May 2015 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] SUSE-SU-2015:0960-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 28 May '15

28 May '15

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0960-1 Rating: important References: #930622 Cross-References: CVE-2015-0797 CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update to Firefox 31.7.0 ESR (bsc#930622) fixes the following issues: * MFSA 2015-46/CVE-2015-2708/CVE-2015-2709 (bmo#1120655, bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977, bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526, bmo#1153688, bmo#1155474) Miscellaneous memory safety hazards (rv:38.0 / rv:31.7) * MFSA 2015-47/CVE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer * MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS * MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled * MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-217=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-217=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-31.7.0esr-34.1 MozillaFirefox-debugsource-31.7.0esr-34.1 MozillaFirefox-devel-31.7.0esr-34.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-31.7.0esr-34.1 MozillaFirefox-debuginfo-31.7.0esr-34.1 MozillaFirefox-debugsource-31.7.0esr-34.1 MozillaFirefox-translations-31.7.0esr-34.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-31.7.0esr-34.1 MozillaFirefox-debuginfo-31.7.0esr-34.1 MozillaFirefox-debugsource-31.7.0esr-34.1 MozillaFirefox-translations-31.7.0esr-34.1 References: https://www.suse.com/security/cve/CVE-2015-0797.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2709.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://bugzilla.suse.com/930622 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0946-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 26 May '15

26 May '15

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0946-1 Rating: important References: #922043 #927623 Cross-References: CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 CVE-2015-0405 CVE-2015-0423 CVE-2015-0433 CVE-2015-0438 CVE-2015-0439 CVE-2015-0441 CVE-2015-0498 CVE-2015-0499 CVE-2015-0500 CVE-2015-0501 CVE-2015-0503 CVE-2015-0505 CVE-2015-0506 CVE-2015-0507 CVE-2015-0508 CVE-2015-0511 CVE-2015-2305 CVE-2015-2566 CVE-2015-2567 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-2576 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. It includes one version update. Description: MySQL was updated to version 5.5.43 to fix several security and non security issues: * CVEs fixed: CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206, CVE-2015-0405, CVE-2015-0423, CVE-2015-0433, CVE-2015-0438, CVE-2015-0439, CVE-2015-0441, CVE-2015-0498, CVE-2015-0499, CVE-2015-0500, CVE-2015-0501, CVE-2015-0503, CVE-2015-0505, CVE-2015-0506, CVE-2015-0507, CVE-2015-0508, CVE-2015-0511, CVE-2015-2566, CVE-2015-2567, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573, CVE-2015-2576. * Fix integer overflow in regcomp (Henry Spencer's regex library) for excessively long pattern strings. (bnc#922043, CVE-2015-2305) For a comprehensive list of changes, refer to http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-43.html <http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-43.html> . Security Issues: * CVE-2014-3569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3569> * CVE-2014-3570 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3570> * CVE-2014-3571 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3571> * CVE-2014-3572 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3572> * CVE-2014-8275 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8275> * CVE-2015-0204 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204> * CVE-2015-0205 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0205> * CVE-2015-0206 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0206> * CVE-2015-0405 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0405> * CVE-2015-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0423> * CVE-2015-0433 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0433> * CVE-2015-0438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0438> * CVE-2015-0439 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0439> * CVE-2015-0441 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0441> * CVE-2015-0498 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0498> * CVE-2015-0499 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0499> * CVE-2015-0500 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0500> * CVE-2015-0501 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0501> * CVE-2015-0503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0503> * CVE-2015-0505 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0505> * CVE-2015-0506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0506> * CVE-2015-0507 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0507> * CVE-2015-0508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0508> * CVE-2015-0511 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0511> * CVE-2015-2566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2566> * CVE-2015-2567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2567> * CVE-2015-2568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2568> * CVE-2015-2571 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2571> * CVE-2015-2573 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2573> * CVE-2015-2576 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2576> * CVE-2015-2305 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2305> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18=10661 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18=10661 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18=10661 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18=10661 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.43-0.7.3 libmysqlclient_r15-32bit-5.0.96-0.6.20 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.43-0.7.3 libmysqlclient_r15-x86-5.0.96-0.6.20 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.7.3 libmysql55client_r18-5.5.43-0.7.3 libmysqlclient15-5.0.96-0.6.20 libmysqlclient_r15-5.0.96-0.6.20 mysql-5.5.43-0.7.3 mysql-client-5.5.43-0.7.3 mysql-tools-5.5.43-0.7.3 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.7.3 libmysqlclient15-32bit-5.0.96-0.6.20 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.7.3 libmysql55client_r18-5.5.43-0.7.3 libmysqlclient15-5.0.96-0.6.20 libmysqlclient_r15-5.0.96-0.6.20 mysql-5.5.43-0.7.3 mysql-client-5.5.43-0.7.3 mysql-tools-5.5.43-0.7.3 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.7.3 libmysqlclient15-32bit-5.0.96-0.6.20 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.43]: libmysql55client18-x86-5.5.43-0.7.3 libmysqlclient15-x86-5.0.96-0.6.20 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.7.3 libmysql55client_r18-5.5.43-0.7.3 libmysqlclient15-5.0.96-0.6.20 libmysqlclient_r15-5.0.96-0.6.20 mysql-5.5.43-0.7.3 mysql-client-5.5.43-0.7.3 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.7.3 libmysql55client_r18-32bit-5.5.43-0.7.3 libmysqlclient15-32bit-5.0.96-0.6.20 libmysqlclient_r15-32bit-5.0.96-0.6.20 References: https://www.suse.com/security/cve/CVE-2014-3569.html https://www.suse.com/security/cve/CVE-2014-3570.html https://www.suse.com/security/cve/CVE-2014-3571.html https://www.suse.com/security/cve/CVE-2014-3572.html https://www.suse.com/security/cve/CVE-2014-8275.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0205.html https://www.suse.com/security/cve/CVE-2015-0206.html https://www.suse.com/security/cve/CVE-2015-0405.html https://www.suse.com/security/cve/CVE-2015-0423.html https://www.suse.com/security/cve/CVE-2015-0433.html https://www.suse.com/security/cve/CVE-2015-0438.html https://www.suse.com/security/cve/CVE-2015-0439.html https://www.suse.com/security/cve/CVE-2015-0441.html https://www.suse.com/security/cve/CVE-2015-0498.html https://www.suse.com/security/cve/CVE-2015-0499.html https://www.suse.com/security/cve/CVE-2015-0500.html https://www.suse.com/security/cve/CVE-2015-0501.html https://www.suse.com/security/cve/CVE-2015-0503.html https://www.suse.com/security/cve/CVE-2015-0505.html https://www.suse.com/security/cve/CVE-2015-0506.html https://www.suse.com/security/cve/CVE-2015-0507.html https://www.suse.com/security/cve/CVE-2015-0508.html https://www.suse.com/security/cve/CVE-2015-0511.html https://www.suse.com/security/cve/CVE-2015-2305.html https://www.suse.com/security/cve/CVE-2015-2566.html https://www.suse.com/security/cve/CVE-2015-2567.html https://www.suse.com/security/cve/CVE-2015-2568.html https://www.suse.com/security/cve/CVE-2015-2571.html https://www.suse.com/security/cve/CVE-2015-2573.html https://www.suse.com/security/cve/CVE-2015-2576.html https://bugzilla.suse.com/922043 https://bugzilla.suse.com/927623 https://download.suse.com/patch/finder/?keywords=bf7ed7fc98aa76bac61b9bec76… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0944-1: important: Security update for Xen
by opensuse-security＠opensuse.org 26 May '15

