July 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1331-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 31 Jul '15

31 Jul '15

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1331-1 Rating: important References: #935540 #938895 Cross-References: CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: IBM Java was updated to 7.1-3.10 to fix several security issues. The following vulnerabilities were fixed: * CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-359=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-359=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.10-14.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.10-14.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.10-14.1 - SUSE Linux Enterprise Server 12 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.10-14.1 java-1_7_1-ibm-plugin-1.7.1_sr3.10-14.1 References: https://www.suse.com/security/cve/CVE-2015-1931.html https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/935540 https://bugzilla.suse.com/938895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1329-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 31 Jul '15

31 Jul '15

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1329-1 Rating: important References: #935540 #938895 Cross-References: CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: IBM Java was updated to 7.1-3.10 to fix several security issues. The following vulnerabilities were fixed: * CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-java-1_7_1-ibm-12013=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-java-1_7_1-ibm-12013=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.10-3.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.10-3.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.10-3.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.10-3.1 java-1_7_1-ibm-plugin-1.7.1_sr3.10-3.1 References: https://www.suse.com/security/cve/CVE-2015-1931.html https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/935540 https://bugzilla.suse.com/938895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1326-1: important: Security update for bind
by opensuse-security＠opensuse.org 31 Jul '15

31 Jul '15

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1326-1 Rating: important References: #918330 #936476 #939567 Cross-References: CVE-2015-1349 CVE-2015-4620 CVE-2015-5477 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (boo#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-527=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bind-9.9.4P2-66.1 bind-chrootenv-9.9.4P2-66.1 bind-debuginfo-9.9.4P2-66.1 bind-debugsource-9.9.4P2-66.1 bind-devel-9.9.4P2-66.1 bind-libs-9.9.4P2-66.1 bind-libs-debuginfo-9.9.4P2-66.1 bind-lwresd-9.9.4P2-66.1 bind-lwresd-debuginfo-9.9.4P2-66.1 bind-utils-9.9.4P2-66.1 bind-utils-debuginfo-9.9.4P2-66.1 - openSUSE Evergreen 11.4 (x86_64): bind-libs-32bit-9.9.4P2-66.1 bind-libs-debuginfo-32bit-9.9.4P2-66.1 - openSUSE Evergreen 11.4 (noarch): bind-doc-9.9.4P2-66.1 - openSUSE Evergreen 11.4 (ia64): bind-libs-debuginfo-x86-9.9.4P2-66.1 bind-libs-x86-9.9.4P2-66.1 References: https://www.suse.com/security/cve/CVE-2015-1349.html https://www.suse.com/security/cve/CVE-2015-4620.html https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/918330 https://bugzilla.suse.com/936476 https://bugzilla.suse.com/939567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1324-1: important: Security update for the SUSE Linux Enterprise 12 kernel
by opensuse-security＠opensuse.org 31 Jul '15

