February 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:0236-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0236-1 Rating: critical References: #915918 Cross-References: CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-58=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-58=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.442-67.1 flash-player-gnome-11.2.202.442-67.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.442-67.1 flash-player-gnome-11.2.202.442-67.1 References: http://support.novell.com/security/cve/CVE-2015-0313.html http://support.novell.com/security/cve/CVE-2015-0314.html http://support.novell.com/security/cve/CVE-2015-0315.html http://support.novell.com/security/cve/CVE-2015-0316.html http://support.novell.com/security/cve/CVE-2015-0317.html http://support.novell.com/security/cve/CVE-2015-0318.html http://support.novell.com/security/cve/CVE-2015-0319.html http://support.novell.com/security/cve/CVE-2015-0320.html http://support.novell.com/security/cve/CVE-2015-0321.html http://support.novell.com/security/cve/CVE-2015-0322.html http://support.novell.com/security/cve/CVE-2015-0323.html http://support.novell.com/security/cve/CVE-2015-0324.html http://support.novell.com/security/cve/CVE-2015-0325.html http://support.novell.com/security/cve/CVE-2015-0326.html http://support.novell.com/security/cve/CVE-2015-0327.html http://support.novell.com/security/cve/CVE-2015-0328.html http://support.novell.com/security/cve/CVE-2015-0329.html http://support.novell.com/security/cve/CVE-2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0226-1: important: Security update for xen
by opensuse-security＠opensuse.org 06 Feb '15

06 Feb '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0226-1 Rating: important References: #826717 #866902 #882089 #889526 #900292 #901317 #903357 #903359 #903850 #903967 #903970 #905465 #905467 #906439 #906996 #910681 Cross-References: CVE-2013-3495 CVE-2014-5146 CVE-2014-5149 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 CVE-2014-9065 CVE-2014-9066 CVE-2015-0361 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 5 fixes is now available. Description: The virtualization software XEN was updated to version 4.3.3 and also to fix bugs and security issues. Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use after free on hvm guest teardown CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation CVE-2014-9030: XSA-113: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode hypercall argument translation CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86 emulation of far branches CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU update hypercalls CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu operations are not preemptible Bugs fixed: - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore - bnc#903359 - Temporary migration name is not cleaned up after migration - bnc#903850 - VUL-0: Xen: guest user mode triggerable VM exits not handled by hypervisor - bnc#866902 - L3: Xen save/restore of HVM guests cuts off disk and networking - bnc#901317 - L3: increase limit domUloader to 32MB domUloader.py - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bsc#900292 - xl: change default dump directory - Update to Xen 4.3.3 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-113=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.3_04-34.1 xen-devel-4.3.3_04-34.1 xen-kmp-default-4.3.3_04_k3.11.10_25-34.1 xen-kmp-default-debuginfo-4.3.3_04_k3.11.10_25-34.1 xen-kmp-desktop-4.3.3_04_k3.11.10_25-34.1 xen-kmp-desktop-debuginfo-4.3.3_04_k3.11.10_25-34.1 xen-libs-4.3.3_04-34.1 xen-libs-debuginfo-4.3.3_04-34.1 xen-tools-domU-4.3.3_04-34.1 xen-tools-domU-debuginfo-4.3.3_04-34.1 - openSUSE 13.1 (x86_64): xen-4.3.3_04-34.1 xen-doc-html-4.3.3_04-34.1 xen-libs-32bit-4.3.3_04-34.1 xen-libs-debuginfo-32bit-4.3.3_04-34.1 xen-tools-4.3.3_04-34.1 xen-tools-debuginfo-4.3.3_04-34.1 xen-xend-tools-4.3.3_04-34.1 xen-xend-tools-debuginfo-4.3.3_04-34.1 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.3_04_k3.11.10_25-34.1 xen-kmp-pae-debuginfo-4.3.3_04_k3.11.10_25-34.1 References: http://support.novell.com/security/cve/CVE-2013-3495.html http://support.novell.com/security/cve/CVE-2014-5146.html http://support.novell.com/security/cve/CVE-2014-5149.html http://support.novell.com/security/cve/CVE-2014-8594.html http://support.novell.com/security/cve/CVE-2014-8595.html http://support.novell.com/security/cve/CVE-2014-8866.html http://support.novell.com/security/cve/CVE-2014-8867.html http://support.novell.com/security/cve/CVE-2014-9030.html http://support.novell.com/security/cve/CVE-2014-9065.html http://support.novell.com/security/cve/CVE-2014-9066.html http://support.novell.com/security/cve/CVE-2015-0361.html https://bugzilla.suse.com/show_bug.cgi?id=826717 https://bugzilla.suse.com/show_bug.cgi?id=866902 https://bugzilla.suse.com/show_bug.cgi?id=882089 https://bugzilla.suse.com/show_bug.cgi?id=889526 https://bugzilla.suse.com/show_bug.cgi?id=900292 https://bugzilla.suse.com/show_bug.cgi?id=901317 https://bugzilla.suse.com/show_bug.cgi?id=903357 https://bugzilla.suse.com/show_bug.cgi?id=903359 https://bugzilla.suse.com/show_bug.cgi?id=903850 https://bugzilla.suse.com/show_bug.cgi?id=903967 https://bugzilla.suse.com/show_bug.cgi?id=903970 https://bugzilla.suse.com/show_bug.cgi?id=905465 https://bugzilla.suse.com/show_bug.cgi?id=905467 https://bugzilla.suse.com/show_bug.cgi?id=906439 https://bugzilla.suse.com/show_bug.cgi?id=906996 https://bugzilla.suse.com/show_bug.cgi?id=910681 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 12.3 has reached end of SUSE support
by Benjamin Brunner 02 Feb '15

