July 2015 - openSUSE Security Announce

[security-announce] openSUSE-SU-2015:1267-1: critical: flash-player
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1267-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-502=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.491-173.1 flash-player-gnome-11.2.202.491-173.1 flash-player-kde4-11.2.202.491-173.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1266-1: important: Mozilla (Firefox/Thunderbird) updates to 31.8.0
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: Mozilla (Firefox/Thunderbird) updates to 31.8.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1266-1 Rating: important References: #894370 #900639 #900941 #908009 #910669 #917597 #925368 #930622 #935979 Cross-References: CVE-2011-3079 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0833 CVE-2015-0836 CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: Combined Mozilla update: - Update Firefox to 31.8.0 - Update Thunderbird to 31.8.0 - Update mozilla-nspr to 4.10.6 - Update mozilla-nss to 3.19.2 to fix several security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.8.0-143.1 MozillaFirefox-branding-upstream-31.8.0-143.1 MozillaFirefox-buildsymbols-31.8.0-143.1 MozillaFirefox-debuginfo-31.8.0-143.1 MozillaFirefox-debugsource-31.8.0-143.1 MozillaFirefox-devel-31.8.0-143.1 MozillaFirefox-translations-common-31.8.0-143.1 MozillaFirefox-translations-other-31.8.0-143.1 MozillaThunderbird-31.8.0-110.1 MozillaThunderbird-buildsymbols-31.8.0-110.1 MozillaThunderbird-debuginfo-31.8.0-110.1 MozillaThunderbird-debugsource-31.8.0-110.1 MozillaThunderbird-devel-31.8.0-110.1 MozillaThunderbird-translations-common-31.8.0-110.1 MozillaThunderbird-translations-other-31.8.0-110.1 libfreebl3-3.19.2-107.1 libfreebl3-debuginfo-3.19.2-107.1 libsoftokn3-3.19.2-107.1 libsoftokn3-debuginfo-3.19.2-107.1 mozilla-nspr-4.10.8-52.1 mozilla-nspr-debuginfo-4.10.8-52.1 mozilla-nspr-debugsource-4.10.8-52.1 mozilla-nspr-devel-4.10.8-52.1 mozilla-nss-3.19.2-107.1 mozilla-nss-certs-3.19.2-107.1 mozilla-nss-certs-debuginfo-3.19.2-107.1 mozilla-nss-debuginfo-3.19.2-107.1 mozilla-nss-debugsource-3.19.2-107.1 mozilla-nss-devel-3.19.2-107.1 mozilla-nss-sysinit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-3.19.2-107.1 mozilla-nss-tools-3.19.2-107.1 mozilla-nss-tools-debuginfo-3.19.2-107.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.19.2-107.1 libfreebl3-debuginfo-32bit-3.19.2-107.1 libsoftokn3-32bit-3.19.2-107.1 libsoftokn3-debuginfo-32bit-3.19.2-107.1 mozilla-nspr-32bit-4.10.8-52.1 mozilla-nspr-debuginfo-32bit-4.10.8-52.1 mozilla-nss-32bit-3.19.2-107.1 mozilla-nss-certs-32bit-3.19.2-107.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-107.1 mozilla-nss-debuginfo-32bit-3.19.2-107.1 mozilla-nss-sysinit-32bit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-107.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.19.2-107.1 libfreebl3-x86-3.19.2-107.1 libsoftokn3-debuginfo-x86-3.19.2-107.1 libsoftokn3-x86-3.19.2-107.1 mozilla-nspr-debuginfo-x86-4.10.8-52.1 mozilla-nspr-x86-4.10.8-52.1 mozilla-nss-certs-debuginfo-x86-3.19.2-107.1 mozilla-nss-certs-x86-3.19.2-107.1 mozilla-nss-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-x86-3.19.2-107.1 mozilla-nss-x86-3.19.2-107.1 References: https://www.suse.com/security/cve/CVE-2011-3079.html https://www.suse.com/security/cve/CVE-2014-1553.html https://www.suse.com/security/cve/CVE-2014-1562.html https://www.suse.com/security/cve/CVE-2014-1563.html https://www.suse.com/security/cve/CVE-2014-1564.html