31 Jul '15

SUSE Security Update: Security update for the SUSE Linux Enterprise 12 kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1324-1 Rating: important References: #854817 #854824 #858727 #866911 #867362 #895814 #903279 #907092 #908491 #915183 #917630 #918618 #921430 #924071 #924526 #926369 #926953 #927455 #927697 #927786 #928131 #929475 #929696 #929879 #929974 #930092 #930399 #930579 #930599 #930972 #931124 #931403 #931538 #931620 #931860 #931988 #932348 #932793 #932897 #932898 #932899 #932900 #932967 #933117 #933429 #933637 #933896 #933904 #933907 #934160 #935083 #935085 #935088 #935174 #935542 #935881 #935918 #936012 #936423 #936445 #936446 #936502 #936556 #936831 #936875 #937032 #937087 #937609 #937612 #937613 #937616 #938022 #938023 #938024 Cross-References: CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-1805 CVE-2015-3212 CVE-2015-4036 CVE-2015-4167 CVE-2015-4692 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 63 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes. These features were added: - mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array support (bsc#854824). - mpt3sas: Bump mpt3sas driver version to 04.100.00.00 (bsc#854817). Following security bugs were fixed: - CVE-2015-1805: iov overrun for failed atomic copy could have lead to DoS or privilege escalation (bsc#933429). - CVE-2015-3212: A race condition in the way the Linux kernel handled lists of associations in SCTP sockets could have lead to list corruption and kernel panics (bsc#936502). - CVE-2015-4036: DoS via memory corruption in vhost/scsi driver (bsc#931988). - CVE-2015-4167: Linux kernel built with the UDF file system(CONFIG_UDF_FS) support was vulnerable to a crash. It occurred while fetching inode information from a corrupted/malicious udf file system image (bsc#933907). - CVE-2015-4692: DoS via NULL pointer dereference in kvm_apic_has_events function (bsc#935542). - CVE-2015-5364: Remote DoS via flood of UDP packets with invalid checksums (bsc#936831). - CVE-2015-5366: Remote DoS of EPOLLET epoll applications via flood of UDP packets with invalid checksums (bsc#936831). Security issues already fixed in the previous update but not referenced by CVE: - CVE-2014-9728: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904). - CVE-2014-9729: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904). - CVE-2014-9730: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to a crash (bsc#933904). - CVE-2014-9731: Kernel built with the UDF file system(CONFIG_UDF_FS) support were vulnerable to information leakage (bsc#933896). The following non-security bugs were fixed: - ALSA: hda - add codec ID for Skylake display audio codec (bsc#936556). - ALSA: hda/hdmi - apply Haswell fix-ups to Skylake display codec (bsc#936556). - ALSA: hda_controller: Separate stream_tag for input and output streams (bsc#936556). - ALSA: hda_intel: add AZX_DCAPS_I915_POWERWELL for SKL and BSW (bsc#936556). - ALSA: hda_intel: apply the Seperate stream_tag for Skylake (bsc#936556). - ALSA: hda_intel: apply the Seperate stream_tag for Sunrise Point (bsc#936556). - Btrfs: Handle unaligned length in extent_same (bsc#937609). - Btrfs: add missing inode item update in fallocate() (bsc#938023). - Btrfs: check pending chunks when shrinking fs to avoid corruption (bsc#936445). - Btrfs: do not update mtime/ctime on deduped inodes (bsc#937616). - Btrfs: fix block group ->space_info null pointer dereference (bsc#935088). - Btrfs: fix clone / extent-same deadlocks (bsc#937612). - Btrfs: fix deadlock with extent-same and readpage (bsc#937612). - Btrfs: fix fsync data loss after append write (bsc#936446). - Btrfs: fix hang during inode eviction due to concurrent readahead (bsc#935085). - Btrfs: fix memory leak in the extent_same ioctl (bsc#937613). - Btrfs: fix race when reusing stale extent buffers that leads to BUG_ON (bsc#926369). - Btrfs: fix use after free when close_ctree frees the orphan_rsv (bsc#938022). - Btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609). - Btrfs: provide super_operations->inode_get_dev (bsc#927455). - Drivers: hv: balloon: check if ha_region_mutex was acquired in MEM_CANCEL_ONLINE case. - Drivers: hv: fcopy: process deferred messages when we complete the transaction. - Drivers: hv: fcopy: rename fcopy_work -> fcopy_timeout_work. - Drivers: hv: fcopy: set .owner reference for file operations. - Drivers: hv: fcopy: switch to using the hvutil_device_state state machine. - Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case. - Drivers: hv: hv_balloon: correctly handle val.freeram lower than num_pages case. - Drivers: hv: hv_balloon: do not lose memory when onlining order is not natural. - Drivers: hv: hv_balloon: do not online pages in offline blocks. - Drivers: hv: hv_balloon: eliminate jumps in piecewiese linear floor function. - Drivers: hv: hv_balloon: eliminate the trylock path in acquire/release_region_mutex. - Drivers: hv: hv_balloon: keep locks balanced on add_memory() failure. - Drivers: hv: hv_balloon: refuse to balloon below the floor. - Drivers: hv: hv_balloon: report offline pages as being used. - Drivers: hv: hv_balloon: survive ballooning request with num_pages=0. - Drivers: hv: kvp: move poll_channel() to hyperv_vmbus.h. - Drivers: hv: kvp: rename kvp_work -> kvp_timeout_work. - Drivers: hv: kvp: reset kvp_context. - Drivers: hv: kvp: switch to using the hvutil_device_state state machine. - Drivers: hv: util: Fix a bug in the KVP code. reapply upstream change ontop of v3.12-stable change - Drivers: hv: util: On device remove, close the channel after de-initializing the service. - Drivers: hv: util: introduce hv_utils_transport abstraction. - Drivers: hv: util: introduce state machine for util drivers. - Drivers: hv: util: move kvp/vss function declarations to hyperv_vmbus.h. - Drivers: hv: vmbus: Add device and vendor ID to vmbus devices. - Drivers: hv: vmbus: Add support for VMBus panic notifier handler (bsc#934160). - Drivers: hv: vmbus: Add support for the NetworkDirect GUID. - Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY (bsc#934160). - Drivers: hv: vmbus: Export the vmbus_sendpacket_pagebuffer_ctl(). - Drivers: hv: vmbus: Fix a bug in rescind processing in vmbus_close_internal(). - Drivers: hv: vmbus: Fix a siganlling host signalling issue. - Drivers: hv: vmbus: Get rid of some unnecessary messages. - Drivers: hv: vmbus: Get rid of some unused definitions. - Drivers: hv: vmbus: Handle both rescind and offer messages in the same context. - Drivers: hv: vmbus: Implement the protocol for tearing down vmbus state. - Drivers: hv: vmbus: Introduce a function to remove a rescinded offer. - Drivers: hv: vmbus: Perform device register in the per-channel work element. - Drivers: hv: vmbus: Permit sending of packets without payload. - Drivers: hv: vmbus: Properly handle child device remove. - Drivers: hv: vmbus: Remove the channel from the channel list(s) on failure. - Drivers: hv: vmbus: Suport an API to send packet with additional control. - Drivers: hv: vmbus: Suport an API to send pagebuffers with additional control. - Drivers: hv: vmbus: Teardown clockevent devices on module unload. - Drivers: hv: vmbus: Teardown synthetic interrupt controllers on module unload. - Drivers: hv: vmbus: Use a round-robin algorithm for picking the outgoing channel. - Drivers: hv: vmbus: Use the vp_index map even for channels bound to CPU 0. - Drivers: hv: vmbus: avoid double kfree for device_obj. - Drivers: hv: vmbus: briefly comment num_sc and next_oc. - Drivers: hv: vmbus: decrease num_sc on subchannel removal. - Drivers: hv: vmbus: distribute subchannels among all vcpus. - Drivers: hv: vmbus: do cleanup on all vmbus_open() failure paths. - Drivers: hv: vmbus: introduce vmbus_acpi_remove. - Drivers: hv: vmbus: kill tasklets on module unload. - Drivers: hv: vmbus: move init_vp_index() call to vmbus_process_offer(). - Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors. - Drivers: hv: vmbus: rename channel work queues. - Drivers: hv: vmbus: teardown hv_vmbus_con workqueue and vmbus_connection pages on shutdown. - Drivers: hv: vmbus: unify calls to percpu_channel_enq(). - Drivers: hv: vmbus: unregister panic notifier on module unload. - Drivers: hv: vmbus:Update preferred vmbus protocol version to windows 10. - Drivers: hv: vss: process deferred messages when we complete the transaction. - Drivers: hv: vss: switch to using the hvutil_device_state state machine. - Enable CONFIG_BRIDGE_NF_EBTABLES on s390x (bsc#936012) - Fix connection reuse when sk_error_report is used (bsc#930972). - GHES: Carve out error queueing in a separate function (bsc#917630). - GHES: Carve out the panic functionality (bsc#917630). - GHES: Elliminate double-loop in the NMI handler (bsc#917630). - GHES: Make NMI handler have a single reader (bsc#917630). - GHES: Panic right after detection (bsc#917630). - IB/mlx4: Fix wrong usage of IPv4 protocol for multicast attach/detach (bsc#918618). - Initialize hv_netvsc_packet->xmit_more to avoid transfer stalls - KVM: PPC: BOOK3S: HV: CMA: Reserve cma region only in hypervisor mode (bsc#908491). - KVM: s390: virtio-ccw: Handle command rejects (bsc#931860). - MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696). - MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696). - PCI: pciehp: Add hotplug_lock to serialize hotplug events (bsc#866911). - Revert "MODSIGN: loading keys from db when SecureBoot disabled". This reverts commit b45412d4, because it breaks legacy boot. - SUNRPC: Report connection error values to rpc_tasks on the pending queue (bsc#930972). - Update s390x kabi files with netfilter change (bsc#936012) - client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bsc#932348). - cpufreq: pcc: Enable autoload of pcc-cpufreq for ACPI processors (bsc#933117). - dmapi: fix value from newer Linux strnlen_user() (bsc#932897). - drm/i915/hsw: Fix workaround for server AUX channel clock divisor (bsc#935918). - drm/i915: Evict CS TLBs between batches (bsc#935918). - drm/i915: Fix DDC probe for passive adapters (bsc#935918). - drm/i915: Handle failure to kick out a conflicting fb driver (bsc#935918). - drm/i915: drop WaSetupGtModeTdRowDispatch:snb (bsc#935918). - drm/i915: save/restore GMBUS freq across suspend/resume on gen4 (bsc#935918). - edd: support original Phoenix EDD 3.0 information (bsc#929974). - ext4: fix over-defensive complaint after journal abort (bsc#935174). - fs/cifs: Fix corrupt SMB2 ioctl requests (bsc#931124). - ftrace: add oco handling patch (bsc#924526). - ftrace: allow architectures to specify ftrace compile options (bsc#924526). - ftrace: let notrace function attribute disable hotpatching if necessary (bsc#924526). - hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES (bsc#930092). - hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bsc#930092). - hv: channel: match var type to return type of wait_for_completion. - hv: do not schedule new works in vmbus_onoffer()/vmbus_onoffer_rescind(). - hv: hv_balloon: match var type to return type of wait_for_completion. - hv: hv_util: move vmbus_open() to a later place. - hv: hypervvssd: call endmntent before call setmntent again. - hv: no rmmod for hv_vmbus and hv_utils. - hv: remove the per-channel workqueue. - hv: run non-blocking message handlers in the dispatch tasklet. - hv: vmbus: missing curly braces in vmbus_process_offer(). - hv: vmbus_free_channels(): remove the redundant free_channel(). - hv: vmbus_open(): reset the channel state on ENOMEM. - hv: vmbus_post_msg: retry the hypercall on some transient errors. - hv_netvsc: Allocate the receive buffer from the correct NUMA node. - hv_netvsc: Allocate the sendbuf in a NUMA aware way. - hv_netvsc: Clean up two unused variables. - hv_netvsc: Cleanup the test for freeing skb when we use sendbuf mechanism. - hv_netvsc: Define a macro RNDIS_AND_PPI_SIZE. - hv_netvsc: Eliminate memory allocation in the packet send path. - hv_netvsc: Fix a bug in netvsc_start_xmit(). - hv_netvsc: Fix the packet free when it is in skb headroom. - hv_netvsc: Implement batching in send buffer. - hv_netvsc: Implement partial copy into send buffer. - hv_netvsc: Use the xmit_more skb flag to optimize signaling the host. - hv_netvsc: change member name of struct netvsc_stats. - hv_netvsc: introduce netif-msg into netvsc module. - hv_netvsc: remove unused variable in netvsc_send(). - hv_netvsc: remove vmbus_are_subchannels_present() in rndis_filter_device_add(). - hv_netvsc: try linearizing big SKBs before dropping them. - hv_netvsc: use per_cpu stats to calculate TX/RX data. - hv_netvsc: use single existing drop path in netvsc_start_xmit. - hv_vmbus: Add gradually increased delay for retries in vmbus_post_msg(). - hyperv: Implement netvsc_get_channels() ethool op. - hyperv: hyperv_fb: match wait_for_completion_timeout return type. - iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538). - iommu/amd: Handle large pages correctly in free_pagetable (bsc#935881). - ipr: Increase default adapter init stage change timeout (bsc#930579). - ipv6: do not delete previously existing ECMP routes if add fails (bsc#930399). - ipv6: fix ECMP route replacement (bsc#930399). - jbd2: improve error messages for inconsistent journal heads (bsc#935174). - jbd2: revise KERN_EMERG error messages (bsc#935174). - kabi/severities: Add s390 symbols allowed to change in bsc#931860 - kabi: only use sops->get_inode_dev with proper fsflag. - kernel: add panic_on_warn. - kexec: allocate the kexec control page with KEXEC_CONTROL_MEMORY_GFP (bsc#928131). - kgr: fix redirection on s390x arch (bsc#903279). - kgr: move kgr_task_in_progress() to sched.h. - kgr: send a fake signal to all blocking tasks. - kvm: irqchip: Break up high order allocations of kvm_irq_routing_table (bsc#926953). - libata: Blacklist queued TRIM on all Samsung 800-series (bsc#930599). - mei: bus: () can be static. - mm, thp: really limit transparent hugepage allocation to local node (VM Performance, bsc#931620). - mm, thp: respect MPOL_PREFERRED policy with non-local node (VM Performance, bsc#931620). - mm/mempolicy.c: merge alloc_hugepage_vma to alloc_pages_vma (VM Performance, bsc#931620). - mm/thp: allocate transparent hugepages on local node (VM Performance, bsc#931620). - net/mlx4_en: Call register_netdevice in the proper location (bsc#858727). - net/mlx4_en: Do not attempt to TX offload the outer UDP checksum for VXLAN (bsc#858727). - net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference (bsc#867362). - net: introduce netdev_alloc_pcpu_stats() for drivers. - net: ipv6: fib: do not sleep inside atomic lock (bsc#867362). - netdev: set __percpu attribute on netdev_alloc_pcpu_stats. - netdev_alloc_pcpu_stats: use less common iterator variable. - netfilter: xt_NFQUEUE: fix --queue-bypass regression (bsc#935083) - ovl: default permissions (bsc#924071). - ovl: move s_stack_depth . - powerpc/perf/hv-24x7: use kmem_cache instead of aligned stack allocations (bsc#931403). - powerpc/pseries: Correct cpu affinity for dlpar added cpus (bsc#932967). - powerpc: Add VM_FAULT_HWPOISON handling to powerpc page fault handler (bsc#929475). - powerpc: Fill in si_addr_lsb siginfo field (bsc#929475). - powerpc: Simplify do_sigbus (bsc#929475). - reiserfs: Fix use after free in journal teardown (bsc#927697). - rtlwifi: rtl8192cu: Fix kernel deadlock (bsc#927786). - s390/airq: add support for irq ranges (bsc#931860). - s390/airq: silence lockdep warning (bsc#931860). - s390/compat,signal: change return values to -EFAULT (bsc#929879). - s390/ftrace: hotpatch support for function tracing (bsc#924526). - s390/irq: improve displayed interrupt order in /proc/interrupts (bsc#931860). - s390/kernel: use stnsm 255 instead of stosm 0 (bsc#929879). - s390/kgr: reorganize kgr infrastructure in entry64.S. - s390/mm: align 64-bit PIE binaries to 4GB (bsc#929879). - s390/mm: limit STACK_RND_MASK for compat tasks (bsc#929879). - s390/rwlock: add missing local_irq_restore calls (bsc#929879). - s390/sclp_vt220: Fix kernel panic due to early terminal input (bsc#931860). - s390/smp: only send external call ipi if needed (bsc#929879). - s390/spinlock,rwlock: always to a load-and-test first (bsc#929879). - s390/spinlock: cleanup spinlock code (bsc#929879). - s390/spinlock: optimize spin_unlock code (bsc#929879). - s390/spinlock: optimize spinlock code sequence (bsc#929879). - s390/spinlock: refactor arch_spin_lock_wait[_flags] (bsc#929879). - s390/time: use stck clock fast for do_account_vtime (bsc#929879). - s390: Remove zfcpdump NR_CPUS dependency (bsc#929879). - s390: add z13 code generation support (bsc#929879). - s390: avoid z13 cache aliasing (bsc#929879). - s390: fix control register update (bsc#929879). - s390: optimize control register update (bsc#929879). - s390: z13 base performance (bsc#929879). - sched: fix __sched_setscheduler() vs load balancing race (bsc#921430) - scsi: retry MODE SENSE on unit attention (bsc#895814). - scsi_dh_alua: Recheck state on unit attention (bsc#895814). - scsi_dh_alua: fixup crash in alua_rtpg_work() (bsc#895814). - scsi_dh_alua: parse device id instead of target id (bsc#895814). - scsi_dh_alua: recheck RTPG in regular intervals (bsc#895814). - scsi_dh_alua: update all port states (bsc#895814). - sd: always retry READ CAPACITY for ALUA state transition (bsc#895814). - st: null pointer dereference panic caused by use after kref_put by st_open (bsc#936875). - supported.conf: add btrfs to kernel-$flavor-base (bsc#933637) - udf: Remove repeated loads blocksize (bsc#933907). - usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset (bsc#938024). - vTPM: set virtual device before passing to ibmvtpm_reset_crq (bsc#937087). - vfs: add super_operations->get_inode_dev (bsc#927455). - virtio-ccw: virtio-ccw adapter interrupt support (bsc#931860). - virtio-rng: do not crash if virtqueue is broken (bsc#931860). - virtio: fail adding buffer on broken queues (bsc#931860). - virtio: virtio_break_device() to mark all virtqueues broken (bsc#931860). - virtio_blk: verify if queue is broken after virtqueue_get_buf() (bsc#931860). - virtio_ccw: fix hang in set offline processing (bsc#931860). - virtio_ccw: fix vcdev pointer handling issues (bsc#931860). - virtio_ccw: introduce device_lost in virtio_ccw_device (bsc#931860). - virtio_net: do not crash if virtqueue is broken (bsc#931860). - virtio_net: verify if queue is broken after virtqueue_get_buf() (bsc#931860). - virtio_ring: adapt to notify() returning bool (bsc#931860). - virtio_ring: add new function virtqueue_is_broken() (bsc#931860). - virtio_ring: change host notification API (bsc#931860). - virtio_ring: let virtqueue_{kick()/notify()} return a bool (bsc#931860). - virtio_ring: plug kmemleak false positive (bsc#931860). - virtio_scsi: do not call virtqueue_add_sgs(... GFP_NOIO) holding spinlock (bsc#931860). - virtio_scsi: verify if queue is broken after virtqueue_get_buf() (bsc#931860). - vmxnet3: Bump up driver version number (bsc#936423). - vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423). - vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423). - vmxnet3: Register shutdown handler for device (fwd) (bug#936423). - x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A (bsc#907092). - x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing (bsc#907092). - x86/kgr: move kgr infrastructure from asm to C. - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - xfrm: release dst_orig in case of error in xfrm_lookup() (bsc#932793). - xfs: Skip dirty pages in ->releasepage (bsc#915183). - xfs: fix xfs_setattr for DMAPI (bsc#932900). - xfs_dmapi: fix transaction ilocks (bsc#932899). - xfs_dmapi: fix value from newer Linux strnlen_user() (bsc#932897). - xfs_dmapi: xfs_dm_rdwr() uses dir file ops not file's ops (bsc#932898). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-356=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-356=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-356=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-356=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-356=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-356=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.44-52.10.1 kernel-default-debugsource-3.12.44-52.10.1 kernel-default-extra-3.12.44-52.10.1 kernel-default-extra-debuginfo-3.12.44-52.10.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.44-52.10.1 kernel-obs-build-debugsource-3.12.44-52.10.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.44-52.10.3 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.44-52.10.1 kernel-default-base-3.12.44-52.10.1 kernel-default-base-debuginfo-3.12.44-52.10.1 kernel-default-debuginfo-3.12.44-52.10.1 kernel-default-debugsource-3.12.44-52.10.1 kernel-default-devel-3.12.44-52.10.1 kernel-syms-3.12.44-52.10.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.44-52.10.1 kernel-xen-base-3.12.44-52.10.1 kernel-xen-base-debuginfo-3.12.44-52.10.1 kernel-xen-debuginfo-3.12.44-52.10.1 kernel-xen-debugsource-3.12.44-52.10.1 kernel-xen-devel-3.12.44-52.10.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.44-52.10.1 kernel-macros-3.12.44-52.10.1 kernel-source-3.12.44-52.10.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.44-52.10.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.44-52.10.1 kernel-ec2-debuginfo-3.12.44-52.10.1 kernel-ec2-debugsource-3.12.44-52.10.1 kernel-ec2-devel-3.12.44-52.10.1 kernel-ec2-extra-3.12.44-52.10.1 kernel-ec2-extra-debuginfo-3.12.44-52.10.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_44-52_10-default-1-2.1 kgraft-patch-3_12_44-52_10-xen-1-2.1 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.44-52.10.1 kernel-default-debuginfo-3.12.44-52.10.1 kernel-default-debugsource-3.12.44-52.10.1 kernel-default-devel-3.12.44-52.10.1 kernel-default-extra-3.12.44-52.10.1 kernel-default-extra-debuginfo-3.12.44-52.10.1 kernel-syms-3.12.44-52.10.1 kernel-xen-3.12.44-52.10.1 kernel-xen-debuginfo-3.12.44-52.10.1 kernel-xen-debugsource-3.12.44-52.10.1 kernel-xen-devel-3.12.44-52.10.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.44-52.10.1 kernel-macros-3.12.44-52.10.1 kernel-source-3.12.44-52.10.1 References: https://www.suse.com/security/cve/CVE-2014-9728.html https://www.suse.com/security/cve/CVE-2014-9729.html https://www.suse.com/security/cve/CVE-2014-9730.html https://www.suse.com/security/cve/CVE-2014-9731.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3212.html https://www.suse.com/security/cve/CVE-2015-4036.html https://www.suse.com/security/cve/CVE-2015-4167.html https://www.suse.com/security/cve/CVE-2015-4692.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/854817 https://bugzilla.suse.com/854824 https://bugzilla.suse.com/858727 https://bugzilla.suse.com/866911 https://bugzilla.suse.com/867362 https://bugzilla.suse.com/895814 https://bugzilla.suse.com/903279 https://bugzilla.suse.com/907092 https://bugzilla.suse.com/908491 https://bugzilla.suse.com/915183 https://bugzilla.suse.com/917630 https://bugzilla.suse.com/918618 https://bugzilla.suse.com/921430 https://bugzilla.suse.com/924071 https://bugzilla.suse.com/924526 https://bugzilla.suse.com/926369 https://bugzilla.suse.com/926953 https://bugzilla.suse.com/927455 https://bugzilla.suse.com/927697 https://bugzilla.suse.com/927786 https://bugzilla.suse.com/928131 https://bugzilla.suse.com/929475 https://bugzilla.suse.com/929696 https://bugzilla.suse.com/929879 https://bugzilla.suse.com/929974 https://bugzilla.suse.com/930092 https://bugzilla.suse.com/930399 https://bugzilla.suse.com/930579 https://bugzilla.suse.com/930599 https://bugzilla.suse.com/930972 https://bugzilla.suse.com/931124 https://bugzilla.suse.com/931403 https://bugzilla.suse.com/931538 https://bugzilla.suse.com/931620 https://bugzilla.suse.com/931860 https://bugzilla.suse.com/931988 https://bugzilla.suse.com/932348 https://bugzilla.suse.com/932793 https://bugzilla.suse.com/932897 https://bugzilla.suse.com/932898 https://bugzilla.suse.com/932899 https://bugzilla.suse.com/932900 https://bugzilla.suse.com/932967 https://bugzilla.suse.com/933117 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/933637 https://bugzilla.suse.com/933896 https://bugzilla.suse.com/933904 https://bugzilla.suse.com/933907 https://bugzilla.suse.com/934160 https://bugzilla.suse.com/935083 https://bugzilla.suse.com/935085 https://bugzilla.suse.com/935088 https://bugzilla.suse.com/935174 https://bugzilla.suse.com/935542 https://bugzilla.suse.com/935881 https://bugzilla.suse.com/935918 https://bugzilla.suse.com/936012 https://bugzilla.suse.com/936423 https://bugzilla.suse.com/936445 https://bugzilla.suse.com/936446 https://bugzilla.suse.com/936502 https://bugzilla.suse.com/936556 https://bugzilla.suse.com/936831 https://bugzilla.suse.com/936875 https://bugzilla.suse.com/937032 https://bugzilla.suse.com/937087 https://bugzilla.suse.com/937609 https://bugzilla.suse.com/937612 https://bugzilla.suse.com/937613 https://bugzilla.suse.com/937616 https://bugzilla.suse.com/938022 https://bugzilla.suse.com/938023 https://bugzilla.suse.com/938024 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1322-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jul '15