26 May '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0944-1 Rating: important References: #910441 #927967 #929339 Cross-References: CVE-2015-3340 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-xen=10685 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): xen-devel-4.1.6_08-0.11.1 xen-kmp-default-4.1.6_08_3.0.101_0.7.29-0.11.1 xen-kmp-trace-4.1.6_08_3.0.101_0.7.29-0.11.1 xen-libs-4.1.6_08-0.11.1 xen-tools-domU-4.1.6_08-0.11.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (x86_64): xen-4.1.6_08-0.11.1 xen-doc-html-4.1.6_08-0.11.1 xen-doc-pdf-4.1.6_08-0.11.1 xen-libs-32bit-4.1.6_08-0.11.1 xen-tools-4.1.6_08-0.11.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): xen-kmp-pae-4.1.6_08_3.0.101_0.7.29-0.11.1 References: https://www.suse.com/security/cve/CVE-2015-3340.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/910441 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=8be2bb05e7093a3facd3bc07a9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0943-1: important: Security update for KVM
by opensuse-security＠opensuse.org 26 May '15

26 May '15

SUSE Security Update: Security update for KVM ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0943-1 Rating: important References: #834196 #929339 Cross-References: CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: KVM was updated to fix the following issues: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * Validate VMDK4 version field so we don't process versions we know nothing about. (bsc#834196) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-kvm=10682 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): kvm-0.15.1-0.29.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/834196 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=8fa4cd2e0df2fbbbef8a56f272… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0889-2: important: Security update for Xen
by opensuse-security＠opensuse.org 26 May '15

26 May '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0889-2 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Xen was updated to fix a buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. (CVE-2015-3456) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): xen-3.2.3_17040_46-0.15.1 xen-devel-3.2.3_17040_46-0.15.1 xen-doc-html-3.2.3_17040_46-0.15.1 xen-doc-pdf-3.2.3_17040_46-0.15.1 xen-doc-ps-3.2.3_17040_46-0.15.1 xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-libs-3.2.3_17040_46-0.15.1 xen-tools-3.2.3_17040_46-0.15.1 xen-tools-domU-3.2.3_17040_46-0.15.1 xen-tools-ioemu-3.2.3_17040_46-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): xen-libs-32bit-3.2.3_17040_46-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.132.1-0.15.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=114b7cce479b39879add5cf193… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0940-1: important: Security update for Xen
by opensuse-security＠opensuse.org 26 May '15

