June 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1161-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 30 Jun '15

30 Jun '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1161-1 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: [http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015](http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Upda te_May_2015) CVEs addressed: CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Additional bugs fixed: * Fix javaws/plugin stuff should slave plugin update-alternatives (bnc#912434) * Changed Java to use the system root CA certificates (bnc#912447) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-288=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-15.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-15.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-15.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-15.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1157-1: important: Security update for Xen
by opensuse-security＠opensuse.org 29 Jun '15

29 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1157-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Xen was updated to fix six security issues: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bsc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628) * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-xen-201506=10729 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): xen-devel-4.1.6_08-0.13.1 xen-kmp-default-4.1.6_08_3.0.101_0.7.29-0.13.1 xen-kmp-trace-4.1.6_08_3.0.101_0.7.29-0.13.1 xen-libs-4.1.6_08-0.13.1 xen-tools-domU-4.1.6_08-0.13.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (x86_64): xen-4.1.6_08-0.13.1 xen-doc-html-4.1.6_08-0.13.1 xen-doc-pdf-4.1.6_08-0.13.1 xen-libs-32bit-4.1.6_08-0.13.1 xen-tools-4.1.6_08-0.13.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): xen-kmp-pae-4.1.6_08_3.0.101_0.7.29-0.13.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=664b696391d543da0f24d6d0b0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1156-1: important: Security update for Xen
by opensuse-security＠opensuse.org 29 Jun '15

29 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1156-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Xen was updated to fix six security issues: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bsc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628) * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-xen-201506=10726 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): xen-4.0.3_21548_18-0.25.1 xen-doc-html-4.0.3_21548_18-0.25.1 xen-doc-pdf-4.0.3_21548_18-0.25.1 xen-kmp-default-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 xen-kmp-trace-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 xen-libs-4.0.3_21548_18-0.25.1 xen-tools-4.0.3_21548_18-0.25.1 xen-tools-domU-4.0.3_21548_18-0.25.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): xen-kmp-pae-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=5db78436698154117f5060fbcf… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1086-4: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 27 Jun '15

27 Jun '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1086-4 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.7.0 was updated to SR9 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> . Security Issues: * CVE-2015-0192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0192> * CVE-2015-2808 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808> * CVE-2015-1914 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1914> * CVE-2015-0138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0138> * CVE-2015-0491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0491> * CVE-2015-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0458> * CVE-2015-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0459> * CVE-2015-0469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0469> * CVE-2015-0480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0480> * CVE-2015-0488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0488> * CVE-2015-0478 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0478> * CVE-2015-0477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477> * CVE-2015-0204 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_7_0-ibm=10784 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_7_0-ibm=10784 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_7_0-ibm=10784 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-alsa-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-plugin-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-plugin-1.7.0_sr9.0-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=9679d0aa3625acf75e826a41db… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1152-1: important: Security update for KVM
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

SUSE Security Update: Security update for KVM ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1152-1 Rating: important References: #932267 #932770 Cross-References: CVE-2015-3209 Affected Products: SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: KVM was updated to fix two security issues: * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (bsc#932770) * CVE-2015-4037: Predictable directory names for smb configuration. (bsc#932267) Security Issues: * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kvm=10747 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kvm=10747 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.31.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://bugzilla.suse.com/932267 https://bugzilla.suse.com/932770 https://download.suse.com/patch/finder/?keywords=22b018e7745a4c6e213ac9c057… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1150-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1150-1 Rating: important References: #879179 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-4000 (boo#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (boo#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (boo#934489) * Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1790 (boo#934491) * PKCS7 crash with missing EnvelopedContent - CVE-2015-1792 (boo#934493) * CMS verify infinite loop with unknown hash function - CVE-2015-1791 (boo#933911) * race condition in NewSessionTicket - CVE-2015-3216 (boo#933898) * Crash in ssleay_rand_bytes due to locking regression * modified openssl-1.0.1i-fipslocking.patch - fix timing side channel in RSA decryption (bnc#929678) - add ECC ciphersuites to DEFAULT (bnc#879179) - Disable EXPORT ciphers by default (bnc#931698, comment #3) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-285=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-285=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-78.1 libopenssl0_9_8-0.9.8j-78.1 libopenssl0_9_8-32bit-0.9.8j-78.1 libopenssl0_9_8-debuginfo-0.9.8j-78.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-78.1 - SUSE Linux Enterprise Desktop 12 (x86_64): compat-openssl098-debugsource-0.9.8j-78.1 libopenssl0_9_8-0.9.8j-78.1 libopenssl0_9_8-32bit-0.9.8j-78.1 libopenssl0_9_8-debuginfo-0.9.8j-78.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-78.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/879179 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1148-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1148-1 Rating: important References: #935701 Cross-References: CVE-2015-3113 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed: * CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution (bsc#935701, APSB15-14) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-450=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-450=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.468-2.58.1 flash-player-gnome-11.2.202.468-2.58.1 flash-player-kde4-11.2.202.468-2.58.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.468-123.1 flash-player-gnome-11.2.202.468-123.1 flash-player-kde4-11.2.202.468-123.1 References: https://www.suse.com/security/cve/CVE-2015-3113.html https://bugzilla.suse.com/935701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1143-1: important: Security update for openssl
by opensuse-security＠opensuse.org 25 Jun '15