30 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1322-1 Rating: important References: #939567 Cross-References: CVE-2015-5477 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: bind was updated to fix one security issue: * CVE-2015-5477: Remote Denial-of-Service via TKEY queries. (bsc#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Security Issues: * CVE-2015-5477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 9.6ESVR11P1]: bind-9.6ESVR11P1-0.14.1 bind-chrootenv-9.6ESVR11P1-0.14.1 bind-devel-9.6ESVR11P1-0.14.1 bind-doc-9.6ESVR11P1-0.14.1 bind-libs-9.6ESVR11P1-0.14.1 bind-utils-9.6ESVR11P1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 9.6ESVR11P1]: bind-libs-32bit-9.6ESVR11P1-0.14.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/939567 https://download.suse.com/patch/finder/?keywords=fe704ff2063364097264540397… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1320-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 30 Jul '15

30 Jul '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1320-1 Rating: important References: #938248 Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-java-1_7_0-openjdk-12012=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk-12012=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-java-1_7_0-openjdk-12012=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-java-1_7_0-openjdk-12012=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-0.11.2 java-1_7_0-openjdk-demo-1.7.0.85-0.11.2 java-1_7_0-openjdk-devel-1.7.0.85-0.11.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-0.11.2 java-1_7_0-openjdk-demo-1.7.0.85-0.11.2 java-1_7_0-openjdk-devel-1.7.0.85-0.11.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2 java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): java-1_7_0-openjdk-debuginfo-1.7.0.85-0.11.2 java-1_7_0-openjdk-debugsource-1.7.0.85-0.11.2 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2596.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1319-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 30 Jul '15

30 Jul '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1319-1 Rating: important References: #938248 Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-352=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-352=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.85-18.2 java-1_7_0-openjdk-debuginfo-1.7.0.85-18.2 java-1_7_0-openjdk-debugsource-1.7.0.85-18.2 java-1_7_0-openjdk-demo-1.7.0.85-18.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-18.2 java-1_7_0-openjdk-devel-1.7.0.85-18.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-18.2 java-1_7_0-openjdk-headless-1.7.0.85-18.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-18.2 - SUSE Linux Enterprise Desktop 12 (x86_64): java-1_7_0-openjdk-1.7.0.85-18.2 java-1_7_0-openjdk-debuginfo-1.7.0.85-18.2 java-1_7_0-openjdk-debugsource-1.7.0.85-18.2 java-1_7_0-openjdk-headless-1.7.0.85-18.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-18.2 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2596.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1316-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jul '15

30 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1316-1 Rating: important References: #939567 Cross-References: CVE-2015-5477 Affected Products: SUSE Linux Enterprise Server 11-SP1-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (bsc#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP1-LTSS: zypper in -t patch slessp1-bind-12010=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP1-LTSS (i586 s390x x86_64): bind-9.6ESVR11W1-0.6.1 bind-chrootenv-9.6ESVR11W1-0.6.1 bind-devel-9.6ESVR11W1-0.6.1 bind-doc-9.6ESVR11W1-0.6.1 bind-libs-9.6ESVR11W1-0.6.1 bind-utils-9.6ESVR11W1-0.6.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (s390x x86_64): bind-libs-32bit-9.6ESVR11W1-0.6.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/939567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1305-1: important: Security update for bind
by opensuse-security＠opensuse.org 28 Jul '15

28 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1305-1 Rating: important References: #939567 Cross-References: CVE-2015-5477 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (bsc#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-346=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-346=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-346=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bind-debuginfo-9.9.6P1-23.1 bind-debugsource-9.9.6P1-23.1 bind-devel-9.9.6P1-23.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bind-9.9.6P1-23.1 bind-chrootenv-9.9.6P1-23.1 bind-debuginfo-9.9.6P1-23.1 bind-debugsource-9.9.6P1-23.1 bind-libs-9.9.6P1-23.1 bind-libs-debuginfo-9.9.6P1-23.1 bind-utils-9.9.6P1-23.1 bind-utils-debuginfo-9.9.6P1-23.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): bind-libs-32bit-9.9.6P1-23.1 bind-libs-debuginfo-32bit-9.9.6P1-23.1 - SUSE Linux Enterprise Server 12 (noarch): bind-doc-9.9.6P1-23.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bind-debuginfo-9.9.6P1-23.1 bind-debugsource-9.9.6P1-23.1 bind-libs-32bit-9.9.6P1-23.1 bind-libs-9.9.6P1-23.1 bind-libs-debuginfo-32bit-9.9.6P1-23.1 bind-libs-debuginfo-9.9.6P1-23.1 bind-utils-9.9.6P1-23.1 bind-utils-debuginfo-9.9.6P1-23.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/939567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1304-1: important: Security update for bind
by opensuse-security＠opensuse.org 28 Jul '15

28 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1304-1 Rating: important References: #939567 Cross-References: CVE-2015-5477 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (bsc#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-12008=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-bind-12008=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-bind-12008=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-12008=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-bind-12008=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-bind-12008=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-bind-12008=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-bind-12008=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-12008=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-12008=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.12.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.12.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64): bind-devel-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): bind-9.9.6P1-0.12.1 bind-chrootenv-9.9.6P1-0.12.1 bind-doc-9.9.6P1-0.12.1 bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.12.1 bind-chrootenv-9.9.6P1-0.12.1 bind-doc-9.9.6P1-0.12.1 bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.12.1 bind-chrootenv-9.9.6P1-0.12.1 bind-doc-9.9.6P1-0.12.1 bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): bind-libs-x86-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.12.1 bind-chrootenv-9.9.6P1-0.12.1 bind-devel-9.9.6P1-0.12.1 bind-doc-9.9.6P1-0.12.1 bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): bind-libs-9.9.6P1-0.12.1 bind-utils-9.9.6P1-0.12.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.12.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.12.1 bind-debugsource-9.9.6P1-0.12.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.12.1 bind-debugsource-9.9.6P1-0.12.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/939567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1302-1: important: Security update for xen
by opensuse-security＠opensuse.org 28 Jul '15

28 Jul '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1302-1 Rating: important References: #925466 #935256 #935634 #938344 Cross-References: CVE-2015-3259 CVE-2015-5154 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: xen was updated to fix two security issues. These security issues were fixed: - CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137). - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). These non-security issues were fixed: - Restart of xencommons service did lead to loss of xenstore data (bsc#935256). - Kdump did not work in a XEN environment (bsc#925466). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-344=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-344=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-344=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.2_08-22.5.1 xen-devel-4.4.2_08-22.5.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.2_08-22.5.1 xen-debugsource-4.4.2_08-22.5.1 xen-doc-html-4.4.2_08-22.5.1 xen-kmp-default-4.4.2_08_k3.12.43_52.6-22.5.1 xen-kmp-default-debuginfo-4.4.2_08_k3.12.43_52.6-22.5.1 xen-libs-32bit-4.4.2_08-22.5.1 xen-libs-4.4.2_08-22.5.1 xen-libs-debuginfo-32bit-4.4.2_08-22.5.1 xen-libs-debuginfo-4.4.2_08-22.5.1 xen-tools-4.4.2_08-22.5.1 xen-tools-debuginfo-4.4.2_08-22.5.1 xen-tools-domU-4.4.2_08-22.5.1 xen-tools-domU-debuginfo-4.4.2_08-22.5.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.2_08-22.5.1 xen-debugsource-4.4.2_08-22.5.1 xen-kmp-default-4.4.2_08_k3.12.43_52.6-22.5.1 xen-kmp-default-debuginfo-4.4.2_08_k3.12.43_52.6-22.5.1 xen-libs-32bit-4.4.2_08-22.5.1 xen-libs-4.4.2_08-22.5.1 xen-libs-debuginfo-32bit-4.4.2_08-22.5.1 xen-libs-debuginfo-4.4.2_08-22.5.1 References: https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/925466 https://bugzilla.suse.com/935256 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1299-1: important: Security update for xen
by opensuse-security＠opensuse.org 27 Jul '15