26 May '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0940-1 Rating: important References: #927967 #929339 Cross-References: CVE-2015-3340 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Xen was updated to fix two security issues: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: An information leak through XEN_DOMCTL_gettscinfo(). (XSA-132) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-xen=10684 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): xen-4.0.3_21548_18-0.21.1 xen-doc-html-4.0.3_21548_18-0.21.1 xen-doc-pdf-4.0.3_21548_18-0.21.1 xen-kmp-default-4.0.3_21548_18_2.6.32.59_0.19-0.21.1 xen-kmp-trace-4.0.3_21548_18_2.6.32.59_0.19-0.21.1 xen-libs-4.0.3_21548_18-0.21.1 xen-tools-4.0.3_21548_18-0.21.1 xen-tools-domU-4.0.3_21548_18-0.21.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): xen-kmp-pae-4.0.3_21548_18_2.6.32.59_0.19-0.21.1 References: https://www.suse.com/security/cve/CVE-2015-3340.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=aee7c643a4c4513e4350b80ada… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0929-1: important: Security update for KVM
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for KVM ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0929-1 Rating: important References: #877642 #877645 #929339 Cross-References: CVE-2014-0222 CVE-2014-0223 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: KVM was updated to fix the following security issues: * CVE-2015-3456: Buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c in QEMU allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image. * CVE-2014-0223: Integer overflow in the qcow_open function in block/qcow.c in QEMU allowed local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read. Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2014-0222 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222> * CVE-2014-0223 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-kvm=10683 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64) [New Version: 0.12.5]: kvm-0.12.5-1.26.1 References: https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-0223.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/877642 https://bugzilla.suse.com/877645 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=a793805e5c8b31d54aefde0380… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0928-1: important: Security update for SUSE Manager Server 1.7
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for SUSE Manager Server 1.7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0928-1 Rating: important References: #799068 #809927 #814954 #864246 #870159 #879904 #881111 #896238 #896244 #898426 #900956 #901108 #902915 #903723 #906850 #912886 #922525 Cross-References: CVE-2014-7811 CVE-2014-7812 CVE-2014-8162 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 14 fixes is now available. It includes 9 new package versions. Description: This collective update for SUSE Manager 1.7 provides several fixes and enhancements. smdba: * Space reclamation caused ORA-00942 (table or view does not exist). (bsc#906850) * Optimized space reclamation for Oracle. * Implement fully hot operations for PostgreSQL. * System check breaks backup and other configuration. * Implement rotating PostgreSQL backup feature. (bsc#896244) * Set PostgreSQL max connections to the same value as for Oracle. sm-ncc-sync-data: * Add ATI and nVidia channels for SLED11-SP3. (bsc#901108) spacecmd: * Fix call to setCustomOptions(). (bsc#879904) spacewalk-backend: * Fix encoding of submit message. * Trigger generation of metadata if the repository contains no packages. (bsc#870159) spacewalk-branding: * Update default Spacewalk entitlement certificate. spacewalk-java: * Introduce improved parser for xmlrpc. (CVE-2014-8162, bsc#922525) * Fix more cross-site scripting bugs. (CVE-2014-7811, bsc#902915) * Ffix CVE audit in case of multiversion package installed and patch in multi channels. (bsc#903723) * Fix automatic configuration file deployment via snippet. (bsc#898426) * Download CSV button does not export all columns ("Base Channel" missing). (bsc#896238) * Fix cross-site scripting in system-group. (CVE-2014-7812, bsc#912886) spacewalk-setup: * Fix XML RPC API External Entities file disclosure. (CVE-2014-8162, bsc#922525) * No activation if db population should be skipped. (bsc#900956) susemanager-schema: * Fix evr_t schema upgrade. (bsc#881111) susemanager: * Add tool to update the spacewalk public cert in the DB. * Fix the test for the mirror credentials. (bsc#864246) How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema with spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start Security Issues: * CVE-2014-7811 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7811> * CVE-2014-7812 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7812> * CVE-2014-8162 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8162> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-sm-ncc-sync-data=10671 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64) [New Version: 1.5,1.7.1.13,1.7.30,1.7.38.34 and 1.7.7.12]: smdba-1.5-0.6.2.1 spacecmd-1.7.7.12-0.5.1 spacewalk-backend-1.7.38.34-0.5.1 spacewalk-backend-app-1.7.38.34-0.5.1 spacewalk-backend-applet-1.7.38.34-0.5.1 spacewalk-backend-config-files-1.7.38.34-0.5.1 spacewalk-backend-config-files-common-1.7.38.34-0.5.1 spacewalk-backend-config-files-tool-1.7.38.34-0.5.1 spacewalk-backend-iss-1.7.38.34-0.5.1 spacewalk-backend-iss-export-1.7.38.34-0.5.1 spacewalk-backend-libs-1.7.38.34-0.5.1 spacewalk-backend-package-push-server-1.7.38.34-0.5.1 spacewalk-backend-server-1.7.38.34-0.5.1 spacewalk-backend-sql-1.7.38.34-0.5.1 spacewalk-backend-sql-oracle-1.7.38.34-0.5.1 spacewalk-backend-sql-postgresql-1.7.38.34-0.5.1 spacewalk-backend-tools-1.7.38.34-0.5.1 spacewalk-backend-xml-export-libs-1.7.38.34-0.5.1 spacewalk-backend-xmlrpc-1.7.38.34-0.5.1 spacewalk-backend-xp-1.7.38.34-0.5.1 spacewalk-branding-1.7.1.13-0.5.1 susemanager-1.7.30-0.5.2 susemanager-tools-1.7.30-0.5.2 - SUSE Manager 1.7 for SLE 11 SP2 (noarch) [New Version: 1.7.21,1.7.54.34,1.7.56.24 and 1.7.9.12]: sm-ncc-sync-data-1.7.21-0.5.1 spacewalk-java-1.7.54.34-0.5.1 spacewalk-java-config-1.7.54.34-0.5.1 spacewalk-java-lib-1.7.54.34-0.5.1 spacewalk-java-oracle-1.7.54.34-0.5.1 spacewalk-java-postgresql-1.7.54.34-0.5.1 spacewalk-setup-1.7.9.12-0.5.1 spacewalk-taskomatic-1.7.54.34-0.5.1 susemanager-schema-1.7.56.24-0.7.1 References: https://www.suse.com/security/cve/CVE-2014-7811.html https://www.suse.com/security/cve/CVE-2014-7812.html https://www.suse.com/security/cve/CVE-2014-8162.html https://bugzilla.suse.com/799068 https://bugzilla.suse.com/809927 https://bugzilla.suse.com/814954 https://bugzilla.suse.com/864246 https://bugzilla.suse.com/870159 https://bugzilla.suse.com/879904 https://bugzilla.suse.com/881111 https://bugzilla.suse.com/896238 https://bugzilla.suse.com/896244 https://bugzilla.suse.com/898426 https://bugzilla.suse.com/900956 https://bugzilla.suse.com/901108 https://bugzilla.suse.com/902915 https://bugzilla.suse.com/903723 https://bugzilla.suse.com/906850 https://bugzilla.suse.com/912886 https://bugzilla.suse.com/922525 https://download.suse.com/patch/finder/?keywords=8028a25587947641ad45132e49… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0927-1: important: Security update for Xen
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0927-1 Rating: important References: #910441 #927967 #929339 Cross-References: CVE-2015-3456 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen=10673 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen=10673 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen=10673 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-libs-4.2.5_06-0.7.1 xen-tools-domU-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.5_06-0.7.1 xen-doc-html-4.2.5_06-0.7.1 xen-doc-pdf-4.2.5_06-0.7.1 xen-libs-32bit-4.2.5_06-0.7.1 xen-tools-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-libs-4.2.5_06-0.7.1 xen-tools-domU-4.2.5_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.5_06-0.7.1 xen-doc-html-4.2.5_06-0.7.1 xen-doc-pdf-4.2.5_06-0.7.1 xen-libs-32bit-4.2.5_06-0.7.1 xen-tools-4.2.5_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/910441 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=beaa1b0c2d4c1d543469208fc4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0923-1: important: Security update for xen
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0923-1 Rating: important References: #922705 #922709 #927967 #929339 Cross-References: CVE-2015-2751 CVE-2015-2752 CVE-2015-3340 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: XEN was updated to fix two security issues and bugs. Security issues fixed: * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * CVE-2015-2751: Xen, when using toolstack disaggregation, allowed remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. * CVE-2015-2752: The XEN_DOMCTL_memory_mapping hypercall in Xen, when using a PCI passthrough device, was not preemptable, which allowed local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Bugs fixed: - xentop: Fix memory leak on read failure Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-206=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-206=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-206=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.2_04-18.1 xen-devel-4.4.2_04-18.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.2_04-18.1 xen-debugsource-4.4.2_04-18.1 xen-doc-html-4.4.2_04-18.1 xen-kmp-default-4.4.2_04_k3.12.39_47-18.1 xen-kmp-default-debuginfo-4.4.2_04_k3.12.39_47-18.1 xen-libs-32bit-4.4.2_04-18.1 xen-libs-4.4.2_04-18.1 xen-libs-debuginfo-32bit-4.4.2_04-18.1 xen-libs-debuginfo-4.4.2_04-18.1 xen-tools-4.4.2_04-18.1 xen-tools-debuginfo-4.4.2_04-18.1 xen-tools-domU-4.4.2_04-18.1 xen-tools-domU-debuginfo-4.4.2_04-18.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.2_04-18.1 xen-debugsource-4.4.2_04-18.1 xen-kmp-default-4.4.2_04_k3.12.39_47-18.1 xen-kmp-default-debuginfo-4.4.2_04_k3.12.39_47-18.1 xen-libs-32bit-4.4.2_04-18.1 xen-libs-4.4.2_04-18.1 xen-libs-debuginfo-32bit-4.4.2_04-18.1 xen-libs-debuginfo-4.4.2_04-18.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-2752.html https://www.suse.com/security/cve/CVE-2015-3340.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/922705 https://bugzilla.suse.com/922709 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0921-1: important: Security update for gstreamer-0_10-plugins-bad
by opensuse-security＠opensuse.org 20 May '15

20 May '15

SUSE Security Update: Security update for gstreamer-0_10-plugins-bad ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0921-1 Rating: important References: #927559 Cross-References: CVE-2015-0797 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797). Security Issues: * CVE-2015-0797 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-gstreamer-0_10-plugins-bad=10643 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): gstreamer-0_10-plugins-bad-0.10.22-7.11.1 gstreamer-0_10-plugins-bad-lang-0.10.22-7.11.1 libgstbasecamerabinsrc-0_10-0-0.10.22-7.11.1 libgstbasevideo-0_10-0-0.10.22-7.11.1 libgstphotography-0_10-0-0.10.22-7.11.1 libgstsignalprocessor-0_10-0-0.10.22-7.11.1 libgstvdp-0_10-0-0.10.22-7.11.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libgstbasecamerabinsrc-0_10-0-32bit-0.10.22-7.11.1 libgstbasevideo-0_10-0-32bit-0.10.22-7.11.1 libgstphotography-0_10-0-32bit-0.10.22-7.11.1 libgstsignalprocessor-0_10-0-32bit-0.10.22-7.11.1 libgstvdp-0_10-0-32bit-0.10.22-7.11.1 References: https://www.suse.com/security/cve/CVE-2015-0797.html https://bugzilla.suse.com/927559 https://download.suse.com/patch/finder/?keywords=f7ccd0598b1d14e206c07e7685… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0914-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 19 May '15