25 Jun '15

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1143-1 Rating: important References: #926597 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update of openssl fixes the following security issues: - CVE-2015-4000 (bsc#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (bsc#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (bsc#934489) * Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1790 (bsc#934491) * PKCS7 crash with missing EnvelopedContent - CVE-2015-1792 (bsc#934493) * CMS verify infinite loop with unknown hash function - CVE-2015-1791 (bsc#933911) * race condition in NewSessionTicket - CVE-2015-3216 (bsc#933898) * Crash in ssleay_rand_bytes due to locking regression - fix a timing side channel in RSA decryption (bnc#929678) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-282=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-282=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-282=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libopenssl-devel-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libopenssl1_0_0-1.0.1i-25.1 libopenssl1_0_0-debuginfo-1.0.1i-25.1 libopenssl1_0_0-hmac-1.0.1i-25.1 openssl-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libopenssl1_0_0-32bit-1.0.1i-25.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-25.1 libopenssl1_0_0-hmac-32bit-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (noarch): openssl-doc-1.0.1i-25.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libopenssl1_0_0-1.0.1i-25.1 libopenssl1_0_0-32bit-1.0.1i-25.1 libopenssl1_0_0-debuginfo-1.0.1i-25.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-25.1 openssl-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/926597 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1139-1: important: Security update for openssl
by opensuse-security＠opensuse.org 25 Jun '15

25 Jun '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1139-1 Rating: important References: #931698 #933898 #933911 #934487 #934489 #934491 #934493 #934494 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: openssl was updated to fix six security issues. The following vulnerabilities were fixed: * CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. (boo#931698) * CVE-2015-1788: Malformed ECParameters causes infinite loop (boo#934487) * CVE-2015-1789: Exploitable out-of-bounds read in X509_cmp_time (boo#934489) * CVE-2015-1790: PKCS7 crash with missing EnvelopedContent (boo#934491) * CVE-2015-1792: CMS verify infinite loop with unknown hash function (boo#934493) * CVE-2015-1791: race condition in NewSessionTicket (boo#933911) * CVE-2015-3216: Crash in ssleay_rand_bytes due to locking regression (boo#933898) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-447=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-447=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.24.1 libopenssl1_0_0-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-1.0.1k-2.24.1 libopenssl1_0_0-hmac-1.0.1k-2.24.1 openssl-1.0.1k-2.24.1 openssl-debuginfo-1.0.1k-2.24.1 openssl-debugsource-1.0.1k-2.24.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.24.1 libopenssl1_0_0-32bit-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.24.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.24.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.24.1 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.72.1 libopenssl1_0_0-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-1.0.1k-11.72.1 openssl-1.0.1k-11.72.1 openssl-debuginfo-1.0.1k-11.72.1 openssl-debugsource-1.0.1k-11.72.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.72.1 libopenssl1_0_0-32bit-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.72.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1138-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1138-1 Rating: important References: #930365 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.8.1 References: https://bugzilla.suse.com/930365 https://download.suse.com/patch/finder/?keywords=c5428e2c57be4bc06608802e52… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1086-3: important: Security update for Java
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1086-3 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.7.0 was updated to SR9 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_7_0-ibm=10785 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-devel-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-plugin-1.7.0_sr9.0-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=9ca57b921374626bc74b4dc6c6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1136-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1136-1 Rating: important References: #935701 Cross-References: CVE-2015-3113 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.468, fixing a security issue, where attackers could trigger a heap overflow and could execute code. https://helpx.adobe.com/security/products/flash-player/apsb15-14.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-279=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-279=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.468-89.1 flash-player-gnome-11.2.202.468-89.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.468-89.1 flash-player-gnome-11.2.202.468-89.1 References: https://www.suse.com/security/cve/CVE-2015-3113.html https://bugzilla.suse.com/935701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1103-1: important: Security update for e2fsprogs
by opensuse-security＠opensuse.org 23 Jun '15

23 Jun '15

SUSE Security Update: Security update for e2fsprogs ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1103-1 Rating: important References: #915402 #918346 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update provides the following security-fixes for e2fsprogs: libext2fs: fix potential buffer overflow in closefs() (bsc#918346, CVE-2015-1572) libext2fs: avoid buffer overflow if s_first_meta_bg is too big (bsc#915402, CVE-2015-0247) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-e2fsprogs-219=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-e2fsprogs-219=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-e2fsprogs-219=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): e2fsprogs-devel-1.41.9-2.14.2 libcom_err-devel-1.41.9-2.14.2 libext2fs-devel-1.41.9-2.14.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libcom_err-devel-32bit-1.41.9-2.14.2 libext2fs-devel-32bit-1.41.9-2.14.2 libext2fs2-32bit-1.41.9-2.14.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ia64): libext2fs2-x86-1.41.9-2.14.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): e2fsprogs-1.41.9-2.14.2 libcom_err2-1.41.9-2.14.2 libext2fs2-1.41.9-2.14.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libcom_err2-32bit-1.41.9-2.14.2 - SUSE Linux Enterprise Server 11-SP4 (ia64): libcom_err2-x86-1.41.9-2.14.2 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): e2fsprogs-1.41.9-2.14.2 libcom_err2-1.41.9-2.14.2 libext2fs2-1.41.9-2.14.2 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libcom_err2-32bit-1.41.9-2.14.2 References: https://bugzilla.suse.com/915402 https://bugzilla.suse.com/918346 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1086-2: important: Security update for IBM Java
by opensuse-security＠opensuse.org 22 Jun '15