27 Jul '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1299-1 Rating: important References: #925466 #935634 #938344 Cross-References: CVE-2015-3259 CVE-2015-5154 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: xen was updated to fix two security issues. These security issues were fixed: - CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137). - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). This non-security issue was fixed: - Kdump did not work in a XEN environment (bsc#925466). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-12007=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-12007=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-xen-12007=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-12007=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.2_10_3.0.101_63-5.1 xen-libs-4.4.2_10-5.1 xen-tools-domU-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.2_10-5.1 xen-doc-html-4.4.2_10-5.1 xen-libs-32bit-4.4.2_10-5.1 xen-tools-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.2_10_3.0.101_63-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): xen-kmp-default-4.4.2_10_3.0.101_63-5.1 xen-libs-4.4.2_10-5.1 xen-tools-domU-4.4.2_10-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): xen-4.4.2_10-5.1 xen-doc-html-4.4.2_10-5.1 xen-libs-32bit-4.4.2_10-5.1 xen-tools-4.4.2_10-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586): xen-kmp-pae-4.4.2_10_3.0.101_63-5.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.2_10-5.1 xen-debugsource-4.4.2_10-5.1 References: https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/925466 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1289-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1289-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2659 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2659: Easily exploitable vulnerability in the Security component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.51-12.1 java-1_8_0-openjdk-accessibility-1.8.0.51-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-debugsource-1.8.0.51-12.1 java-1_8_0-openjdk-demo-1.8.0.51-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-devel-1.8.0.51-12.1 java-1_8_0-openjdk-headless-1.8.0.51-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-src-1.8.0.51-12.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.51-12.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2659.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1288-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1288-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-511=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-511=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-10.2 java-1_7_0-openjdk-accessibility-1.7.0.85-10.2 java-1_7_0-openjdk-bootstrap-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-debugsource-1.7.0.85-10.2 java-1_7_0-openjdk-demo-1.7.0.85-10.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-devel-1.7.0.85-10.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-headless-1.7.0.85-10.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-src-1.7.0.85-10.2 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-10.2 - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-24.21.1 java-1_7_0-openjdk-accessibility-1.7.0.85-24.21.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-debugsource-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-src-1.7.0.85-24.21.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-24.21.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2596.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1287-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1287-1 Rating: important References: #939077 Cross-References: CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1275 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 CVE-2015-5605 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: Chromium was updated to 44.0.2403.89 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-1271: Heap-buffer-overflow in pdfium * CVE-2015-1273: Heap-buffer-overflow in pdfium * CVE-2015-1274: Settings allowed executable files to run immediately after download * CVE-2015-1275: UXSS in Chrome for Android * CVE-2015-1276: Use-after-free in IndexedDB * CVE-2015-1279: Heap-buffer-overflow in pdfium * CVE-2015-1280: Memory corruption in skia * CVE-2015-1281: CSP bypass * CVE-2015-1282: Use-after-free in pdfium * CVE-2015-1283: Heap-buffer-overflow in expat * CVE-2015-1284: Use-after-free in blink * CVE-2015-1286: UXSS in blink * CVE-2015-1287: SOP bypass with CSS * CVE-2015-1270: Uninitialized memory read in ICU * CVE-2015-1272: Use-after-free related to unexpected GPU process termination * CVE-2015-1277: Use-after-free in accessibility * CVE-2015-1278: URL spoofing using pdf files * CVE-2015-1285: Information leak in XSS auditor * CVE-2015-1288: Spell checking dictionaries fetched over HTTP * CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives * CVE-2015-5605: Rgular-expression implementation mishandles interrupts, DoS via JS The following non-security changes are included: * A number of new apps/extension APIs * Lots of under the hood changes for stability and performance * Pepper Flash plugin updated to 18.0.0.209 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-513=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-44.0.2403.89-38.1 chromedriver-debuginfo-44.0.2403.89-38.1 chromium-44.0.2403.89-38.1 chromium-debuginfo-44.0.2403.89-38.1 chromium-debugsource-44.0.2403.89-38.1 chromium-desktop-gnome-44.0.2403.89-38.1 chromium-desktop-kde-44.0.2403.89-38.1 chromium-ffmpegsumo-44.0.2403.89-38.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-38.1 - openSUSE 13.1 (i586 x86_64): chromedriver-44.0.2403.89-93.1 chromedriver-debuginfo-44.0.2403.89-93.1 chromium-44.0.2403.89-93.1 chromium-debuginfo-44.0.2403.89-93.1 chromium-debugsource-44.0.2403.89-93.1 chromium-desktop-gnome-44.0.2403.89-93.1 chromium-desktop-kde-44.0.2403.89-93.1 chromium-ffmpegsumo-44.0.2403.89-93.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-93.1 References: https://www.suse.com/security/cve/CVE-2015-1270.html https://www.suse.com/security/cve/CVE-2015-1271.html https://www.suse.com/security/cve/CVE-2015-1272.html https://www.suse.com/security/cve/CVE-2015-1273.html https://www.suse.com/security/cve/CVE-2015-1274.html https://www.suse.com/security/cve/CVE-2015-1275.html https://www.suse.com/security/cve/CVE-2015-1276.html https://www.suse.com/security/cve/CVE-2015-1277.html https://www.suse.com/security/cve/CVE-2015-1278.html https://www.suse.com/security/cve/CVE-2015-1279.html https://www.suse.com/security/cve/CVE-2015-1280.html https://www.suse.com/security/cve/CVE-2015-1281.html https://www.suse.com/security/cve/CVE-2015-1282.html https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2015-1284.html https://www.suse.com/security/cve/CVE-2015-1285.html https://www.suse.com/security/cve/CVE-2015-1286.html https://www.suse.com/security/cve/CVE-2015-1287.html https://www.suse.com/security/cve/CVE-2015-1288.html https://www.suse.com/security/cve/CVE-2015-1289.html https://www.suse.com/security/cve/CVE-2015-5605.html https://bugzilla.suse.com/939077 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1277-1: important: Security update for libressl
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1277-1 Rating: important References: #912015 #912018 #912292 #912293 #912296 #919648 #920236 #922496 #922499 #922500 #931600 #934487 #934489 #934491 #934493 #934494 #937891 Cross-References: CVE-2014-3570 CVE-2014-3572 CVE-2014-8176 CVE-2014-8275 CVE-2015-0205 CVE-2015-0206 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1792 CVE-2015-4000 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has one errata is now available. Description: libressl was updated to version 2.2.1 to fix 16 security issues. LibreSSL is a fork of OpenSSL. Because of that CVEs affecting OpenSSL often also affect LibreSSL. These security issues were fixed: - CVE-2014-3570: The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c (bsc#912296). - CVE-2014-3572: The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allowed remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message (bsc#912015). - CVE-2015-1792: The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function (bsc#934493). - CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not enforce certain constraints on certificate data, which allowed remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c (bsc#912018). - CVE-2015-0209: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import (bsc#919648). - CVE-2015-1789: The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback (bsc#934489). - CVE-2015-1788: The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b did not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allowed remote attackers to cause a denial of service (infinite loop) via a session that used an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication (bsc#934487). - CVE-2015-1790: The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that used ASN.1 encoding and lacks inner EncryptedContent data (bsc#934491). - CVE-2015-0287: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not reinitialize CHOICE and ADB data structures, which might allowed attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse (bsc#922499). - CVE-2015-0286: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly perform boolean-type comparisons, which allowed remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that used the certificate-verification feature (bsc#922496). - CVE-2015-0289: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly handle a lack of outer ContentInfo, which allowed attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c (bsc#922500). - CVE-2015-0288: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key (bsc#920236). - CVE-2014-8176: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allowed remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data (bsc#934494). - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue (bsc#931600). - CVE-2015-0205: The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allowed remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support (bsc#912293). - CVE-2015-0206: Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allowed remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection (bsc#912292). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-507=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcrypto34-2.2.1-2.3.1 libcrypto34-debuginfo-2.2.1-2.3.1 libressl-2.2.1-2.3.1 libressl-debuginfo-2.2.1-2.3.1 libressl-debugsource-2.2.1-2.3.1 libressl-devel-2.2.1-2.3.1 libssl33-2.2.1-2.3.1 libssl33-debuginfo-2.2.1-2.3.1 libtls4-2.2.1-2.3.1 libtls4-debuginfo-2.2.1-2.3.1 - openSUSE 13.2 (x86_64): libcrypto34-32bit-2.2.1-2.3.1 libcrypto34-debuginfo-32bit-2.2.1-2.3.1 libressl-devel-32bit-2.2.1-2.3.1 libssl33-32bit-2.2.1-2.3.1 libssl33-debuginfo-32bit-2.2.1-2.3.1 libtls4-32bit-2.2.1-2.3.1 libtls4-debuginfo-32bit-2.2.1-2.3.1 - openSUSE 13.2 (noarch): libressl-devel-doc-2.2.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-3570.html https://www.suse.com/security/cve/CVE-2014-3572.html https://www.suse.com/security/cve/CVE-2014-8176.html https://www.suse.com/security/cve/CVE-2014-8275.html https://www.suse.com/security/cve/CVE-2015-0205.html https://www.suse.com/security/cve/CVE-2015-0206.html https://www.suse.com/security/cve/CVE-2015-0209.html https://www.suse.com/security/cve/CVE-2015-0286.html https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-0288.html https://www.suse.com/security/cve/CVE-2015-0289.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/912015 https://bugzilla.suse.com/912018 https://bugzilla.suse.com/912292 https://bugzilla.suse.com/912293 https://bugzilla.suse.com/912296 https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 https://bugzilla.suse.com/931600 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 https://bugzilla.suse.com/937891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1273-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 21 Jul '15