19 May '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0914-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-372=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-372=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.460-2.51.1 flash-player-gnome-11.2.202.460-2.51.1 flash-player-kde4-11.2.202.460-2.51.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.460-116.1 flash-player-gnome-11.2.202.460-116.1 flash-player-kde4-11.2.202.460-116.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0896-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0896-1 Rating: important References: #886378 #924018 #929339 Cross-References: CVE-2015-1779 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: qemu / kvm was updated to fix a security issue and some bugs. Security issue fixed: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. * CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder. Bugs fixed: - qemu truncates vhd images in virt-rescue (bsc#886378) - Update kvm-supported.txt with the current rbd support status. - enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-200=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-200=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): qemu-2.0.2-46.1 qemu-block-curl-2.0.2-46.1 qemu-block-curl-debuginfo-2.0.2-46.1 qemu-debugsource-2.0.2-46.1 qemu-guest-agent-2.0.2-46.1 qemu-guest-agent-debuginfo-2.0.2-46.1 qemu-lang-2.0.2-46.1 qemu-tools-2.0.2-46.1 qemu-tools-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): qemu-kvm-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (ppc64le): qemu-ppc-2.0.2-46.1 qemu-ppc-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (noarch): qemu-ipxe-1.0.0-46.1 qemu-seabios-1.7.4-46.1 qemu-sgabios-8-46.1 qemu-vgabios-1.7.4-46.1 - SUSE Linux Enterprise Server 12 (x86_64): qemu-block-rbd-2.0.2-46.1 qemu-block-rbd-debuginfo-2.0.2-46.1 qemu-x86-2.0.2-46.1 qemu-x86-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (s390x): qemu-s390-2.0.2-46.1 qemu-s390-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Desktop 12 (x86_64): qemu-2.0.2-46.1 qemu-block-curl-2.0.2-46.1 qemu-block-curl-debuginfo-2.0.2-46.1 qemu-debugsource-2.0.2-46.1 qemu-kvm-2.0.2-46.1 qemu-tools-2.0.2-46.1 qemu-tools-debuginfo-2.0.2-46.1 qemu-x86-2.0.2-46.1 qemu-x86-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Desktop 12 (noarch): qemu-ipxe-1.0.0-46.1 qemu-seabios-1.7.4-46.1 qemu-sgabios-8-46.1 qemu-vgabios-1.7.4-46.1 References: https://www.suse.com/security/cve/CVE-2015-1779.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/886378 https://bugzilla.suse.com/924018 https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0894-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0894-1 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: qemu was updated to fix a security issue: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-363=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): qemu-1.6.2-4.8.1 qemu-debuginfo-1.6.2-4.8.1 qemu-debugsource-1.6.2-4.8.1 qemu-guest-agent-1.6.2-4.8.1 qemu-guest-agent-debuginfo-1.6.2-4.8.1 qemu-lang-1.6.2-4.8.1 qemu-linux-user-1.6.2-4.8.1 qemu-linux-user-debuginfo-1.6.2-4.8.1 qemu-linux-user-debugsource-1.6.2-4.8.1 qemu-tools-1.6.2-4.8.1 qemu-tools-debuginfo-1.6.2-4.8.1 - openSUSE 13.1 (noarch): qemu-ipxe-1.0.0-4.8.1 qemu-seabios-1.7.2.2-4.8.1 qemu-sgabios-8-4.8.1 qemu-vgabios-0.6c-4.8.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0893-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0893-1 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Qemu was updated to v2.1.3: See http://wiki.qemu-project.org/ChangeLog/2.1 for more information. This update includes a security fix: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-364=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcacard-debugsource-2.1.3-4.1 libcacard-devel-2.1.3-4.1 libcacard0-2.1.3-4.1 libcacard0-debuginfo-2.1.3-4.1 qemu-2.1.3-4.1 qemu-arm-2.1.3-4.1 qemu-arm-debuginfo-2.1.3-4.1 qemu-block-curl-2.1.3-4.1 qemu-block-curl-debuginfo-2.1.3-4.1 qemu-debugsource-2.1.3-4.1 qemu-extra-2.1.3-4.1 qemu-extra-debuginfo-2.1.3-4.1 qemu-guest-agent-2.1.3-4.1 qemu-guest-agent-debuginfo-2.1.3-4.1 qemu-ksm-2.1.3-4.1 qemu-kvm-2.1.3-4.1 qemu-lang-2.1.3-4.1 qemu-linux-user-2.1.3-4.1 qemu-linux-user-debuginfo-2.1.3-4.1 qemu-linux-user-debugsource-2.1.3-4.1 qemu-ppc-2.1.3-4.1 qemu-ppc-debuginfo-2.1.3-4.1 qemu-s390-2.1.3-4.1 qemu-s390-debuginfo-2.1.3-4.1 qemu-tools-2.1.3-4.1 qemu-tools-debuginfo-2.1.3-4.1 qemu-x86-2.1.3-4.1 qemu-x86-debuginfo-2.1.3-4.1 - openSUSE 13.2 (noarch): qemu-ipxe-1.0.0-4.1 qemu-seabios-1.7.5-4.1 qemu-sgabios-8-4.1 qemu-vgabios-1.7.5-4.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0892-1: important: Update to Firefox 31.7.0esr
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Update to Firefox 31.7.0esr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0892-1 Rating: important References: #925368 #930622 Cross-References: CVE-2011-3079 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: - update to Firefox 31.7.0esr (bnc#930622) * MFSA 2015-46/CVE-2015-2708 Miscellaneous memory safety hazards * MFSA 2015-47/VE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer * MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS * MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled * MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML * MFSA 2015-57/CVE-2011-3079 (bmo#1087565) Privilege escalation through IPC channel messages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-15=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.7.0-140.1 MozillaFirefox-branding-upstream-31.7.0-140.1 MozillaFirefox-buildsymbols-31.7.0-140.1 MozillaFirefox-debuginfo-31.7.0-140.1 MozillaFirefox-debugsource-31.7.0-140.1 MozillaFirefox-devel-31.7.0-140.1 MozillaFirefox-translations-common-31.7.0-140.1 MozillaFirefox-translations-other-31.7.0-140.1 References: https://www.suse.com/security/cve/CVE-2011-3079.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://bugzilla.suse.com/925368 https://bugzilla.suse.com/930622 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0884-2: important: Security update for spice
by opensuse-security＠opensuse.org 15 May '15

15 May '15

SUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0884-2 Rating: important References: #848279 Cross-References: CVE-2013-4282 Affected Products: SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-199=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): libspice-server-devel-0.12.4-6.1 spice-debugsource-0.12.4-6.1 References: https://www.suse.com/security/cve/CVE-2013-4282.html https://bugzilla.suse.com/848279 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0890-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 May '15