https://www.suse.com/security/cve/CVE-2014-1565.html https://www.suse.com/security/cve/CVE-2014-1567.html https://www.suse.com/security/cve/CVE-2014-1574.html https://www.suse.com/security/cve/CVE-2014-1576.html https://www.suse.com/security/cve/CVE-2014-1577.html https://www.suse.com/security/cve/CVE-2014-1578.html https://www.suse.com/security/cve/CVE-2014-1581.html https://www.suse.com/security/cve/CVE-2014-1585.html https://www.suse.com/security/cve/CVE-2014-1586.html https://www.suse.com/security/cve/CVE-2014-1587.html https://www.suse.com/security/cve/CVE-2014-1590.html https://www.suse.com/security/cve/CVE-2014-1592.html https://www.suse.com/security/cve/CVE-2014-1593.html https://www.suse.com/security/cve/CVE-2014-1594.html https://www.suse.com/security/cve/CVE-2014-8634.html https://www.suse.com/security/cve/CVE-2014-8635.html https://www.suse.com/security/cve/CVE-2014-8638.html https://www.suse.com/security/cve/CVE-2014-8639.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://www.suse.com/security/cve/CVE-2015-0822.html https://www.suse.com/security/cve/CVE-2015-0827.html https://www.suse.com/security/cve/CVE-2015-0831.html https://www.suse.com/security/cve/CVE-2015-0833.html https://www.suse.com/security/cve/CVE-2015-0836.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/894370 https://bugzilla.suse.com/900639 https://bugzilla.suse.com/900941 https://bugzilla.suse.com/908009 https://bugzilla.suse.com/910669 https://bugzilla.suse.com/917597 https://bugzilla.suse.com/925368 https://bugzilla.suse.com/930622 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1265-1: important: Security update for PHP
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for PHP ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1265-1 Rating: important References: #919080 #933227 #935074 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: The PHP script interpreter was updated to fix various security issues: * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. * CVE-2015-4148 [bnc#933227]: Fixed a SoapClient's do_soap_call() type confusion after unserialize() information disclosure. Also the following bug were fixed: * fix a segmentation fault in odbc_fetch_array [bnc#935074] * fix timezone map [bnc#919080] Security Issues: * CVE-2015-3411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3411> * CVE-2015-3412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3412> * CVE-2015-4148 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4148> * CVE-2015-4598 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4598> * CVE-2015-4599 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4599> * CVE-2015-4600 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4600> * CVE-2015-4601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4601> * CVE-2015-4602 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4602> * CVE-2015-4603 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4603> * CVE-2015-4643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4643> * CVE-2015-4644 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4644> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-apache2-mod_php53=10811 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-apache2-mod_php53=10811 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-apache2-mod_php53=10811 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-0.43.1 php53-imap-5.3.17-0.43.1 php53-posix-5.3.17-0.43.1 php53-readline-5.3.17-0.43.1 php53-sockets-5.3.17-0.43.1 php53-sqlite-5.3.17-0.43.1 php53-tidy-5.3.17-0.43.