22 Jun '15

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1086-2 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_6_0-ibm=10761 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_6_0-ibm=10761 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_6_0-ibm=10761 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.3.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=224547d04b097be81efdd550de… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1094-1: important: Security update for xen
by opensuse-security＠opensuse.org 22 Jun '15

22 Jun '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1094-1 Rating: important References: #922709 #931625 #931626 #931627 #931628 #932770 #932790 #932996 Cross-References: CVE-2015-2751 CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: Xen was updated to fix eight vulnerabilities. The following vulnerabilities were fixed: * CVE-2015-2751: Certain domctl operations may be abused to lock up the host (XSA-127 boo#922709) * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu (XSA-128) (boo#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests (XSA-129) (boo#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages (XSA-130) (boo#931627) * CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131) (boo#931628) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134) (boo#932790) * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (boo#932770) * CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (boo#932996) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-435=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.4_05-47.1 xen-devel-4.3.4_05-47.1 xen-kmp-default-4.3.4_05_k3.11.10_29-47.1 xen-kmp-default-debuginfo-4.3.4_05_k3.11.10_29-47.1 xen-kmp-desktop-4.3.4_05_k3.11.10_29-47.1 xen-kmp-desktop-debuginfo-4.3.4_05_k3.11.10_29-47.1 xen-libs-4.3.4_05-47.1 xen-libs-debuginfo-4.3.4_05-47.1 xen-tools-domU-4.3.4_05-47.1 xen-tools-domU-debuginfo-4.3.4_05-47.1 - openSUSE 13.1 (x86_64): xen-4.3.4_05-47.1 xen-doc-html-4.3.4_05-47.1 xen-libs-32bit-4.3.4_05-47.1 xen-libs-debuginfo-32bit-4.3.4_05-47.1 xen-tools-4.3.4_05-47.1 xen-tools-debuginfo-4.3.4_05-47.1 xen-xend-tools-4.3.4_05-47.1 xen-xend-tools-debuginfo-4.3.4_05-47.1 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.4_05_k3.11.10_29-47.1 xen-kmp-pae-debuginfo-4.3.4_05_k3.11.10_29-47.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/922709 https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932790 https://bugzilla.suse.com/932996 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1092-1: important: Security update for xen
by opensuse-security＠opensuse.org 22 Jun '15