21 Jul '15

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1273-1 Rating: important References: #906574 #919053 #919062 #920865 #920896 #921333 #924663 #924960 #924961 #934789 #936407 #936408 #936409 Cross-References: CVE-2014-8964 CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2325 CVE-2015-2326 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-3152 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: * Logjam attack: mysql uses 512 bit dh groups in SSL [bnc#934789] * CVE-2015-3152: mysql --ssl does not enforce SSL [bnc#924663] * CVE-2014-8964: heap buffer overflow [bnc#906574] * CVE-2015-2325: heap buffer overflow in compile_branch() [bnc#924960] * CVE-2015-2326: heap buffer overflow in pcre_compile2() [bnc#924961] * CVE-2015-0501: unspecified vulnerability related to Server:Compiling (CPU April 2015) * CVE-2015-2571: unspecified vulnerability related to Server:Optimizer (CPU April 2015) * CVE-2015-0505: unspecified vulnerability related to Server:DDL (CPU April 2015) * CVE-2015-0499: unspecified vulnerability related to Server:Federated (CPU April 2015) * CVE-2015-2568: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015) * CVE-2015-2573: unspecified vulnerability related to Server:DDL (CPU April 2015) * CVE-2015-0433: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015) * CVE-2015-0441: unspecified vulnerability related to Server:Security:Encryption (CPU April 2015) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-332=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-332=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-332=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-332=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): libmysqlclient_r18-10.0.20-18.1 libmysqlclient_r18-32bit-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libmysqlclient-devel-10.0.20-18.1 libmysqlclient_r18-10.0.20-18.1 libmysqld-devel-10.0.20-18.1 libmysqld18-10.0.20-18.1 libmysqld18-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libmysqlclient18-10.0.20-18.1 libmysqlclient18-debuginfo-10.0.20-18.1 mariadb-10.0.20-18.1 mariadb-client-10.0.20-18.1 mariadb-client-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 mariadb-errormessages-10.0.20-18.1 mariadb-tools-10.0.20-18.1 mariadb-tools-debuginfo-10.0.20-18.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libmysqlclient18-32bit-10.0.20-18.1 libmysqlclient18-debuginfo-32bit-10.0.20-18.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libmysqlclient18-10.0.20-18.1 libmysqlclient18-32bit-10.0.20-18.1 libmysqlclient18-debuginfo-10.0.20-18.1 libmysqlclient18-debuginfo-32bit-10.0.20-18.1 libmysqlclient_r18-10.0.20-18.1 libmysqlclient_r18-32bit-10.0.20-18.1 mariadb-10.0.20-18.1 mariadb-client-10.0.20-18.1 mariadb-client-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 mariadb-errormessages-10.0.20-18.1 References: https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-0433.html https://www.suse.com/security/cve/CVE-2015-0441.html https://www.suse.com/security/cve/CVE-2015-0499.html https://www.suse.com/security/cve/CVE-2015-0501.html https://www.suse.com/security/cve/CVE-2015-0505.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2326.html https://www.suse.com/security/cve/CVE-2015-2568.html https://www.suse.com/security/cve/CVE-2015-2571.html https://www.suse.com/security/cve/CVE-2015-2573.html https://www.suse.com/security/cve/CVE-2015-3152.html https://bugzilla.suse.com/906574 https://bugzilla.suse.com/919053 https://bugzilla.suse.com/919062 https://bugzilla.suse.com/920865 https://bugzilla.suse.com/920896 https://bugzilla.suse.com/921333 https://bugzilla.suse.com/924663 https://bugzilla.suse.com/924960 https://bugzilla.suse.com/924961 https://bugzilla.suse.com/934789 https://bugzilla.suse.com/936407 https://bugzilla.suse.com/936408 https://bugzilla.suse.com/936409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1268-2: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1268-2 Rating: important References: #908275 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). This non-security issue was fixed: - bsc#908275: Firefox did not print in landscape orientation. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-201507-12001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-31.8.0esr-0.10.1 mozilla-nspr-devel-4.10.8-0.5.1 mozilla-nss-devel-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-31.8.0esr-0.10.1 mozilla-nspr-devel-4.10.8-0.5.1 mozilla-nss-devel-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (i586 s390x x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libfreebl3-x86-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-x86-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-x86-4.10.8-0.5.1 mozilla-nss-x86-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-0.10.1 MozillaFirefox-debugsource-31.8.0esr-0.10.1 mozilla-nspr-debuginfo-4.10.8-0.5.1 mozilla-nspr-debugsource-4.10.8-0.5.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64): mozilla-nspr-debuginfo-32bit-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64): mozilla-nspr-debuginfo-x86-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-0.10.1 MozillaFirefox-debugsource-31.8.0esr-0.10.1 mozilla-nspr-debuginfo-4.10.8-0.5.1 mozilla-nspr-debugsource-4.10.8-0.5.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ppc64 s390x x86_64): mozilla-nspr-debuginfo-32bit-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ia64): mozilla-nspr-debuginfo-x86-4.10.8-0.5.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/908275 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1269-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1269-1 Rating: important References: #856315 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-330=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-330=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-330=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-devel-31.8.0esr-37.3 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nspr-devel-4.10.8-3.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-devel-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-31.8.0esr-37.3 MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-translations-31.8.0esr-37.3 libfreebl3-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-3.19.2_CKBI_1.98-21.1 libfreebl3-hmac-3.19.2_CKBI_1.98-21.1 libsoftokn3-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-3.19.2_CKBI_1.98-21.1 libsoftokn3-hmac-3.19.2_CKBI_1.98-21.1 mozilla-nspr-4.10.8-3.1 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nss-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-debuginfo-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-hmac-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-hmac-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nspr-32bit-4.10.8-3.1 mozilla-nspr-debuginfo-32bit-4.10.8-3.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-31.8.0esr-37.3 MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-translations-31.8.0esr-37.3 libfreebl3-3.19.2_CKBI_1.98-21.1 libfreebl3-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-3.19.2_CKBI_1.98-21.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nspr-32bit-4.10.8-3.1 mozilla-nspr-4.10.8-3.1 mozilla-nspr-debuginfo-32bit-4.10.8-3.1 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nss-3.19.2_CKBI_1.98-21.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-debuginfo-3.19.2_CKBI_1.98-21.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/856315 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1268-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1268-1 Rating: important References: #908275 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). This non-security issue was fixed: - bsc#908275: Firefox did not print in landscape orientation. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-201507-12001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (ia64 ppc64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libfreebl3-x86-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-x86-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-x86-4.10.8-0.5.1 mozilla-nss-x86-3.19.2_CKBI_1.98-0.10.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/908275 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1267-1: critical: flash-player
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1267-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-502=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.491-173.1 flash-player-gnome-11.2.202.491-173.1 flash-player-kde4-11.2.202.491-173.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1266-1: important: Mozilla (Firefox/Thunderbird) updates to 31.8.0