15 May '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0890-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.460-161.1 flash-player-gnome-11.2.202.460-161.1 flash-player-kde4-11.2.202.460-161.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0889-1: important: Security update for KVM
by opensuse-security＠opensuse.org 15 May '15

15 May '15

SUSE Security Update: Security update for KVM ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0889-1 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: KVM was updated to fix a buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. (CVE-2015-3456) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kvm=10672 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kvm=10672 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.27.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.27.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=0004a1b76b4d8709b2022934a3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0884-1: important: Security update for spice
by opensuse-security＠opensuse.org 15 May '15

15 May '15

SUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0884-1 Rating: important References: #848279 Cross-References: CVE-2013-4282 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-199=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-199=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (x86_64): libspice-server1-0.12.4-6.1 libspice-server1-debuginfo-0.12.4-6.1 spice-debugsource-0.12.4-6.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libspice-server1-0.12.4-6.1 libspice-server1-debuginfo-0.12.4-6.1 spice-debugsource-0.12.4-6.1 References: https://www.suse.com/security/cve/CVE-2013-4282.html https://bugzilla.suse.com/848279 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0878-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 14 May '15

14 May '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0878-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-197=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-197=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.460-83.1 flash-player-gnome-11.2.202.460-83.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.460-83.1 flash-player-gnome-11.2.202.460-83.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0870-1: important: Security update for kvm
by opensuse-security＠opensuse.org 13 May '15

13 May '15

SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0870-1 Rating: important References: #920571 #924018 Cross-References: CVE-2015-1779 Affected Products: SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: This update for KVM fixes an issue in the virtio-blk driver which could result in incorrectly setting its WCE configuration. Under some circumstances, this misconfiguration could cause severe file system corruption, because cache flushes were not generated as they ought to have been. The update also addresses one security vulnerability: * CVE-2015-1779: Insufficient resource limiting in VNC websockets decoder. (bsc#924018) Security Issues: * CVE-2015-1779 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1779> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kvm=10645 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kvm=10645 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.25.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.25.1 References: https://www.suse.com/security/cve/CVE-2015-1779.html https://bugzilla.suse.com/920571 https://bugzilla.suse.com/924018 https://download.suse.com/patch/finder/?keywords=5ce7157b96103bdd850e596ab6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0868-1: important: Security update for php5
by opensuse-security＠opensuse.org 13 May '15