22 Jun '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1092-1 Rating: important References: #861318 #882089 #895528 #901488 #903680 #906689 #910254 #912011 #918995 #918998 #919098 #919464 #919663 #921842 #922705 #922706 #922709 #923758 #927967 #929339 #931625 #931626 #931627 #931628 #932770 #932790 #932996 Cross-References: CVE-2014-3615 CVE-2015-2044 CVE-2015-2045 CVE-2015-2151 CVE-2015-2152 CVE-2015-2751 CVE-2015-2752 CVE-2015-2756 CVE-2015-3209 CVE-2015-3340 CVE-2015-3456 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has 10 fixes is now available. Description: Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs. The following vulnerabilities were fixed: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu (XSA-128) (boo#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests (XSA-129) (boo#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages (XSA-130) (boo#931627) * CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131) (boo#931628) * CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (boo#932996) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134) (boo#932790) * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (boo#932770) * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. () * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. () * CVE-2015-2752: Long latency MMIO mapping operations are not preemptible (XSA-125 boo#922705) * CVE-2015-2756: Unmediated PCI command register access in qemu (XSA-126 boo#922706) * CVE-2015-2751: Certain domctl operations may be abused to lock up the host (XSA-127 boo#922709) * CVE-2015-2151: Hypervisor memory corruption due to x86 emulator flaw (boo#919464 XSA-123) * CVE-2015-2045: Information leak through version information hypercall (boo#918998 XSA-122) * CVE-2015-2044: Information leak via internal x86 system device emulation (boo#918995 (XSA-121) * CVE-2015-2152: HVM qemu unexpectedly enabling emulated VGA graphics backends (boo#919663 XSA-119) * CVE-2014-3615: information leakage when guest sets high resolution (boo#895528) The following non-security bugs were fixed: * xentop: Fix memory leak on read failure * boo#923758: xen dmesg contains bogus output in early boot * boo#921842: Xentop doesn't display disk statistics for VMs using qdisks * boo#919098: L3: XEN blktap device intermittently fails to connect * boo#882089: Windows 2012 R2 fails to boot up with greater than 60 vcpus * boo#903680: Problems with detecting free loop devices on Xen guest startup * boo#861318: xentop reports "Found interface vif101.0 but domain 101 does not exist." * boo#901488: Intel ixgbe driver assigns rx/tx queues per core resulting in irq problems on servers with a large amount of CPU cores * boo#910254: SLES11 SP3 Xen VT-d igb NIC doesn't work * boo#912011: high ping latency after upgrade to latest SLES11SP3 on xen Dom0 * boo#906689: let systemd schedule xencommons after network-online.target and remote-fs.target so that xendomains has access to remote shares The following functionality was enabled or enhanced: * Enable spice support in qemu for x86_64 * Add Qxl vga support * Enhancement to virsh/libvirtd "send-key" command (FATE#317240) * Add domain_migrate_constraints_set API to Xend's http interface (FATE#317239) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-434=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.2_06-23.1 xen-devel-4.4.2_06-23.1 xen-libs-4.4.2_06-23.1 xen-libs-debuginfo-4.4.2_06-23.1 xen-tools-domU-4.4.2_06-23.1 xen-tools-domU-debuginfo-4.4.2_06-23.1 - openSUSE 13.2 (x86_64): xen-4.4.2_06-23.1 xen-doc-html-4.4.2_06-23.1 xen-kmp-default-4.4.2_06_k3.16.7_21-23.1 xen-kmp-default-debuginfo-4.4.2_06_k3.16.7_21-23.1 xen-kmp-desktop-4.4.2_06_k3.16.7_21-23.1 xen-kmp-desktop-debuginfo-4.4.2_06_k3.16.7_21-23.1 xen-libs-32bit-4.4.2_06-23.1 xen-libs-debuginfo-32bit-4.4.2_06-23.1 xen-tools-4.4.2_06-23.1 xen-tools-debuginfo-4.4.2_06-23.1 References: https://www.suse.com/security/cve/CVE-2014-3615.html https://www.suse.com/security/cve/CVE-2015-2044.html https://www.suse.com/security/cve/CVE-2015-2045.html https://www.suse.com/security/cve/CVE-2015-2151.html https://www.suse.com/security/cve/CVE-2015-2152.html https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-2752.html https://www.suse.com/security/cve/CVE-2015-2756.html https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-3340.html https://www.suse.com/security/cve/CVE-2015-3456.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/861318 https://bugzilla.suse.com/882089 https://bugzilla.suse.com/895528 https://bugzilla.suse.com/901488 https://bugzilla.suse.com/903680 https://bugzilla.suse.com/906689 https://bugzilla.suse.com/910254 https://bugzilla.suse.com/912011 https://bugzilla.suse.com/918995 https://bugzilla.suse.com/918998 https://bugzilla.suse.com/919098 https://bugzilla.suse.com/919464 https://bugzilla.suse.com/919663 https://bugzilla.suse.com/921842 https://bugzilla.suse.com/922705 https://bugzilla.suse.com/922706 https://bugzilla.suse.com/922709 https://bugzilla.suse.com/923758 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932790 https://bugzilla.suse.com/932996 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1086-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 18 Jun '15

18 Jun '15

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1086-1 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-java-1_6_0-ibm=10765 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_6_0-ibm=10767 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_6_0-ibm=10766 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-devel-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-devel-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.3.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=6f9a706de68429847056a5fac8… https://download.suse.com/patch/finder/?keywords=8e0b4a662058afb89ec5495af0… https://download.suse.com/patch/finder/?keywords=cfac8b8406c0b7db38257f6cae… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1085-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 18 Jun '15

18 Jun '15

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1085-1 Rating: important References: #930365 #931702 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.5.0 was updated to SR16-FP10 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.10-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.10-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.10-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.10-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.10-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.10-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.10-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.10-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.10-0.6.1 References: https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=75c7c1e62322e337b7527c5259… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1073-1: important:
by opensuse-security＠opensuse.org 16 Jun '15

16 Jun '15

Security update for java-1_7_0-ibm SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1073-1 Rating: important References: #912434 #912447 #930365 #931693 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - Version bump to 7.1-3.0 release bnc#930365 CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 - Fix removeing links before update-alternatives run. bnc#931702 - Fix bnc#912434, javaws/plugin stuff should slave plugin update-alternatives - Fix bnc#912447, use system cacerts - Update to 7.1.2.10 for sec issues bnc#916266 and bnc#916265 CVE-2014-8892 CVE-2014-8891 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-270=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-270=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.0-11.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.0-11.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.0-11.1 - SUSE Linux Enterprise Server 12 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.0-11.1 java-1_7_1-ibm-plugin-1.7.1_sr3.0-11.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931693 https://bugzilla.suse.com/931702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1071-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 16 Jun '15