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): apache2-mod_php53-5.3.17-0.43.1 php53-5.3.17-0.43.1 php53-bcmath-5.3.17-0.43.1 php53-bz2-5.3.17-0.43.1 php53-calendar-5.3.17-0.43.1 php53-ctype-5.3.17-0.43.1 php53-curl-5.3.17-0.43.1 php53-dba-5.3.17-0.43.1 php53-dom-5.3.17-0.43.1 php53-exif-5.3.17-0.43.1 php53-fastcgi-5.3.17-0.43.1 php53-fileinfo-5.3.17-0.43.1 php53-ftp-5.3.17-0.43.1 php53-gd-5.3.17-0.43.1 php53-gettext-5.3.17-0.43.1 php53-gmp-5.3.17-0.43.1 php53-iconv-5.3.17-0.43.1 php53-intl-5.3.17-0.43.1 php53-json-5.3.17-0.43.1 php53-ldap-5.3.17-0.43.1 php53-mbstring-5.3.17-0.43.1 php53-mcrypt-5.3.17-0.43.1 php53-mysql-5.3.17-0.43.1 php53-odbc-5.3.17-0.43.1 php53-openssl-5.3.17-0.43.1 php53-pcntl-5.3.17-0.43.1 php53-pdo-5.3.17-0.43.1 php53-pear-5.3.17-0.43.1 php53-pgsql-5.3.17-0.43.1 php53-pspell-5.3.17-0.43.1 php53-shmop-5.3.17-0.43.1 php53-snmp-5.3.17-0.43.1 php53-soap-5.3.17-0.43.1 php53-suhosin-5.3.17-0.43.1 php53-sysvmsg-5.3.17-0.43.1 php53-sysvsem-5.3.17-0.43.1 php53-sysvshm-5.3.17-0.43.1 php53-tokenizer-5.3.17-0.43.1 php53-wddx-5.3.17-0.43.1 php53-xmlreader-5.3.17-0.43.1 php53-xmlrpc-5.3.17-0.43.1 php53-xmlwriter-5.3.17-0.43.1 php53-xsl-5.3.17-0.43.1 php53-zip-5.3.17-0.43.1 php53-zlib-5.3.17-0.43.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-0.43.1 php53-5.3.17-0.43.1 php53-bcmath-5.3.17-0.43.1 php53-bz2-5.3.17-0.43.1 php53-calendar-5.3.17-0.43.1 php53-ctype-5.3.17-0.43.1 php53-curl-5.3.17-0.43.1 php53-dba-5.3.17-0.43.1 php53-dom-5.3.17-0.43.1 php53-exif-5.3.17-0.43.1 php53-fastcgi-5.3.17-0.43.1 php53-fileinfo-5.3.17-0.43.1 php53-ftp-5.3.17-0.43.1 php53-gd-5.3.17-0.43.1 php53-gettext-5.3.17-0.43.1 php53-gmp-5.3.17-0.43.1 php53-iconv-5.3.17-0.43.1 php53-intl-5.3.17-0.43.1 php53-json-5.3.17-0.43.1 php53-ldap-5.3.17-0.43.1 php53-mbstring-5.3.17-0.43.1 php53-mcrypt-5.3.17-0.43.1 php53-mysql-5.3.17-0.43.1 php53-odbc-5.3.17-0.43.1 php53-openssl-5.3.17-0.43.1 php53-pcntl-5.3.17-0.43.1 php53-pdo-5.3.17-0.43.1 php53-pear-5.3.17-0.43.1 php53-pgsql-5.3.17-0.43.1 php53-pspell-5.3.17-0.43.1 php53-shmop-5.3.17-0.43.1 php53-snmp-5.3.17-0.43.1 php53-soap-5.3.17-0.43.1 php53-suhosin-5.3.17-0.43.1 php53-sysvmsg-5.3.17-0.43.1 php53-sysvsem-5.3.17-0.43.1 php53-sysvshm-5.3.17-0.43.1 php53-tokenizer-5.3.17-0.43.1 php53-wddx-5.3.17-0.43.1 php53-xmlreader-5.3.17-0.43.1 php53-xmlrpc-5.3.17-0.43.1 php53-xmlwriter-5.3.17-0.43.1 php53-xsl-5.3.17-0.43.1 php53-zip-5.3.17-0.43.1 php53-zlib-5.3.17-0.43.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935074 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 https://download.suse.com/patch/finder/?keywords=81cfeb3c78f7d93b7833bcf7ec… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1258-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1258-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-12002=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-flash-player-12002=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.491-0.11.1 flash-player-gnome-11.2.202.491-0.11.1 flash-player-kde4-11.2.202.491-0.11.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): flash-player-11.2.202.491-0.11.1 flash-player-gnome-11.2.202.491-0.11.1 flash-player-kde4-11.2.202.491-0.11.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1255-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1255-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-323=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-323=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.491-96.1 flash-player-gnome-11.2.202.491-96.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.491-96.1 flash-player-gnome-11.2.202.491-96.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1253-2: important: Security update for php5