13 May '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0868-1 Rating: important References: #922022 #922451 #922452 #923946 #924970 #924972 #925109 #928408 #928506 #928511 Cross-References: CVE-2014-9705 CVE-2014-9709 CVE-2015-2301 CVE-2015-2305 CVE-2015-2348 CVE-2015-2783 CVE-2015-2787 CVE-2015-3329 CVE-2015-3330 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: PHP was updated to fix ten security issues. The following vulnerabilities were fixed: * CVE-2014-9709: A specially crafted GIF file could cause a buffer read overflow in php-gd (bnc#923946) * CVE-2015-2301: Memory was use after it was freed in PHAR (bnc#922022) * CVE-2015-2305: heap overflow vulnerability in regcomp.c (bnc#922452) * CVE-2014-9705: heap buffer overflow in Enchant (bnc#922451) * CVE-2015-2787: use-after-free vulnerability in the process_nested_data function (bnc#924972) * unserialize SoapClient type confusion (bnc#925109) * CVE-2015-2348: move_uploaded_file truncates a pathNAME upon encountering a x00 character (bnc#924970) * CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506) * CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506) * CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-192=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-192=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-22.1 php5-debugsource-5.5.14-22.1 php5-devel-5.5.14-22.1 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php5-5.5.14-22.1 apache2-mod_php5-debuginfo-5.5.14-22.1 php5-5.5.14-22.1 php5-bcmath-5.5.14-22.1 php5-bcmath-debuginfo-5.5.14-22.1 php5-bz2-5.5.14-22.1 php5-bz2-debuginfo-5.5.14-22.1 php5-calendar-5.5.14-22.1 php5-calendar-debuginfo-5.5.14-22.1 php5-ctype-5.5.14-22.1 php5-ctype-debuginfo-5.5.14-22.1 php5-curl-5.5.14-22.1 php5-curl-debuginfo-5.5.14-22.1 php5-dba-5.5.14-22.1 php5-dba-debuginfo-5.5.14-22.1 php5-debuginfo-5.5.14-22.1 php5-debugsource-5.5.14-22.1 php5-dom-5.5.14-22.1 php5-dom-debuginfo-5.5.14-22.1 php5-enchant-5.5.14-22.1 php5-enchant-debuginfo-5.5.14-22.1 php5-exif-5.5.14-22.1 php5-exif-debuginfo-5.5.14-22.1 php5-fastcgi-5.5.14-22.1 php5-fastcgi-debuginfo-5.5.14-22.1 php5-fileinfo-5.5.14-22.1 php5-fileinfo-debuginfo-5.5.14-22.1 php5-fpm-5.5.14-22.1 php5-fpm-debuginfo-5.5.14-22.1 php5-ftp-5.5.14-22.1 php5-ftp-debuginfo-5.5.14-22.1 php5-gd-5.5.14-22.1 php5-gd-debuginfo-5.5.14-22.1 php5-gettext-5.5.14-22.1 php5-gettext-debuginfo-5.5.14-22.1 php5-gmp-5.5.14-22.1 php5-gmp-debuginfo-5.5.14-22.1 php5-iconv-5.5.14-22.1 php5-iconv-debuginfo-5.5.14-22.1 php5-intl-5.5.14-22.1 php5-intl-debuginfo-5.5.14-22.1 php5-json-5.5.14-22.1 php5-json-debuginfo-5.5.14-22.1 php5-ldap-5.5.14-22.1 php5-ldap-debuginfo-5.5.14-22.1 php5-mbstring-5.5.14-22.1 php5-mbstring-debuginfo-5.5.14-22.1 php5-mcrypt-5.5.14-22.1 php5-mcrypt-debuginfo-5.5.14-22.1 php5-mysql-5.5.14-22.1 php5-mysql-debuginfo-5.5.14-22.1 php5-odbc-5.5.14-22.1 php5-odbc-debuginfo-5.5.14-22.1 php5-openssl-5.5.14-22.1 php5-openssl-debuginfo-5.5.14-22.1 php5-pcntl-5.5.14-22.1 php5-pcntl-debuginfo-5.5.14-22.1 php5-pdo-5.5.14-22.1 php5-pdo-debuginfo-5.5.14-22.1 php5-pgsql-5.5.14-22.1 php5-pgsql-debuginfo-5.5.14-22.1 php5-pspell-5.5.14-22.1 php5-pspell-debuginfo-5.5.14-22.1 php5-shmop-5.5.14-22.1 php5-shmop-debuginfo-5.5.14-22.1 php5-snmp-5.5.14-22.1 php5-snmp-debuginfo-5.5.14-22.1 php5-soap-5.5.14-22.1 php5-soap-debuginfo-5.5.14-22.1 php5-sockets-5.5.14-22.1 php5-sockets-debuginfo-5.5.14-22.1 php5-sqlite-5.5.14-22.1 php5-sqlite-debuginfo-5.5.14-22.1 php5-suhosin-5.5.14-22.1 php5-suhosin-debuginfo-5.5.14-22.1 php5-sysvmsg-5.5.14-22.1 php5-sysvmsg-debuginfo-5.5.14-22.1 php5-sysvsem-5.5.14-22.1 php5-sysvsem-debuginfo-5.5.14-22.1 php5-sysvshm-5.5.14-22.1 php5-sysvshm-debuginfo-5.5.14-22.1 php5-tokenizer-5.5.14-22.1 php5-tokenizer-debuginfo-5.5.14-22.1 php5-wddx-5.5.14-22.1 php5-wddx-debuginfo-5.5.14-22.1 php5-xmlreader-5.5.14-22.1 php5-xmlreader-debuginfo-5.5.14-22.1 php5-xmlrpc-5.5.14-22.1 php5-xmlrpc-debuginfo-5.5.14-22.1 php5-xmlwriter-5.5.14-22.1 php5-xmlwriter-debuginfo-5.5.14-22.1 php5-xsl-5.5.14-22.1 php5-xsl-debuginfo-5.5.14-22.1 php5-zip-5.5.14-22.1 php5-zip-debuginfo-5.5.14-22.1 php5-zlib-5.5.14-22.1 php5-zlib-debuginfo-5.5.14-22.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-22.1 References: https://www.suse.com/security/cve/CVE-2014-9705.html https://www.suse.com/security/cve/CVE-2014-9709.html https://www.suse.com/security/cve/CVE-2015-2301.html https://www.suse.com/security/cve/CVE-2015-2305.html https://www.suse.com/security/cve/CVE-2015-2348.html https://www.suse.com/security/cve/CVE-2015-2783.html https://www.suse.com/security/cve/CVE-2015-2787.html https://www.suse.com/security/cve/CVE-2015-3329.html https://www.suse.com/security/cve/CVE-2015-3330.html https://bugzilla.suse.com/922022 https://bugzilla.suse.com/922451 https://bugzilla.suse.com/922452 https://bugzilla.suse.com/923946 https://bugzilla.suse.com/924970 https://bugzilla.suse.com/924972 https://bugzilla.suse.com/925109 https://bugzilla.suse.com/928408 https://bugzilla.suse.com/928506 https://bugzilla.suse.com/928511 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0855-1: important: Security update for php5
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0855-1 Rating: important References: #927147 #928408 #928506 #928511 Cross-References: CVE-2015-2783 CVE-2015-3329 CVE-2015-3330 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: PHP was updated to fix three security issues. The following vulnerabilities were fixed: * CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506) * CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506) * CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511) On openSUSE 13.2, the following bug was fixed: * boo#927147: php5-fpm did not start correctly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-352=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-352=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-21.1 apache2-mod_php5-debuginfo-5.6.1-21.1 php5-5.6.1-21.1 php5-bcmath-5.6.1-21.1 php5-bcmath-debuginfo-5.6.1-21.1 php5-bz2-5.6.1-21.1 php5-bz2-debuginfo-5.6.1-21.1 php5-calendar-5.6.1-21.1 php5-calendar-debuginfo-5.6.1-21.1 php5-ctype-5.6.1-21.1 php5-ctype-debuginfo-5.6.1-21.1 php5-curl-5.6.1-21.1 php5-curl-debuginfo-5.6.1-21.1 php5-dba-5.6.1-21.1 php5-dba-debuginfo-5.6.1-21.1 php5-debuginfo-5.6.1-21.1 php5-debugsource-5.6.1-21.1 php5-devel-5.6.1-21.1 