16 Jun '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1071-1 Rating: important References: #899192 #900881 #909312 #913232 #914742 #915540 #916225 #917125 #919007 #919018 #920262 #921769 #922583 #922734 #922944 #924664 #924803 #924809 #925567 #926156 #926240 #926314 #927084 #927115 #927116 #927257 #927285 #927308 #927455 #928122 #928130 #928135 #928141 #928708 #929092 #929145 #929525 #929883 #930224 #930226 #930669 #930786 #931014 #931130 Cross-References: CVE-2014-3647 CVE-2014-8086 CVE-2014-8159 CVE-2015-1465 CVE-2015-2041 CVE-2015-2042 CVE-2015-2666 CVE-2015-2830 CVE-2015-2922 CVE-2015-3331 CVE-2015-3332 CVE-2015-3339 CVE-2015-3636 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has 31 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes. Following security bugs were fixed: - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192). - CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881). - CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742). - CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225). - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007). - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018). - CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944). - CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240). - CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583). - CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257). - CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135). - CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130). - CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525). The following non-security bugs were fixed: - /proc/stat: convert to single_open_size() (bsc#928122). - ACPI / sysfs: Treat the count field of counter_show() as unsigned (bsc#909312). - Automatically Provide/Obsolete all subpackages of old flavors (bsc#925567) - Btrfs: btrfs_release_extent_buffer_page did not free pages of dummy extent (bsc#930226). - Btrfs: fix inode eviction infinite loop after cloning into it (bsc#930224). - Btrfs: fix inode eviction infinite loop after extent_same ioctl (bsc#930224). - Btrfs: fix log tree corruption when fs mounted with -o discard (bsc#927116). - Btrfs: fix up bounds checking in lseek (bsc#927115). - Fix rtworkqueues crash. Calling __sched_setscheduler() in interrupt context is forbidden, and destroy_worker() did so in the timer interrupt with a nohz_full config. Preclude that possibility for both boot options. - Input: psmouse - add psmouse_matches_pnp_id helper function (bsc#929092). - Input: synaptics - fix middle button on Lenovo 2015 products (bsc#929092). - Input: synaptics - handle spurious release of trackstick buttons (bsc#929092). - Input: synaptics - re-route tracksticks buttons on the Lenovo 2015 series (bsc#929092). - Input: synaptics - remove TOPBUTTONPAD property for Lenovos 2015 (bsc#929092). - Input: synaptics - retrieve the extended capabilities in query $10 (bsc#929092). - NFS: Add attribute update barriers to nfs_setattr_update_inode() (bsc#920262). - NFS: restore kabi after change to nfs_setattr_update_inode (bsc#920262). - af_iucv: fix AF_IUCV sendmsg() errno (bsc#927308, LTC#123304). - audit: do not reject all AUDIT_INODE filter types (bsc#927455). - bnx2x: Fix kdump when iommu=on (bsc#921769). - cpufreq: fix a NULL pointer dereference in __cpufreq_governor() (bsc#924664). - dasd: Fix device having no paths after suspend/resume (bsc#927308, LTC#123896). - dasd: Fix inability to set a DASD device offline (bsc#927308, LTC#123905). - dasd: Fix unresumed device after suspend/resume (bsc#927308, LTC#123892). - dasd: Missing partition after online processing (bsc#917125, LTC#120565). - drm/radeon/cik: Add macrotile mode array query (bsc#927285). - drm/radeon: fix display tiling setup on SI (bsc#927285). - drm/radeon: set correct number of banks for CIK chips in DCE (bsc#927285). - iommu/amd: Correctly encode huge pages in iommu page tables (bsc#931014). - iommu/amd: Optimize alloc_new_range for new fetch_pte interface (bsc#931014). - iommu/amd: Optimize amd_iommu_iova_to_phys for new fetch_pte interface (bsc#931014). - iommu/amd: Optimize iommu_unmap_page for new fetch_pte interface (bsc#931014). - iommu/amd: Return the pte page-size in fetch_pte (bsc#931014). - ipc/shm.c: fix overly aggressive shmdt() when calls span multiple segments (ipc fixes). - ipmi: Turn off all activity on an idle ipmi interface (bsc#915540). - ixgbe: fix detection of SFP+ capable interfaces (bsc#922734). - kgr: add error code to the message in kgr_revert_replaced_funs. - kgr: add kgraft annotations to kthreads wait_event_freezable() API calls. - kgr: correct error handling of the first patching stage. - kgr: handle the delayed patching of the modules. - kgr: handle the failure of finalization stage. - kgr: return error in kgr_init if notifier registration fails. - kgr: take switching of the fops out of kgr_patch_code to new function. - kgr: use for_each_process_thread (bsc#929883). - kgr: use kgr_in_progress for all threads (bnc#929883). - libata: Blacklist queued TRIM on Samsung SSD 850 Pro (bsc#926156). - mlx4: Call dev_kfree_skby_any instead of dev_kfree_skb (bsc#928708). - mm, numa: really disable NUMA balancing by default on single node machines (Automatic NUMA Balancing). - mm: vmscan: do not throttle based on pfmemalloc reserves if node has no reclaimable pages (bsc#924803, VM Functionality). - net/mlx4: Cache line CQE/EQE stride fixes (bsc#927084). - net/mlx4_core: Cache line EQE size support (bsc#927084). - net/mlx4_core: Enable CQE/EQE stride support (bsc#927084). - net/mlx4_en: Add mlx4_en_get_cqe helper (bsc#927084). - perf/x86/amd/ibs: Update IBS MSRs and feature definitions. - powerpc/mm: Fix mmap errno when MAP_FIXED is set and mapping exceeds the allowed address space (bsc#930669). - powerpc/numa: Add ability to disable and debug topology updates (bsc#924809). - powerpc/numa: Enable CONFIG_HAVE_MEMORYLESS_NODES (bsc#924809). - powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID (bsc#924809). - powerpc/numa: check error return from proc_create (bsc#924809). - powerpc/numa: ensure per-cpu NUMA mappings are correct on topology update (bsc#924809). - powerpc/numa: use cached value of update->cpu in update_cpu_topology (bsc#924809). - powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH (bsc#928141). - powerpc/pseries: Introduce api_version to migration sysfs interface (bsc#926314). - powerpc/pseries: Little endian fixes for post mobility device tree update (bsc#926314). - powerpc/pseries: Simplify check for suspendability during suspend/migration (bsc#926314). - powerpc: Fix sys_call_table declaration to enable syscall tracing. - powerpc: Fix warning reported by verify_cpu_node_mapping() (bsc#924809). - powerpc: Only set numa node information for present cpus at boottime (bsc#924809). - powerpc: reorder per-cpu NUMA information initialization (bsc#924809). - powerpc: some changes in