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: Mozilla (Firefox/Thunderbird) updates to 31.8.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1266-1 Rating: important References: #894370 #900639 #900941 #908009 #910669 #917597 #925368 #930622 #935979 Cross-References: CVE-2011-3079 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0833 CVE-2015-0836 CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: Combined Mozilla update: - Update Firefox to 31.8.0 - Update Thunderbird to 31.8.0 - Update mozilla-nspr to 4.10.6 - Update mozilla-nss to 3.19.2 to fix several security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.8.0-143.1 MozillaFirefox-branding-upstream-31.8.0-143.1 MozillaFirefox-buildsymbols-31.8.0-143.1 MozillaFirefox-debuginfo-31.8.0-143.1 MozillaFirefox-debugsource-31.8.0-143.1 MozillaFirefox-devel-31.8.0-143.1 MozillaFirefox-translations-common-31.8.0-143.1 MozillaFirefox-translations-other-31.8.0-143.1 MozillaThunderbird-31.8.0-110.1 MozillaThunderbird-buildsymbols-31.8.0-110.1 MozillaThunderbird-debuginfo-31.8.0-110.1 MozillaThunderbird-debugsource-31.8.0-110.1 MozillaThunderbird-devel-31.8.0-110.1 MozillaThunderbird-translations-common-31.8.0-110.1 MozillaThunderbird-translations-other-31.8.0-110.1 libfreebl3-3.19.2-107.1 libfreebl3-debuginfo-3.19.2-107.1 libsoftokn3-3.19.2-107.1 libsoftokn3-debuginfo-3.19.2-107.1 mozilla-nspr-4.10.8-52.1 mozilla-nspr-debuginfo-4.10.8-52.1 mozilla-nspr-debugsource-4.10.8-52.1 mozilla-nspr-devel-4.10.8-52.1 mozilla-nss-3.19.2-107.1 mozilla-nss-certs-3.19.2-107.1 mozilla-nss-certs-debuginfo-3.19.2-107.1 mozilla-nss-debuginfo-3.19.2-107.1 mozilla-nss-debugsource-3.19.2-107.1 mozilla-nss-devel-3.19.2-107.1 mozilla-nss-sysinit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-3.19.2-107.1 mozilla-nss-tools-3.19.2-107.1 mozilla-nss-tools-debuginfo-3.19.2-107.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.19.2-107.1 libfreebl3-debuginfo-32bit-3.19.2-107.1 libsoftokn3-32bit-3.19.2-107.1 libsoftokn3-debuginfo-32bit-3.19.2-107.1 mozilla-nspr-32bit-4.10.8-52.1 mozilla-nspr-debuginfo-32bit-4.10.8-52.1 mozilla-nss-32bit-3.19.2-107.1 mozilla-nss-certs-32bit-3.19.2-107.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-107.1 mozilla-nss-debuginfo-32bit-3.19.2-107.1 mozilla-nss-sysinit-32bit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-107.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.19.2-107.1 libfreebl3-x86-3.19.2-107.1 libsoftokn3-debuginfo-x86-3.19.2-107.1 libsoftokn3-x86-3.19.2-107.1 mozilla-nspr-debuginfo-x86-4.10.8-52.1 mozilla-nspr-x86-4.10.8-52.1 mozilla-nss-certs-debuginfo-x86-3.19.2-107.1 mozilla-nss-certs-x86-3.19.2-107.1 mozilla-nss-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-x86-3.19.2-107.1 mozilla-nss-x86-3.19.2-107.1 References: https://www.suse.com/security/cve/CVE-2011-3079.html https://www.suse.com/security/cve/CVE-2014-1553.html https://www.suse.com/security/cve/CVE-2014-1562.html https://www.suse.com/security/cve/CVE-2014-1563.html https://www.suse.com/security/cve/CVE-2014-1564.html https://www.suse.com/security/cve/CVE-2014-1565.html https://www.suse.com/security/cve/CVE-2014-1567.html https://www.suse.com/security/cve/CVE-2014-1574.html https://www.suse.com/security/cve/CVE-2014-1576.html https://www.suse.com/security/cve/CVE-2014-1577.html https://www.suse.com/security/cve/CVE-2014-1578.html https://www.suse.com/security/cve/CVE-2014-1581.html https://www.suse.com/security/cve/CVE-2014-1585.html https://www.suse.com/security/cve/CVE-2014-1586.html https://www.suse.com/security/cve/CVE-2014-1587.html https://www.suse.com/security/cve/CVE-2014-1590.html https://www.suse.com/security/cve/CVE-2014-1592.html https://www.suse.com/security/cve/CVE-2014-1593.html https://www.suse.com/security/cve/CVE-2014-1594.html https://www.suse.com/security/cve/CVE-2014-8634.html https://www.suse.com/security/cve/CVE-2014-8635.html https://www.suse.com/security/cve/CVE-2014-8638.html https://www.suse.com/security/cve/CVE-2014-8639.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://www.suse.com/security/cve/CVE-2015-0822.html https://www.suse.com/security/cve/CVE-2015-0827.html https://www.suse.com/security/cve/CVE-2015-0831.html https://www.suse.com/security/cve/CVE-2015-0833.html https://www.suse.com/security/cve/CVE-2015-0836.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/894370 https://bugzilla.suse.com/900639 https://bugzilla.suse.com/900941 https://bugzilla.suse.com/908009 https://bugzilla.suse.com/910669 https://bugzilla.suse.com/917597 https://bugzilla.suse.com/925368 https://bugzilla.suse.com/930622 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1265-1: important: Security update for PHP
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for PHP ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1265-1 Rating: important References: #919080 #933227 #935074 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: The PHP script interpreter was updated to fix various security issues: * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. * CVE-2015-4148 [bnc#933227]: Fixed a SoapClient's do_soap_call() type confusion after unserialize() information disclosure. Also the following bug were fixed: * fix a segmentation fault in odbc_fetch_array [bnc#935074] * fix timezone map [bnc#919080] Security Issues: * CVE-2015-3411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3411> * CVE-2015-3412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3412> * CVE-2015-4148 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4148> * CVE-2015-4598 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4598> * CVE-2015-4599 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4599> * CVE-2015-4600 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4600> * CVE-2015-4601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4601> * CVE-2015-4602 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4602> * CVE-2015-4603 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4603> * CVE-2015-4643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4643> * CVE-2015-4644 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4644> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-apache2-mod_php53=10811 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-apache2-mod_php53=10811 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-apache2-mod_php53=10811 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-0.43.1 php53-imap-5.3.17-0.43.1 php53-posix-5.3.17-0.43.1 php53-readline-5.3.17-0.43.1 php53-sockets-5.3.17-0.43.1 php53-sqlite-5.3.17-0.43.1 php53-tidy-5.3.17-0.43.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): apache2-mod_php53-5.3.17-0.43.1 php53-5.3.17-0.43.1 php53-bcmath-5.3.17-0.43.1 php53-bz2-5.3.17-0.43.1 php53-calendar-5.3.17-0.43.1 php53-ctype-5.3.17-0.43.1 php53-curl-5.3.17-0.43.1 php53-dba-5.3.17-0.43.1 php53-dom-5.3.17-0.43.1 php53-exif-5.3.17-0.43.1 php53-fastcgi-5.3.17-0.43.1 php53-fileinfo-5.3.17-0.43.1 php53-ftp-5.3.17-0.43.1 php53-gd-5.3.17-0.43.1 php53-gettext-5.3.17-0.43.1 php53-gmp-5.3.17-0.43.1 php53-iconv-5.3.17-0.43.1 php53-intl-5.3.17-0.43.1 php53-json-5.3.17-0.43.1 php53-ldap-5.3.17-0.43.1 php53-mbstring-5.3.17-0.43.1 php53-mcrypt-5.3.17-0.43.1 php53-mysql-5.3.17-0.43.1 php53-odbc-5.3.17-0.43.1 php53-openssl-5.3.17-0.43.1 php53-pcntl-5.3.17-0.43.1 php53-pdo-5.3.17-0.43.1 php53-pear-5.3.17-0.43.1 php53-pgsql-5.3.17-0.43.1 php53-pspell-5.3.17-0.43.1 php53-shmop-5.3.17-0.43.1 php53-snmp-5.3.17-0.43.1 php53-soap-5.3.17-0.43.1 php53-suhosin-5.3.17-0.43.1 php53-sysvmsg-5.3.17-0.43.1 php53-sysvsem-5.3.17-0.43.1 php53-sysvshm-5.3.17-0.43.1 php53-tokenizer-5.3.17-0.43.1 php53-wddx-5.3.17-0.43.1 php53-xmlreader-5.3.17-0.43.1 php53-xmlrpc-5.3.17-0.43.1 php53-xmlwriter-5.3.17-0.43.1 php53-xsl-5.3.17-0.43.1 php53-zip-5.3.17-0.43.1 php53-zlib-5.3.17-0.43.