). CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may have performed use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications might also been vulnerable if they contain insufficiently defensive XDR functions. CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepted authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm. CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients. Bugs fixed: - Work around replay cache creation race; (bnc#898439). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-74=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-74=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-74=1 - SUSE Linux Enterprise Build System Kit 12: zypper in -t patch SUSE-SLE-BSK-12-2015-74=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): krb5-debuginfo-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-devel-1.12.1-9.1 - SUSE Linux Enterprise Server 12 (x86_64): krb5-1.12.1-9.1 krb5-32bit-1.12.1-9.1 krb5-client-1.12.1-9.1 krb5-client-debuginfo-1.12.1-9.1 krb5-debuginfo-1.12.1-9.1 krb5-debuginfo-32bit-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 krb5-doc-1.12.1-9.1 krb5-plugin-kdb-ldap-1.12.1-9.1 krb5-plugin-kdb-ldap-debuginfo-1.12.1-9.1 krb5-plugin-preauth-otp-1.12.1-9.1 krb5-plugin-preauth-otp-debuginfo-1.12.1-9.1 krb5-plugin-preauth-pkinit-1.12.1-9.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.1-9.1 krb5-server-1.12.1-9.1 krb5-server-debuginfo-1.12.1-9.1 - SUSE Linux Enterprise Desktop 12 (x86_64): krb5-1.12.1-9.1 krb5-32bit-1.12.1-9.1 krb5-client-1.12.1-9.1 krb5-client-debuginfo-1.12.1-9.1 krb5-debuginfo-1.12.1-9.1 krb5-debuginfo-32bit-1.12.1-9.1 krb5-debugsource-1.12.1-9.1 - SUSE Linux Enterprise Build System Kit 12 (x86_64): krb5-mini-1.12.1-9.1 krb5-mini-debuginfo-1.12.1-9.1 krb5-mini-debugsource-1.12.1-9.1 krb5-mini-devel-1.12.1-9.1 References: http://support.novell.com/security/cve/CVE-2014-5351.html http://support.novell.com/security/cve/CVE-2014-5352.html http://support.novell.com/security/cve/CVE-2014-9421.html http://support.novell.com/security/cve/CVE-2014-9422.html http://support.novell.com/security/cve/CVE-2014-9423.html https://bugzilla.suse.com/897874 https://bugzilla.suse.com/898439 https://bugzilla.suse.com/912002 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0