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1253-2 Rating: important References: #919080 #927147 #931421 #931769 #931772 #931776 #933227 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4026 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This security update of PHP fixes the following issues: Security issues fixed: * CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. * CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. * CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. * CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. * CVE-2015-4148 [bnc#933227]: Fixed SoapClient's do_soap_call() type confusion after unserialize() information disclosure. * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Bugs fixed: * configure php-fpm with --localstatedir=/var [bnc#927147] * fix timezone map [bnc#919080] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-322=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le): apache2-mod_php5-5.5.14-30.1 apache2-mod_php5-debuginfo-5.5.14-30.1 php5-5.5.14-30.1 php5-bcmath-5.5.14-30.1 php5-bcmath-debuginfo-5.5.14-30.1 php5-bz2-5.5.14-30.1 php5-bz2-debuginfo-5.5.14-30.1 php5-calendar-5.5.14-30.1 php5-calendar-debuginfo-5.5.14-30.1 php5-ctype-5.5.14-30.1 php5-ctype-debuginfo-5.5.14-30.1 php5-curl-5.5.14-30.1 php5-curl-debuginfo-5.5.14-30.1 php5-dba-5.5.14-30.1 php5-dba-debuginfo-5.5.14-30.1 php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-dom-5.5.14-30.1 php5-dom-debuginfo-5.5.14-30.1 php5-enchant-5.5.14-30.1 php5-enchant-debuginfo-5.5.14-30.1 php5-exif-5.5.14-30.1 php5-exif-debuginfo-5.5.14-30.1 php5-fastcgi-5.5.14-30.1 php5-fastcgi-debuginfo-5.5.14-30.1 php5-fileinfo-5.5.14-30.1 php5-fileinfo-debuginfo-5.5.14-30.1 php5-fpm-5.5.14-30.1 php5-fpm-debuginfo-5.5.14-30.1 php5-ftp-5.5.14-30.1 php5-ftp-debuginfo-5.5.14-30.1 php5-gd-5.5.14-30.1 php5-gd-debuginfo-5.5.14-30.1 php5-gettext-5.5.14-30.1 php5-gettext-debuginfo-5.5.14-30.1 php5-gmp-5.5.14-30.1 php5-gmp-debuginfo-5.5.14-30.1 php5-iconv-5.5.14-30.1 php5-iconv-debuginfo-5.5.14-30.1 php5-intl-5.5.14-30.1 php5-intl-debuginfo-5.5.14-30.1 php5-json-5.5.14-30.1 php5-json-debuginfo-5.5.14-30.1 php5-ldap-5.5.14-30.1 php5-ldap-debuginfo-5.5.14-30.1 php5-mbstring-5.5.14-30.1 php5-mbstring-debuginfo-5.5.14-30.1 php5-mcrypt-5.5.14-30.1 php5-mcrypt-debuginfo-5.5.14-30.1 php5-mysql-5.5.14-30.1 php5-mysql-debuginfo-5.5.14-30.1 php5-odbc-5.5.14-30.1 php5-odbc-debuginfo-5.5.14-30.1 php5-openssl-5.5.14-30.1 php5-openssl-debuginfo-5.5.14-30.1 php5-pcntl-5.5.14-30.1 php5-pcntl-debuginfo-5.5.14-30.1 php5-pdo-5.5.14-30.1 php5-pdo-debuginfo-5.5.14-30.1 php5-pgsql-5.5.14-30.1 php5-pgsql-debuginfo-5.5.14-30.1 php5-pspell-5.5.14-30.1 php5-pspell-debuginfo-5.5.14-30.1 php5-shmop-5.5.14-30.1 php5-shmop-debuginfo-5.5.14-30.1 php5-snmp-5.5.14-30.1 php5-snmp-debuginfo-5.5.14-30.1 php5-soap-5.5.14-30.1 php5-soap-debuginfo-5.5.14-30.1 php5-sockets-5.5.14-30.1 php5-sockets-debuginfo-5.5.14-30.1 php5-sqlite-5.5.14-30.1 php5-sqlite-debuginfo-5.5.14-30.1 php5-suhosin-5.5.14-30.1 php5-suhosin-debuginfo-5.5.14-30.1 php5-sysvmsg-5.5.14-30.1 php5-sysvmsg-debuginfo-5.5.14-30.1 php5-sysvsem-5.5.14-30.1 php5-sysvsem-debuginfo-5.5.14-30.1 php5-sysvshm-5.5.14-30.1 php5-sysvshm-debuginfo-5.5.14-30.1 php5-tokenizer-5.5.14-30.1 php5-tokenizer-debuginfo-5.5.14-30.1 php5-wddx-5.5.14-30.1 php5-wddx-debuginfo-5.5.14-30.1 php5-xmlreader-5.5.14-30.1 php5-xmlreader-debuginfo-5.5.14-30.1 php5-xmlrpc-5.5.14-30.1 php5-xmlrpc-debuginfo-5.5.14-30.1 php5-xmlwriter-5.5.14-30.1 php5-xmlwriter-debuginfo-5.5.14-30.1 php5-xsl-5.5.14-30.1 php5-xsl-debuginfo-5.5.14-30.1 php5-zip-5.5.14-30.1 php5-zip-debuginfo-5.5.14-30.1 php5-zlib-5.5.14-30.1 php5-zlib-debuginfo-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-30.