php5-dom-5.6.1-21.1 php5-dom-debuginfo-5.6.1-21.1 php5-enchant-5.6.1-21.1 php5-enchant-debuginfo-5.6.1-21.1 php5-exif-5.6.1-21.1 php5-exif-debuginfo-5.6.1-21.1 php5-fastcgi-5.6.1-21.1 php5-fastcgi-debuginfo-5.6.1-21.1 php5-fileinfo-5.6.1-21.1 php5-fileinfo-debuginfo-5.6.1-21.1 php5-firebird-5.6.1-21.1 php5-firebird-debuginfo-5.6.1-21.1 php5-fpm-5.6.1-21.1 php5-fpm-debuginfo-5.6.1-21.1 php5-ftp-5.6.1-21.1 php5-ftp-debuginfo-5.6.1-21.1 php5-gd-5.6.1-21.1 php5-gd-debuginfo-5.6.1-21.1 php5-gettext-5.6.1-21.1 php5-gettext-debuginfo-5.6.1-21.1 php5-gmp-5.6.1-21.1 php5-gmp-debuginfo-5.6.1-21.1 php5-iconv-5.6.1-21.1 php5-iconv-debuginfo-5.6.1-21.1 php5-imap-5.6.1-21.1 php5-imap-debuginfo-5.6.1-21.1 php5-intl-5.6.1-21.1 php5-intl-debuginfo-5.6.1-21.1 php5-json-5.6.1-21.1 php5-json-debuginfo-5.6.1-21.1 php5-ldap-5.6.1-21.1 php5-ldap-debuginfo-5.6.1-21.1 php5-mbstring-5.6.1-21.1 php5-mbstring-debuginfo-5.6.1-21.1 php5-mcrypt-5.6.1-21.1 php5-mcrypt-debuginfo-5.6.1-21.1 php5-mssql-5.6.1-21.1 php5-mssql-debuginfo-5.6.1-21.1 php5-mysql-5.6.1-21.1 php5-mysql-debuginfo-5.6.1-21.1 php5-odbc-5.6.1-21.1 php5-odbc-debuginfo-5.6.1-21.1 php5-opcache-5.6.1-21.1 php5-opcache-debuginfo-5.6.1-21.1 php5-openssl-5.6.1-21.1 php5-openssl-debuginfo-5.6.1-21.1 php5-pcntl-5.6.1-21.1 php5-pcntl-debuginfo-5.6.1-21.1 php5-pdo-5.6.1-21.1 php5-pdo-debuginfo-5.6.1-21.1 php5-pgsql-5.6.1-21.1 php5-pgsql-debuginfo-5.6.1-21.1 php5-phar-5.6.1-21.1 php5-phar-debuginfo-5.6.1-21.1 php5-posix-5.6.1-21.1 php5-posix-debuginfo-5.6.1-21.1 php5-pspell-5.6.1-21.1 php5-pspell-debuginfo-5.6.1-21.1 php5-readline-5.6.1-21.1 php5-readline-debuginfo-5.6.1-21.1 php5-shmop-5.6.1-21.1 php5-shmop-debuginfo-5.6.1-21.1 php5-snmp-5.6.1-21.1 php5-snmp-debuginfo-5.6.1-21.1 php5-soap-5.6.1-21.1 php5-soap-debuginfo-5.6.1-21.1 php5-sockets-5.6.1-21.1 php5-sockets-debuginfo-5.6.1-21.1 php5-sqlite-5.6.1-21.1 php5-sqlite-debuginfo-5.6.1-21.1 php5-suhosin-5.6.1-21.1 php5-suhosin-debuginfo-5.6.1-21.1 php5-sysvmsg-5.6.1-21.1 php5-sysvmsg-debuginfo-5.6.1-21.1 php5-sysvsem-5.6.1-21.1 php5-sysvsem-debuginfo-5.6.1-21.1 php5-sysvshm-5.6.1-21.1 php5-sysvshm-debuginfo-5.6.1-21.1 php5-tidy-5.6.1-21.1 php5-tidy-debuginfo-5.6.1-21.1 php5-tokenizer-5.6.1-21.1 php5-tokenizer-debuginfo-5.6.1-21.1 php5-wddx-5.6.1-21.1 php5-wddx-debuginfo-5.6.1-21.1 php5-xmlreader-5.6.1-21.1 php5-xmlreader-debuginfo-5.6.1-21.1 php5-xmlrpc-5.6.1-21.1 php5-xmlrpc-debuginfo-5.6.1-21.1 php5-xmlwriter-5.6.1-21.1 php5-xmlwriter-debuginfo-5.6.1-21.1 php5-xsl-5.6.1-21.1 php5-xsl-debuginfo-5.6.1-21.1 php5-zip-5.6.1-21.1 php5-zip-debuginfo-5.6.1-21.1 php5-zlib-5.6.1-21.1 php5-zlib-debuginfo-5.6.1-21.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-21.1 - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-52.1 apache2-mod_php5-debuginfo-5.4.20-52.1 php5-5.4.20-52.1 php5-bcmath-5.4.20-52.1 php5-bcmath-debuginfo-5.4.20-52.1 php5-bz2-5.4.20-52.1 php5-bz2-debuginfo-5.4.20-52.1 php5-calendar-5.4.20-52.1 php5-calendar-debuginfo-5.4.20-52.1 php5-ctype-5.4.20-52.1 php5-ctype-debuginfo-5.4.20-52.1 php5-curl-5.4.20-52.1 php5-curl-debuginfo-5.4.20-52.1 php5-dba-5.4.20-52.1 php5-dba-debuginfo-5.4.20-52.1 php5-debuginfo-5.4.20-52.1 php5-debugsource-5.4.20-52.1 php5-devel-5.4.20-52.1 php5-dom-5.4.20-52.1 php5-dom-debuginfo-5.4.20-52.1 php5-enchant-5.4.20-52.1 php5-enchant-debuginfo-5.4.20-52.1 php5-exif-5.4.20-52.1 php5-exif-debuginfo-5.4.20-52.1 php5-fastcgi-5.4.20-52.1 php5-fastcgi-debuginfo-5.4.20-52.1 php5-fileinfo-5.4.20-52.1 php5-fileinfo-debuginfo-5.4.20-52.1 php5-firebird-5.4.20-52.1 php5-firebird-debuginfo-5.4.20-52.1 php5-fpm-5.4.20-52.1 php5-fpm-debuginfo-5.4.20-52.1 php5-ftp-5.4.20-52.1 php5-ftp-debuginfo-5.4.20-52.1 php5-gd-5.4.20-52.1 php5-gd-debuginfo-5.4.20-52.1 php5-gettext-5.4.20-52.1 php5-gettext-debuginfo-5.4.20-52.1 php5-gmp-5.4.20-52.1 php5-gmp-debuginfo-5.4.20-52.1 php5-iconv-5.4.20-52.1 php5-iconv-debuginfo-5.4.20-52.1 php5-imap-5.4.20-52.1 php5-imap-debuginfo-5.4.20-52.1 php5-intl-5.4.20-52.1 php5-intl-debuginfo-5.4.20-52.1 php5-json-5.4.20-52.1 php5-json-debuginfo-5.4.20-52.1 php5-ldap-5.4.20-52.1 php5-ldap-debuginfo-5.4.20-52.1 php5-mbstring-5.4.20-52.1 php5-mbstring-debuginfo-5.4.20-52.1 php5-mcrypt-5.4.20-52.1 php5-mcrypt-debuginfo-5.4.20-52.1 php5-mssql-5.4.20-52.1 php5-mssql-debuginfo-5.4.20-52.1 php5-mysql-5.4.20-52.1 php5-mysql-debuginfo-5.4.20-52.1 php5-odbc-5.4.20-52.1 php5-odbc-debuginfo-5.4.20-52.1 php5-openssl-5.4.20-52.1 php5-openssl-debuginfo-5.4.20-52.1 php5-pcntl-5.4.20-52.1 php5-pcntl-debuginfo-5.4.20-52.1 php5-pdo-5.4.20-52.1 php5-pdo-debuginfo-5.4.20-52.1 php5-pgsql-5.4.20-52.1 php5-pgsql-debuginfo-5.4.20-52.1 php5-phar-5.4.20-52.1 php5-phar-debuginfo-5.4.20-52.1 php5-posix-5.4.20-52.1 php5-posix-debuginfo-5.4.20-52.1 php5-pspell-5.4.20-52.1 php5-pspell-debuginfo-5.4.20-52.1 php5-readline-5.4.20-52.1 php5-readline-debuginfo-5.4.20-52.1 php5-shmop-5.4.20-52.1 php5-shmop-debuginfo-5.4.20-52.1 php5-snmp-5.4.20-52.1 php5-snmp-debuginfo-5.4.20-52.1 php5-soap-5.4.20-52.1 php5-soap-debuginfo-5.4.20-52.1 php5-sockets-5.4.20-52.1 php5-sockets-debuginfo-5.4.20-52.1 php5-sqlite-5.4.20-52.1 php5-sqlite-debuginfo-5.4.20-52.1 php5-suhosin-5.4.20-52.1 php5-suhosin-debuginfo-5.4.20-52.1 php5-sysvmsg-5.4.20-52.1 php5-sysvmsg-debuginfo-5.4.20-52.1 php5-sysvsem-5.4.20-52.1 php5-sysvsem-debuginfo-5.4.20-52.1 php5-sysvshm-5.4.20-52.1 php5-sysvshm-debuginfo-5.4.20-52.1 php5-tidy-5.4.20-52.1 php5-tidy-debuginfo-5.4.20-52.1 php5-tokenizer-5.4.20-52.1 php5-tokenizer-debuginfo-5.4.20-52.1 php5-wddx-5.4.20-52.1 php5-wddx-debuginfo-5.4.20-52.1 php5-xmlreader-5.4.20-52.1 php5-xmlreader-debuginfo-5.4.20-52.1 php5-xmlrpc-5.4.20-52.1 php5-xmlrpc-debuginfo-5.4.20-52.1 php5-xmlwriter-5.4.20-52.1 php5-xmlwriter-debuginfo-5.4.20-52.1 php5-xsl-5.4.20-52.1 php5-xsl-debuginfo-5.4.20-52.1 php5-zip-5.4.20-52.1 php5-zip-debuginfo-5.4.20-52.1 php5-zlib-5.4.20-52.1 php5-zlib-debuginfo-5.4.20-52.1 - openSUSE 13.1 (noarch): php5-pear-5.4.20-52.1 References: https://www.suse.com/security/cve/CVE-2015-2783.html https://www.suse.com/security/cve/CVE-2015-3329.html https://www.suse.com/security/cve/CVE-2015-3330.html https://bugzilla.suse.com/927147 https://bugzilla.suse.com/928408 https://bugzilla.suse.com/928506 https://bugzilla.suse.com/928511 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0839-1: important: Security update for DirectFB
by opensuse-security＠opensuse.org 08 May '15