02 Feb '15

Hi all, with the release of flash-player on January 29th, 2015 the SUSE sponsored maintenance of openSUSE 12.3 has ended. openSUSE 12.3 is now officially discontinued and out of support by SUSE. openSUSE 12.3 was released on March 13th 2013, making it ca. 11 months of security and bugfix support. Here are some statistics of our released updates (compared to 12.2): Total updates: 909 (+160) Security: 468 (+116) Recommended: 439 (+43) Optional: 1 (0) Feature: 1 (+1) Fixed CVE-entries: 1581 (+250) Fixed Bugs (overall): 1861 (+505) A huge thanks to our awesome packagers, community and all involved people, who made the next great release possible! Your maintenance- and security-team -- Benjamin Brunner <bbrunner(a)suse.com>, SUSE MaintenanceSecurity SUSE LINUX GmbH, GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 1

[security-announce] openSUSE-SU-2015:0192-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0192-1 Rating: important References: #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: Mozilla seamonkey was updated to SeaMonkey 2.32 (bnc#910669) * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - use GStreamer 1.0 from 13.2 on Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-92 - openSUSE 13.1: zypper in -t patch openSUSE-2015-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): seamonkey-2.32-8.2 seamonkey-debuginfo-2.32-8.2 seamonkey-debugsource-2.32-8.2 seamonkey-dom-inspector-2.32-8.2 seamonkey-irc-2.32-8.2 seamonkey-translations-common-2.32-8.2 seamonkey-translations-other-2.32-8.2 - openSUSE 13.1 (i586 x86_64): seamonkey-2.32-44.2 seamonkey-debuginfo-2.32-44.2 seamonkey-debugsource-2.32-44.2 seamonkey-dom-inspector-2.32-44.2 seamonkey-irc-2.32-44.2 seamonkey-translations-common-2.32-44.2 seamonkey-translations-other-2.32-44.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0190-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0190-1 Rating: important References: #914041 Cross-References: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: OpenJDK was updated to 2.5.4 - OpenJDK 7u75 to fix security issues and bugs: * Security fixes - S8046656: Update protocol support - S8047125, CVE-2015-0395: (ref) More phantom object references - S8047130: Fewer escapes from escape analysis - S8048035, CVE-2015-0400: Ensure proper proxy protocols - S8049253: Better GC validation - S8050807, CVE-2015-0383: Better performing performance data handling - S8054367, CVE-2015-0412: More references for endpoints - S8055304, CVE-2015-0407: More boxing for DirectoryComboBoxModel - S8055309, CVE-2015-0408: RMI needs better transportation considerations - S8055479: TLAB stability - S8055489, CVE-2014-6585: Better substitution formats - S8056264, CVE-2014-6587: Multicast support improvements - S8056276, CVE-2014-6591: Fontmanager feature improvements - S8057555, CVE-2014-6593: Less cryptic cipher suite management - S8058982, CVE-2014-6601: Better verification of an exceptional invokespecial - S8059485, CVE-2015-0410: Resolve parsing ambiguity - S8061210, CVE-2014-3566: Issues in TLS Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-91 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.75-4.1 java-1_7_0-openjdk-accessibility-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.75-4.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-debugsource-1.7.0.75-4.1 java-1_7_0-openjdk-demo-1.7.0.75-4.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-devel-1.7.0.75-4.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-headless-1.7.0.75-4.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.75-4.1 java-1_7_0-openjdk-src-1.7.0.75-4.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.75-4.1 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-6585.html http://support.novell.com/security/cve/CVE-2014-6587.html http://support.novell.com/security/cve/CVE-2014-6591.html http://support.novell.com/security/cve/CVE-2014-6593.html http://support.novell.com/security/cve/CVE-2014-6601.html http://support.novell.com/security/cve/CVE-2015-0383.html http://support.novell.com/security/cve/CVE-2015-0395.html http://support.novell.com/security/cve/CVE-2015-0400.html http://support.novell.com/security/cve/CVE-2015-0407.html http://support.novell.com/security/cve/CVE-2015-0408.html http://support.novell.com/security/cve/CVE-2015-0410.html http://support.novell.com/security/cve/CVE-2015-0412.html https://bugzilla.suse.com/show_bug.cgi?id=914041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0184-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 02 Feb '15

02 Feb '15

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0184-1 Rating: critical References: #913646 Cross-References: CVE-2015-0235 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issue: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2015-84 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): glibc-2.17-4.17.1 glibc-debuginfo-2.17-4.17.1 glibc-debugsource-2.17-4.17.1 glibc-devel-2.17-4.17.1 glibc-devel-debuginfo-2.17-4.17.1 glibc-devel-static-2.17-4.17.1 glibc-extra-2.17-4.17.1 glibc-extra-debuginfo-2.17-4.17.1 glibc-locale-2.17-4.17.1 glibc-locale-debuginfo-2.17-4.17.1 glibc-profile-2.17-4.17.1 glibc-utils-2.17-4.17.1 glibc-utils-debuginfo-2.17-4.17.1 glibc-utils-debugsource-2.17-4.17.1 nscd-2.17-4.17.1 nscd-debuginfo-2.17-4.17.1 - openSUSE 12.3 (x86_64): glibc-utils-32bit-2.17-4.17.1 glibc-utils-debuginfo-32bit-2.17-4.17.1 - openSUSE 12.3 (noarch): glibc-html-2.17-4.17.1 glibc-i18ndata-2.17-4.17.1 glibc-info-2.17-4.17.1 - openSUSE 12.3 (i586): glibc-obsolete-2.17-4.17.1 glibc-obsolete-debuginfo-2.17-4.17.1 References: http://support.novell.com/security/cve/CVE-2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0