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4021.html https://www.suse.com/security/cve/CVE-2015-4022.html https://www.suse.com/security/cve/CVE-2015-4024.html https://www.suse.com/security/cve/CVE-2015-4026.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/927147 https://bugzilla.suse.com/931421 https://bugzilla.suse.com/931769 https://bugzilla.suse.com/931772 https://bugzilla.suse.com/931776 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1253-1: important: Security update for php5
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1253-1 Rating: important References: #919080 #927147 #931421 #931769 #931772 #931776 #933227 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4026 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This security update of PHP fixes the following issues: Security issues fixed: * CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. * CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. * CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. * CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. * CVE-2015-4148 [bnc#933227]: Fixed SoapClient's do_soap_call() type confusion after unserialize() information disclosure. * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Bugs fixed: * configure php-fpm with --localstatedir=/var [bnc#927147] * fix timezone map [bnc#919080] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-322=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-322=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-devel-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (s390x x86_64): apache2-mod_php5-5.5.14-30.1 apache2-mod_php5-debuginfo-5.5.14-30.1 php5-5.5.14-30.1 php5-bcmath-5.5.14-30.1 php5-bcmath-debuginfo-5.5.14-30.1 php5-bz2-5.5.14-30.1 php5-bz2-debuginfo-5.5.14-30.1 php5-calendar-5.5.14-30.1 php5-calendar-debuginfo-5.5.14-30.1 php5-ctype-5.5.14-30.1 php5-ctype-debuginfo-5.5.14-30.1 php5-curl-5.5.14-30.1 php5-curl-debuginfo-5.5.14-30.1 php5-dba-5.5.14-30.1 php5-dba-debuginfo-5.5.14-30.1 php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-dom-5.5.14-30.1 php5-dom-debuginfo-5.5.14-30.1 php5-enchant-5.5.14-30.1 php5-enchant-debuginfo-5.5.14-30.1 php5-exif-5.5.14-30.1 php5-exif-debuginfo-5.5.14-30.1 php5-fastcgi-5.5.14-30.1 php5-fastcgi-debuginfo-5.5.14-30.1 php5-fileinfo-5.5.14-30.1 php5-fileinfo-debuginfo-5.5.14-30.1 php5-fpm-5.5.14-30.1 php5-fpm-debuginfo-5.5.14-30.1 php5-ftp-5.5.14-30.1 php5-ftp-debuginfo-5.5.14-30.1 php5-gd-5.5.14-30.1 php5-gd-debuginfo-5.5.14-30.1 php5-gettext-5.5.14-30.1 php5-gettext-debuginfo-5.5.14-30.1 php5-gmp-5.5.14-30.1 php5-gmp-debuginfo-5.5.14-30.1 php5-iconv-5.5.14-30.1 php5-iconv-debuginfo-5.5.14-30.1 php5-intl-5.5.14-30.1 php5-intl-debuginfo-5.5.14-30.1 php5-json-5.5.14-30.1 php5-json-debuginfo-5.5.14-30.1 php5-ldap-5.5.14-30.1 php5-ldap-debuginfo-5.5.14-30.1 php5-mbstring-5.5.14-30.1 php5-mbstring-debuginfo-5.5.14-30.1 php5-mcrypt-5.5.14-30.1 php5-mcrypt-debuginfo-5.5.14-30.1 php5-mysql-5.5.14-30.1 php5-mysql-debuginfo-5.5.14-30.1 php5-odbc-5.5.14-30.1 php5-odbc-debuginfo-5.5.14-30.1 php5-openssl-5.5.14-30.1 php5-openssl-debuginfo-5.5.14-30.1 