08 May '15

SUSE Security Update: Security update for DirectFB ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0839-1 Rating: important References: #878345 #878349 Cross-References: CVE-2014-2977 CVE-2014-2978 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: DirectFB was updated to fix two security issues. The following vulnerabilities were fixed: * CVE-2014-2977: Multiple integer signedness errors could allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow. * CVE-2014-2978: Remote attackers could cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-185=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-185=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-185=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-185=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): libdirectfb-1_7-1-32bit-1.7.1-4.1 libdirectfb-1_7-1-debuginfo-32bit-1.7.1-4.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): DirectFB-debuginfo-1.7.1-4.1 DirectFB-debugsource-1.7.1-4.1 DirectFB-devel-1.7.1-4.1 lib++dfb-devel-1.7.1-4.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): DirectFB-1.7.1-4.1 DirectFB-debuginfo-1.7.1-4.1 DirectFB-debugsource-1.7.1-4.1 lib++dfb-1_7-1-1.7.1-4.1 lib++dfb-1_7-1-debuginfo-1.7.1-4.1 libdirectfb-1_7-1-1.7.1-4.1 libdirectfb-1_7-1-debuginfo-1.7.1-4.1 - SUSE Linux Enterprise Desktop 12 (x86_64): DirectFB-1.7.1-4.1 DirectFB-debuginfo-1.7.1-4.1 DirectFB-debugsource-1.7.1-4.1 lib++dfb-1_7-1-1.7.1-4.1 lib++dfb-1_7-1-debuginfo-1.7.1-4.1 libdirectfb-1_7-1-1.7.1-4.1 libdirectfb-1_7-1-32bit-1.7.1-4.1 libdirectfb-1_7-1-debuginfo-1.7.1-4.1 libdirectfb-1_7-1-debuginfo-32bit-1.7.1-4.1 References: https://www.suse.com/security/cve/CVE-2014-2977.html https://www.suse.com/security/cve/CVE-2014-2978.html https://bugzilla.suse.com/878345 https://bugzilla.suse.com/878349 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0833-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 07 May '15

07 May '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0833-1 Rating: critical References: #927591 Cross-References: CVE-2015-0458 CVE-2015-0459 CVE-2015-0460 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0484 CVE-2015-0488 CVE-2015-0491 CVE-2015-0492 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. It includes one version update. Description: OpenJDK was updated to version 2.5.5 - OpenJDK 7u79 to fix security issues and bugs. The following vulnerabilities have been fixed: * CVE-2015-0458: Deployment: unauthenticated remote attackers could execute arbitrary code via multiple protocols. * CVE-2015-0459: 2D: unauthenticated remote attackers could execute arbitrary code via multiple protocols. * CVE-2015-0460: Hotspot: unauthenticated remote attackers could execute arbitrary code via multiple protocols. * CVE-2015-0469: 2D: unauthenticated remote attackers could execute arbitrary code via multiple protocols. * CVE-2015-0477: Beans: unauthenticated remote attackers could update, insert or delete some JAVA accessible data via multiple protocols * CVE-2015-0478: JCE: unauthenticated remote attackers could read some JAVA accessible data via multiple protocols * CVE-2015-0480: Tools: unauthenticated remote attackers could update, insert or delete some JAVA accessible data via multiple protocols and cause a partial denial of service (partial DOS) * CVE-2015-0484: JavaFX: unauthenticated remote attackers could read, update, insert or delete access some Java accessible data via multiple protocols and cause a partial denial of service (partial DOS). * CVE-2015-0488: JSSE: unauthenticated remote attackers could cause a partial denial of service (partial DOS). * CVE-2015-0491: 2D: unauthenticated remote attackers could execute arbitrary code via multiple protocols. * CVE-2015-0492: JavaFX: unauthenticated remote attackers could execute arbitrary code via multiple protocols. Security Issues: * CVE-2015-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0458> * CVE-2015-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0459> * CVE-2015-0460 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0460> * CVE-2015-0469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0469> * CVE-2015-0477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477> * CVE-2015-0478 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0478> * CVE-2015-0480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0480> * CVE-2015-0484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0484> * CVE-2015-0488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0488> * CVE-2015-0491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0491> * CVE-2015-0492 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0492> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk=10621 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.7.0.75]: java-1_7_0-openjdk-1.7.0.75-0.9.1 java-1_7_0-openjdk-demo-1.7.0.75-0.9.1 java-1_7_0-openjdk-devel-1.7.0.75-0.9.1 References: https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0460.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0484.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-0492.html https://bugzilla.suse.com/927591 https://download.suse.com/patch/finder/?keywords=2082b6af65787f83584579a017… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0832-1: important: Security update for kgraft-patch-SLE12_Update_1, kgraft-patch-SLE12_Update_2
by opensuse-security＠opensuse.org 07 May '15

07 May '15

SUSE Security Update: Security update for kgraft-patch-SLE12_Update_1, kgraft-patch-SLE12_Update_2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0832-1 Rating: important References: #920633 #922004 Cross-References: CVE-2015-1421 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update supplies kgraft patches to fix one security vulnerability. CVE-2015-1421: A use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel allowed remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. This patch supplies kgraft patches for the first kernel update and the second kernel update published for SUSE Linux Enterprise Server 12. The third kernel update contains the patch already. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-183=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_32-33-default-2-3.1 kgraft-patch-3_12_32-33-xen-2-3.1 kgraft-patch-3_12_36-38-default-2-3.1 kgraft-patch-3_12_36-38-xen-2-3.1 References: https://www.suse.com/security/cve/CVE-2015-1421.html https://bugzilla.suse.com/920633 https://bugzilla.suse.com/922004 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0813-1: important: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 01 May '15

01 May '15

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0813-1 Rating: important References: #927558 Cross-References: CVE-2015-1863 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The wireless network encryption and authentication daemon wpa_supplicant was updated to fix a security issue. The following vulnerability was fixed: * CVE-2015-1863: A buffer overflow in handling SSIDs in P2P management frames allowed attackers in radio range to crash, expose memory content or potentially execute arbitrary code. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-341=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-341=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wpa_supplicant-2.2-5.4.1 wpa_supplicant-debuginfo-2.2-5.4.1 wpa_supplicant-debugsource-2.2-5.4.1 wpa_supplicant-gui-2.2-5.4.1 wpa_supplicant-gui-debuginfo-2.2-5.4.1 - openSUSE 13.1 (i586 x86_64): wpa_supplicant-2.0-3.11.1 wpa_supplicant-debuginfo-2.0-3.11.1 wpa_supplicant-debugsource-2.0-3.11.1 wpa_supplicant-gui-2.0-3.11.1 wpa_supplicant-gui-debuginfo-2.0-3.11.1 References: https://www.suse.com/security/cve/CVE-2015-1863.html https://bugzilla.suse.com/927558 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0