numa_setup_cpu() (bsc#924809). - quota: Fix use of units in quota getting / setting interfaces (bsc#913232). - rpm/kernel-binary.spec.in: Fix build if there is no *.crt file - rpm/kernel-obs-qa.spec.in: Do not fail if the kernel versions do not match - s390/bpf: Fix ALU_NEG (A = -A) (bsc#917125, LTC#121759). - s390/bpf: Fix JMP_JGE_K (A >= K) and JMP_JGT_K (A > K) (bsc#917125, LTC#121759). - s390/bpf: Fix JMP_JGE_X (A > X) and JMP_JGT_X (A >= X) (bsc#917125, LTC#121759). - s390/bpf: Fix offset parameter for skb_copy_bits() (bsc#917125, LTC#121759). - s390/bpf: Fix sk_load_byte_msh() (bsc#917125, LTC#121759). - s390/bpf: Fix skb_copy_bits() parameter passing (bsc#917125, LTC#121759). - s390/bpf: Zero extend parameters before calling C function (bsc#917125, LTC#121759). - s390/sclp: Consolidate early sclp init calls to sclp_early_detect() (bsc#917125, LTC#122429). - s390/sclp: Determine HSA size dynamically for zfcpdump (bsc#917125, LTC#122429). - s390/sclp: Move declarations for sclp_sdias into separate header file (bsc#917125, LTC#122429). - s390/sclp: Move early code from sclp_cmd.c to sclp_early.c (bsc#917125, LTC#122429). - s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_early (bsc#917125, LTC#122429). - s390/sclp: revert smp-detect-possible-cpus.patch (bsc#917125, LTC#122429). - s390/sclp_early: Add function to detect sclp console capabilities (bsc#917125, LTC#122429). - s390/sclp_early: Get rid of sclp_early_read_info_sccb_valid (bsc#917125, LTC#122429). - s390/sclp_early: Pass sccb pointer to every *_detect() function (bsc#917125, LTC#122429). - s390/sclp_early: Replace early_read_info_sccb with sccb_early (bsc#917125, LTC#122429). - s390/sclp_early: Return correct HSA block count also for zero (bsc#917125, LTC#122429). - s390/smp: limit number of cpus in possible cpu mask (bsc#917125, LTC#122429). - s390: kgr, change the kgraft state only if enabled. - sched, time: Fix lock inversion in thread_group_cputime() - sched: Fix potential near-infinite distribute_cfs_runtime() loop (bsc#930786) - sched: Robustify topology setup (bsc#924809). - seqlock: Add irqsave variant of read_seqbegin_or_lock() (Time scalability). - storvsc: Set the SRB flags correctly when no data transfer is needed (bsc#931130). - x86/apic/uv: Update the APIC UV OEM check (bsc#929145). - x86/apic/uv: Update the UV APIC HUB check (bsc#929145). - x86/apic/uv: Update the UV APIC driver check (bsc#929145). - x86/microcode/intel: Guard against stack overflow in the loader (bsc#922944). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-269=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-269=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-269=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-269=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-269=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-269=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.43-52.6.1 kernel-default-debugsource-3.12.43-52.6.1 kernel-default-extra-3.12.43-52.6.1 kernel-default-extra-debuginfo-3.12.43-52.6.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.43-52.6.2 kernel-obs-build-debugsource-3.12.43-52.6.2 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.43-52.6.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.43-52.6.1 kernel-default-base-3.12.43-52.6.1 kernel-default-base-debuginfo-3.12.43-52.6.1 kernel-default-debuginfo-3.12.43-52.6.1 kernel-default-debugsource-3.12.43-52.6.1 kernel-default-devel-3.12.43-52.6.1 kernel-syms-3.12.43-52.6.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.43-52.6.1 kernel-xen-base-3.12.43-52.6.1 kernel-xen-base-debuginfo-3.12.43-52.6.1 kernel-xen-debuginfo-3.12.43-52.6.1 kernel-xen-debugsource-3.12.43-52.6.1 kernel-xen-devel-3.12.43-52.6.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.43-52.6.1 kernel-macros-3.12.43-52.6.1 kernel-source-3.12.43-52.6.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.43-52.6.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.43-52.6.1 kernel-ec2-debuginfo-3.12.43-52.6.1 kernel-ec2-debugsource-3.12.43-52.6.1 kernel-ec2-devel-3.12.43-52.6.1 kernel-ec2-extra-3.12.43-52.6.1 kernel-ec2-extra-debuginfo-3.12.43-52.6.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_43-52_6-default-1-2.3 kgraft-patch-3_12_43-52_6-xen-1-2.3 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.43-52.6.1 kernel-default-debuginfo-3.12.43-52.6.1 kernel-default-debugsource-3.12.43-52.6.1 kernel-default-devel-3.12.43-52.6.1 kernel-default-extra-3.12.43-52.6.1 kernel-default-extra-debuginfo-3.12.43-52.6.1 kernel-syms-3.12.43-52.6.1 kernel-xen-3.12.43-52.6.1 kernel-xen-debuginfo-3.12.43-52.6.1 kernel-xen-debugsource-3.12.43-52.6.1 kernel-xen-devel-3.12.43-52.6.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.43-52.6.1 kernel-macros-3.12.43-52.6.1 kernel-source-3.12.43-52.6.1 References: https://www.suse.com/security/cve/CVE-2014-3647.html https://www.suse.com/security/cve/CVE-2014-8086.html https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2015-1465.html https://www.suse.com/security/cve/CVE-2015-2041.html https://www.suse.com/security/cve/CVE-2015-2042.html https://www.suse.com/security/cve/CVE-2015-2666.html https://www.suse.com/security/cve/CVE-2015-2830.html https://www.suse.com/security/cve/CVE-2015-2922.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3332.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://bugzilla.suse.com/899192 https://bugzilla.suse.com/900881 https://bugzilla.suse.com/909312 https://bugzilla.suse.com/913232 https://bugzilla.suse.com/914742 https://bugzilla.suse.com/915540 https://bugzilla.suse.com/916225 https://bugzilla.suse.com/917125 https://bugzilla.suse.com/919007 https://bugzilla.suse.com/919018 https://bugzilla.suse.com/920262 https://bugzilla.suse.com/921769 https://bugzilla.suse.com/922583 https://bugzilla.suse.com/922734 https://bugzilla.suse.com/922944 https://bugzilla.suse.com/924664 https://bugzilla.suse.com/924803 https://bugzilla.suse.com/924809 https://bugzilla.suse.com/925567 https://bugzilla.suse.com/926156 https://bugzilla.suse.com/926240 https://bugzilla.suse.com/926314 https://bugzilla.suse.com/927084 https://bugzilla.suse.com/927115 https://bugzilla.suse.com/927116 https://bugzilla.suse.com/927257 https://bugzilla.suse.com/927285 https://bugzilla.suse.com/927308 https://bugzilla.suse.com/927455 https://bugzilla.suse.com/928122 https://bugzilla.suse.com/928130 https://bugzilla.suse.com/928135 https://bugzilla.suse.com/928141 https://bugzilla.suse.com/928708 https://bugzilla.suse.com/929092 https://bugzilla.suse.com/929145 https://bugzilla.suse.com/929525 https://bugzilla.suse.com/929883 https://bugzilla.suse.com/930224 https://bugzilla.suse.com/930226 https://bugzilla.suse.com/930669 https://bugzilla.suse.com/930786 https://bugzilla.suse.com/931014 https://bugzilla.suse.com/931130 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1061-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 13 Jun '15