php5-pcntl-5.5.14-30.1 php5-pcntl-debuginfo-5.5.14-30.1 php5-pdo-5.5.14-30.1 php5-pdo-debuginfo-5.5.14-30.1 php5-pgsql-5.5.14-30.1 php5-pgsql-debuginfo-5.5.14-30.1 php5-pspell-5.5.14-30.1 php5-pspell-debuginfo-5.5.14-30.1 php5-shmop-5.5.14-30.1 php5-shmop-debuginfo-5.5.14-30.1 php5-snmp-5.5.14-30.1 php5-snmp-debuginfo-5.5.14-30.1 php5-soap-5.5.14-30.1 php5-soap-debuginfo-5.5.14-30.1 php5-sockets-5.5.14-30.1 php5-sockets-debuginfo-5.5.14-30.1 php5-sqlite-5.5.14-30.1 php5-sqlite-debuginfo-5.5.14-30.1 php5-suhosin-5.5.14-30.1 php5-suhosin-debuginfo-5.5.14-30.1 php5-sysvmsg-5.5.14-30.1 php5-sysvmsg-debuginfo-5.5.14-30.1 php5-sysvsem-5.5.14-30.1 php5-sysvsem-debuginfo-5.5.14-30.1 php5-sysvshm-5.5.14-30.1 php5-sysvshm-debuginfo-5.5.14-30.1 php5-tokenizer-5.5.14-30.1 php5-tokenizer-debuginfo-5.5.14-30.1 php5-wddx-5.5.14-30.1 php5-wddx-debuginfo-5.5.14-30.1 php5-xmlreader-5.5.14-30.1 php5-xmlreader-debuginfo-5.5.14-30.1 php5-xmlrpc-5.5.14-30.1 php5-xmlrpc-debuginfo-5.5.14-30.1 php5-xmlwriter-5.5.14-30.1 php5-xmlwriter-debuginfo-5.5.14-30.1 php5-xsl-5.5.14-30.1 php5-xsl-debuginfo-5.5.14-30.1 php5-zip-5.5.14-30.1 php5-zip-debuginfo-5.5.14-30.1 php5-zlib-5.5.14-30.1 php5-zlib-debuginfo-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-30.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4021.html https://www.suse.com/security/cve/CVE-2015-4022.html https://www.suse.com/security/cve/CVE-2015-4024.html https://www.suse.com/security/cve/CVE-2015-4026.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/927147 https://bugzilla.suse.com/931421 https://bugzilla.suse.com/931769 https://bugzilla.suse.com/931772 https://bugzilla.suse.com/931776 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1229-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 13 Jul '15

13 Jul '15

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1229-1 Rating: important References: #932142 #933439 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: MozillaFirefox was updated to version 39.0 to fix 21 security issues. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2727: Local files or privileged URLs in pages can be opened into new tabs (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2729: Out-of-bound read while computing an oscillator rendering range in Web Audio (bsc#935979). - CVE-2015-2731: Use-after-free in Content Policy due to microtask execution error (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2741: Key pinning is ignored when overridable errors are encountered (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935979). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). New features: - Share Hello URLs with social networks - Support for 'switch' role in ARIA 1.1 (web accessibility) - SafeBrowsing malware detection lookups enabled for downloads (Mac OS X and Linux) - Support for new Unicode 8.0 skin tone emoji - Removed support for insecure SSLv3 for network communications - Disable use of RC4 except for temporarily whitelisted hosts - NPAPI Plug-in performance improved via asynchronous initialization mozilla-nss was updated to version 3.19.2 to fix some of the security issues listed above. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-480=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-480=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-39.0-34.2 MozillaFirefox-branding-upstream-39.0-34.2 MozillaFirefox-buildsymbols-39.0-34.2 MozillaFirefox-debuginfo-39.0-34.2 MozillaFirefox-debugsource-39.0-34.2 MozillaFirefox-devel-39.0-34.2 MozillaFirefox-translations-common-39.0-34.2 MozillaFirefox-translations-other-39.0-34.2 libfreebl3-3.19.2-16.1 libfreebl3-debuginfo-3.19.2-16.1 libsoftokn3-3.19.2-16.1 libsoftokn3-debuginfo-3.19.2-16.1 mozilla-nss-3.19.2-16.1 mozilla-nss-certs-3.19.2-16.1 mozilla-nss-certs-debuginfo-3.19.2-16.1 mozilla-nss-debuginfo-3.19.2-16.1 mozilla-nss-debugsource-3.19.2-16.1 mozilla-nss-devel-3.19.2-16.1 mozilla-nss-sysinit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-3.19.2-16.1 mozilla-nss-tools-3.19.2-16.1 mozilla-nss-tools-debuginfo-3.19.2-16.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.19.2-16.1 libfreebl3-debuginfo-32bit-3.19.2-16.1 libsoftokn3-32bit-3.19.2-16.1 libsoftokn3-debuginfo-32bit-3.19.2-16.1 mozilla-nss-32bit-3.19.2-16.1 mozilla-nss-certs-32bit-3.19.2-16.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-16.1 mozilla-nss-debuginfo-32bit-3.19.2-16.1 mozilla-nss-sysinit-32bit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-16.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-39.0-78.1 MozillaFirefox-branding-upstream-39.0-78.1 MozillaFirefox-buildsymbols-39.0-78.1 MozillaFirefox-debuginfo-39.0-78.1 MozillaFirefox-debugsource-39.0-78.1 MozillaFirefox-devel-39.0-78.1 MozillaFirefox-translations-common-39.0-78.1 MozillaFirefox-translations-other-39.0-78.1 libfreebl3-3.19.2-59.1 libfreebl3-debuginfo-3.19.2-59.1 libsoftokn3-3.19.2-59.1 libsoftokn3-debuginfo-3.19.2-59.1 mozilla-nss-3.19.2-59.1 mozilla-nss-certs-3.19.2-59.1 mozilla-nss-certs-debuginfo-3.19.2-59.1 mozilla-nss-debuginfo-3.19.2-59.1 mozilla-nss-debugsource-3.19.2-59.1 mozilla-nss-devel-3.19.2-59.1 mozilla-nss-sysinit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-3.19.2-59.1 mozilla-nss-tools-3.19.2-59.1 mozilla-nss-tools-debuginfo-3.19.2-59.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.19.2-59.1 libfreebl3-debuginfo-32bit-3.19.2-59.1 libsoftokn3-32bit-3.19.2-59.1 libsoftokn3-debuginfo-32bit-3.19.2-59.1 mozilla-nss-32bit-3.19.2-59.1 mozilla-nss-certs-32bit-3.19.2-59.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-59.1 mozilla-nss-debuginfo-32bit-3.19.2-59.1 mozilla-nss-sysinit-32bit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-59.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2727.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2729.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2731.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2741.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/932142 https://bugzilla.suse.com/933439 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1177-2: important: Security update for MySQL
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1177-2 Rating: important References: #934789 Cross-References: CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This MySQL update fixes the following security issue: * Logjam Attack: MySQL uses 512 bit DH groups in SSL connections. (bsc#934789) Security Issues: * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libmysqlclient-devel=10835 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libmysqlclient-devel=10834 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.8.8.2 libmysqlclient_r15-5.0.96-0.8.8.2 mysql-5.0.96-0.8.8.2 mysql-Max-5.0.96-0.8.8.2 mysql-client-5.0.96-0.8.8.2 mysql-tools-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.8.8.2 libmysqlclient_r15-5.0.96-0.8.8.2 mysql-5.0.96-0.8.8.2 mysql-Max-5.0.96-0.8.8.2 mysql-client-5.0.96-0.8.8.2 mysql-tools-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.8.8.2 