13 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1061-1 Rating: important References: #934088 Cross-References: CVE-2015-3096 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.466 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-3096: bypass for CVE-2014-5333 * CVE-2015-3098: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3099: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3100: stack overflow vulnerability that could lead to code execution * CVE-2015-3102: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3103: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3104: integer overflow vulnerability that could lead to code execution * CVE-2015-3105: memory corruption vulnerability that could lead to code execution * CVE-2015-3106: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3107: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3108: memory leak vulnerability that could be used to bypass ASLR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-17=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.466-164.1 flash-player-gnome-11.2.202.466-164.1 flash-player-kde4-11.2.202.466-164.1 References: https://www.suse.com/security/cve/CVE-2015-3096.html https://www.suse.com/security/cve/CVE-2015-3098.html https://www.suse.com/security/cve/CVE-2015-3099.html https://www.suse.com/security/cve/CVE-2015-3100.html https://www.suse.com/security/cve/CVE-2015-3102.html https://www.suse.com/security/cve/CVE-2015-3103.html https://www.suse.com/security/cve/CVE-2015-3104.html https://www.suse.com/security/cve/CVE-2015-3105.html https://www.suse.com/security/cve/CVE-2015-3106.html https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-3108.html https://bugzilla.suse.com/934088 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1056-1: critical: Security update for cups
by opensuse-security＠opensuse.org 12 Jun '15