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/934789 https://download.suse.com/patch/finder/?keywords=981d8f54c6495496c156cd451d… https://download.suse.com/patch/finder/?keywords=9bf49a65c370d89b69d6200ce0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1224-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1224-1 Rating: important References: #915517 #919007 #922583 #923908 #927355 #929525 #929647 #930786 #933429 #933896 #933904 #933907 #935705 #936831 Affected Products: SUSE Linux Enterprise Server 11-SP3-TERADATA ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following bugs and security issues. The following security issues have been fixed: - Update patches.fixes/udp-fix-behavior-of-wrong-checksums.patch (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Btrfs: make xattr replace operations atomic (bnc#923908, CVE-2014-9710). - udp: fix behavior of wrong checksums (bsc#936831, CVE-2015-5364, CVE-2015-5366). - vfs: read file_handle only once in handle_to_path (bsc#915517, CVE-2015-1420). - x86: bpf_jit: fix compilation of large bpf programs (bnc#935705,CVE-2015-4700). - udf: Check length of extended attributes and allocation (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Update patches.fixes/udf-Check-component-length-before-reading-it.patch (bsc#933904, CVE-2014-9728, CVE-2014-9730). - Update patches.fixes/udf-Verify-i_size-when-loading-inode.patch (bsc#933904, CVE-2014-9728, CVE-2014-9729). - Update patches.fixes/udf-Verify-symlink-size-before-loading-it.patch (bsc#933904, CVE-2014-9728). - Update patches.fixes/udf-Check-path-length-when-reading-symlink.patch (bnc#933896, CVE-2014-9731). - pipe: fix iov overrun for failed atomic copy (bsc#933429, CVE-2015-1805). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). The following non-security issues have been fixed: - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - net/mlx4_core: Don't disable SRIOV if there are active VFs (bsc#927355). - udf: Remove repeated loads blocksize (bsc#933907). - Refresh patches.fixes/deal-with-deadlock-in-d_walk-fix.patch. based on 3.2 stable fix 20defcec264c ("dcache: Fix locking bugs in backported "deal with deadlock in d_walk()""). Not harmfull for regular SLES kernels but RT or PREEMPT kernels would see disbalance. - sched: Fix potential near-infinite distribute_cfs_runtime() loop (bnc#930786) - tty: Correct tty buffer flush (bnc#929647). - tty: hold lock across tty buffer finding and buffer filling (bnc#929647). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-TERADATA: zypper in -t patch slessp3-kernel-201507-2=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-TERADATA (x86_64): kernel-default-3.0.101-57.TDC.2 kernel-default-base-3.0.101-57.TDC.2 kernel-default-devel-3.0.101-57.TDC.2 kernel-source-3.0.101-57.TDC.2 kernel-syms-3.0.101-57.TDC.2 kernel-trace-3.0.101-57.TDC.2 kernel-trace-base-3.0.101-57.TDC.2 kernel-trace-devel-3.0.101-57.TDC.2 kernel-xen-3.0.101-57.TDC.2 kernel-xen-base-3.0.101-57.TDC.2 kernel-xen-devel-3.0.101-57.TDC.2 References: https://bugzilla.suse.com/915517 https://bugzilla.suse.com/919007 https://bugzilla.suse.com/922583 https://bugzilla.suse.com/923908 https://bugzilla.suse.com/927355 https://bugzilla.suse.com/929525 https://bugzilla.suse.com/929647 https://bugzilla.suse.com/930786 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/933896 https://bugzilla.suse.com/933904 https://bugzilla.suse.com/933907 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/936831 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0