12 Jun '15

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1056-1 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes the following issues: - CVE-2015-1158 and CVE-2015-1159 fixes a possible privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (CUPS STR#4609 CERT-VU-810572 CVE-2015-1158 CVE-2015-1159 bugzilla.suse.com bsc#924208). In general it is crucial to limit access to CUPS to trustworthy users who do not misuse their permission to submit print jobs which means to upload arbitrary data onto the CUPS server, see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings and cf. the entries about CVE-2012-5519 below. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-418=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-418=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cups-1.5.4-21.9.1 cups-client-1.5.4-21.9.1 cups-client-debuginfo-1.5.4-21.9.1 cups-ddk-1.5.4-21.9.1 cups-ddk-debuginfo-1.5.4-21.9.1 cups-debuginfo-1.5.4-21.9.1 cups-debugsource-1.5.4-21.9.1 cups-devel-1.5.4-21.9.1 cups-libs-1.5.4-21.9.1 cups-libs-debuginfo-1.5.4-21.9.1 - openSUSE 13.2 (x86_64): cups-libs-32bit-1.5.4-21.9.1 cups-libs-debuginfo-32bit-1.5.4-21.9.1 - openSUSE 13.1 (i586 x86_64): cups-1.5.4-12.20.1 cups-client-1.5.4-12.20.1 cups-client-debuginfo-1.5.4-12.20.1 cups-ddk-1.5.4-12.20.1 cups-ddk-debuginfo-1.5.4-12.20.1 cups-debuginfo-1.5.4-12.20.1 cups-debugsource-1.5.4-12.20.1 cups-devel-1.5.4-12.20.1 cups-libs-1.5.4-12.20.1 cups-libs-debuginfo-1.5.4-12.20.1 - openSUSE 13.1 (x86_64): cups-libs-32bit-1.5.4-12.20.1 cups-libs-debuginfo-32bit-1.5.4-12.20.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1047-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1047-1 Rating: important References: #934088 Cross-References: CVE-2015-3096 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.466 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-3096: bypass for CVE-2014-5333 * CVE-2015-3098: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3099: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3100: stack overflow vulnerability that could lead to code execution * CVE-2015-3102: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3103: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3104: integer overflow vulnerability that could lead to code execution * CVE-2015-3105: memory corruption vulnerability that could lead to code execution * CVE-2015-3106: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3107: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3108: memory leak vulnerability that could be used to bypass ASLR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-412=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-412=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.466-2.55.1 flash-player-gnome-11.2.202.466-2.55.1 flash-player-kde4-11.2.202.466-2.55.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.466-120.1 flash-player-gnome-11.2.202.466-120.1 flash-player-kde4-11.2.202.466-120.1 References: https://www.suse.com/security/cve/CVE-2015-3096.html https://www.suse.com/security/cve/CVE-2015-3098.html https://www.suse.com/security/cve/CVE-2015-3099.html https://www.suse.com/security/cve/CVE-2015-3100.html https://www.suse.com/security/cve/CVE-2015-3102.html https://www.suse.com/security/cve/CVE-2015-3103.html https://www.suse.com/security/cve/CVE-2015-3104.html https://www.suse.com/security/cve/CVE-2015-3105.html https://www.suse.com/security/cve/CVE-2015-3106.html https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-3108.html https://bugzilla.suse.com/934088 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1044-2: critical: Security update for cups154
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for cups154 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1044-2 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following issues are fixed by this update: * CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208). * CVE-2015-1158: Improper Update of Reference Count * CVE-2015-1159: Cross-Site Scripting Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-265=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x): cups154-1.5.4-9.1 cups154-client-1.5.4-9.1 cups154-client-debuginfo-1.5.4-9.1 cups154-debuginfo-1.5.4-9.1 cups154-debugsource-1.5.4-9.1 cups154-filters-1.5.4-9.1 cups154-filters-debuginfo-1.5.4-9.1 cups154-libs-1.5.4-9.1 cups154-libs-debuginfo-1.5.4-9.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1045-1: important: Security update for Xen
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1045-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932790 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Xen was updated to fix seven security vulnerabilities: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bnc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bnc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bnc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bnc#931628) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior. (XSA-134, bnc#932790) * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bnc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bnc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen-201506=10727 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen-201506=10727 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen-201506=10727 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_08_3.0.101_0.47.55-0.9.1 xen-libs-4.2.5_08-0.9.1 xen-tools-domU-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.5_08-0.9.1 xen-doc-html-4.2.5_08-0.9.1 xen-doc-pdf-4.2.5_08-0.9.1 xen-libs-32bit-4.2.5_08-0.9.1 xen-tools-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.5_08_3.0.101_0.47.55-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_08_3.0.101_0.47.55-0.9.1 xen-libs-4.2.5_08-0.9.1 xen-tools-domU-4.2.5_08-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.5_08-0.9.1 xen-doc-html-4.2.5_08-0.9.1 xen-doc-pdf-4.2.5_08-0.9.1 xen-libs-32bit-4.2.5_08-0.9.1 xen-tools-4.2.5_08-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.5_08_3.0.101_0.47.55-0.9.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932790 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=3ae6793ddbacaa600cc65649e1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0