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-0.43.1 php53-5.3.17-0.43.1 php53-bcmath-5.3.17-0.43.1 php53-bz2-5.3.17-0.43.1 php53-calendar-5.3.17-0.43.1 php53-ctype-5.3.17-0.43.1 php53-curl-5.3.17-0.43.1 php53-dba-5.3.17-0.43.1 php53-dom-5.3.17-0.43.1 php53-exif-5.3.17-0.43.1 php53-fastcgi-5.3.17-0.43.1 php53-fileinfo-5.3.17-0.43.1 php53-ftp-5.3.17-0.43.1 php53-gd-5.3.17-0.43.1 php53-gettext-5.3.17-0.43.1 php53-gmp-5.3.17-0.43.1 php53-iconv-5.3.17-0.43.1 php53-intl-5.3.17-0.43.1 php53-json-5.3.17-0.43.1 php53-ldap-5.3.17-0.43.1 php53-mbstring-5.3.17-0.43.1 php53-mcrypt-5.3.17-0.43.1 php53-mysql-5.3.17-0.43.1 php53-odbc-5.3.17-0.43.1 php53-openssl-5.3.17-0.43.1 php53-pcntl-5.3.17-0.43.1 php53-pdo-5.3.17-0.43.1 php53-pear-5.3.17-0.43.1 php53-pgsql-5.3.17-0.43.1 php53-pspell-5.3.17-0.43.1 php53-shmop-5.3.17-0.43.1 php53-snmp-5.3.17-0.43.1 php53-soap-5.3.17-0.43.1 php53-suhosin-5.3.17-0.43.1 php53-sysvmsg-5.3.17-0.43.1 php53-sysvsem-5.3.17-0.43.1 php53-sysvshm-5.3.17-0.43.1 php53-tokenizer-5.3.17-0.43.1 php53-wddx-5.3.17-0.43.1 php53-xmlreader-5.3.17-0.43.1 php53-xmlrpc-5.3.17-0.43.1 php53-xmlwriter-5.3.17-0.43.1 php53-xsl-5.3.17-0.43.1 php53-zip-5.3.17-0.43.1 php53-zlib-5.3.17-0.43.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935074 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 https://download.suse.com/patch/finder/?keywords=81cfeb3c78f7d93b7833bcf7ec… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1258-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1258-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-12002=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-flash-player-12002=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.491-0.11.1 flash-player-gnome-11.2.202.491-0.11.1 flash-player-kde4-11.2.202.491-0.11.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): flash-player-11.2.202.491-0.11.1 flash-player-gnome-11.2.202.491-0.11.1 flash-player-kde4-11.2.202.491-0.11.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1255-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1255-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-323=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-323=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.491-96.1 flash-player-gnome-11.2.202.491-96.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.491-96.1 flash-player-gnome-11.2.202.491-96.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1253-2: important: Security update for php5
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1253-2 Rating: important References: #919080 #927147 #931421 #931769 #931772 #931776 #933227 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4026 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This security update of PHP fixes the following issues: Security issues fixed: * CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. * CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. * CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. * CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. * CVE-2015-4148 [bnc#933227]: Fixed SoapClient's do_soap_call() type confusion after unserialize() information disclosure. * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Bugs fixed: * configure php-fpm with --localstatedir=/var [bnc#927147] * fix timezone map [bnc#919080] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-322=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le): apache2-mod_php5-5.5.14-30.1 apache2-mod_php5-debuginfo-5.5.14-30.1 php5-5.5.14-30.1 php5-bcmath-5.5.14-30.1 php5-bcmath-debuginfo-5.5.14-30.1 php5-bz2-5.5.14-30.1 php5-bz2-debuginfo-5.5.14-30.1 php5-calendar-5.5.14-30.1 php5-calendar-debuginfo-5.5.14-30.1 php5-ctype-5.5.14-30.1 php5-ctype-debuginfo-5.5.14-30.1 php5-curl-5.5.14-30.1 php5-curl-debuginfo-5.5.14-30.1 php5-dba-5.5.14-30.1 php5-dba-debuginfo-5.5.14-30.1 php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-dom-5.5.14-30.1 php5-dom-debuginfo-5.5.14-30.1 php5-enchant-5.5.14-30.1 php5-enchant-debuginfo-5.5.14-30.1 php5-exif-5.5.14-30.1 php5-exif-debuginfo-5.5.14-30.1 php5-fastcgi-5.5.14-30.1 php5-fastcgi-debuginfo-5.5.14-30.1 php5-fileinfo-5.5.14-30.1 php5-fileinfo-debuginfo-5.5.14-30.1 php5-fpm-5.5.14-30.1 php5-fpm-debuginfo-5.5.14-30.1 php5-ftp-5.5.14-30.1 php5-ftp-debuginfo-5.5.14-30.1 php5-gd-5.5.14-30.1 php5-gd-debuginfo-5.5.14-30.1 php5-gettext-5.5.14-30.1 php5-gettext-debuginfo-5.5.14-30.1 php5-gmp-5.5.14-30.1 php5-gmp-debuginfo-5.5.14-30.1 php5-iconv-5.5.14-30.1 php5-iconv-debuginfo-5.5.14-30.1 php5-intl-5.5.14-30.1 php5-intl-debuginfo-5.5.14-30.1 php5-json-5.5.14-30.1 php5-json-debuginfo-5.5.14-30.1 php5-ldap-5.5.14-30.1 php5-ldap-debuginfo-5.5.14-30.1 php5-mbstring-5.5.14-30.1 php5-mbstring-debuginfo-5.5.14-30.1 php5-mcrypt-5.5.14-30.1 php5-mcrypt-debuginfo-5.5.14-30.1 php5-mysql-5.5.14-30.1 php5-mysql-debuginfo-5.5.14-30.1 php5-odbc-5.5.14-30.1 php5-odbc-debuginfo-5.5.14-30.1 php5-openssl-5.5.14-30.1 php5-openssl-debuginfo-5.5.14-30.1 php5-pcntl-5.5.14-30.1 php5-pcntl-debuginfo-5.5.14-30.1 php5-pdo-5.5.14-30.1 php5-pdo-debuginfo-5.5.14-30.1 php5-pgsql-5.5.14-30.1 php5-pgsql-debuginfo-5.5.14-30.1 php5-pspell-5.5.14-30.1 php5-pspell-debuginfo-5.5.14-30.1 php5-shmop-5.5.14-30.1 php5-shmop-debuginfo-5.5.14-30.1 php5-snmp-5.5.14-30.1 php5-snmp-debuginfo-5.5.14-30.1 php5-soap-5.5.14-30.1 php5-soap-debuginfo-5.5.14-30.1 php5-sockets-5.5.14-30.1 php5-sockets-debuginfo-5.5.14-30.1 php5-sqlite-5.5.14-30.1 php5-sqlite-debuginfo-5.5.14-30.1 php5-suhosin-5.5.14-30.1 php5-suhosin-debuginfo-5.5.14-30.1 php5-sysvmsg-5.5.14-30.1 php5-sysvmsg-debuginfo-5.5.14-30.1 php5-sysvsem-5.5.14-30.1 php5-sysvsem-debuginfo-5.5.14-30.1 php5-sysvshm-5.5.14-30.1 php5-sysvshm-debuginfo-5.5.14-30.1 php5-tokenizer-5.5.14-30.1 php5-tokenizer-debuginfo-5.5.14-30.1 php5-wddx-5.5.14-30.1 php5-wddx-debuginfo-5.5.14-30.1 php5-xmlreader-5.5.14-30.1 php5-xmlreader-debuginfo-5.5.14-30.1 php5-xmlrpc-5.5.14-30.1 php5-xmlrpc-debuginfo-5.5.14-30.1 php5-xmlwriter-5.5.14-30.1 php5-xmlwriter-debuginfo-5.5.14-30.1 php5-xsl-5.5.14-30.1 php5-xsl-debuginfo-5.5.14-30.1 php5-zip-5.5.14-30.1 php5-zip-debuginfo-5.5.14-30.1 php5-zlib-5.5.14-30.1 php5-zlib-debuginfo-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-30.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4021.html https://www.suse.com/security/cve/CVE-2015-4022.html https://www.suse.com/security/cve/CVE-2015-4024.html https://www.suse.com/security/cve/CVE-2015-4026.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/927147 https://bugzilla.suse.com/931421 https://bugzilla.suse.com/931769 https://bugzilla.suse.com/931772 https://bugzilla.suse.com/931776 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1253-1: important: Security update for php5
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1253-1 Rating: important References: #919080 #927147 #931421 #931769 #931772 #931776 #933227 #935224 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4026 CVE-2015-4148 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4643 CVE-2015-4644 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This security update of PHP fixes the following issues: Security issues fixed: * CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. * CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. * CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. * CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. * CVE-2015-4148 [bnc#933227]: Fixed SoapClient's do_soap_call() type confusion after unserialize() information disclosure. * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Bugs fixed: * configure php-fpm with --localstatedir=/var [bnc#927147] * fix timezone map [bnc#919080] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-322=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-322=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-devel-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (s390x x86_64): apache2-mod_php5-5.5.14-30.1 apache2-mod_php5-debuginfo-5.5.14-30.1 php5-5.5.14-30.1 php5-bcmath-5.5.14-30.1 php5-bcmath-debuginfo-5.5.14-30.1 php5-bz2-5.5.14-30.1 php5-bz2-debuginfo-5.5.14-30.1 php5-calendar-5.5.14-30.1 php5-calendar-debuginfo-5.5.14-30.1 php5-ctype-5.5.14-30.1 php5-ctype-debuginfo-5.5.14-30.1 php5-curl-5.5.14-30.1 php5-curl-debuginfo-5.5.14-30.1 php5-dba-5.5.14-30.1 php5-dba-debuginfo-5.5.14-30.1 php5-debuginfo-5.5.14-30.1 php5-debugsource-5.5.14-30.1 php5-dom-5.5.14-30.1 php5-dom-debuginfo-5.5.14-30.1 php5-enchant-5.5.14-30.1 php5-enchant-debuginfo-5.5.14-30.1 php5-exif-5.5.14-30.1 php5-exif-debuginfo-5.5.14-30.1 php5-fastcgi-5.5.14-30.1 php5-fastcgi-debuginfo-5.5.14-30.1 php5-fileinfo-5.5.14-30.1 php5-fileinfo-debuginfo-5.5.14-30.1 php5-fpm-5.5.14-30.1 php5-fpm-debuginfo-5.5.14-30.1 php5-ftp-5.5.14-30.1 php5-ftp-debuginfo-5.5.14-30.1 php5-gd-5.5.14-30.1 php5-gd-debuginfo-5.5.14-30.1 php5-gettext-5.5.14-30.1 php5-gettext-debuginfo-5.5.14-30.1 php5-gmp-5.5.14-30.1 php5-gmp-debuginfo-5.5.14-30.1 php5-iconv-5.5.14-30.1 php5-iconv-debuginfo-5.5.14-30.1 php5-intl-5.5.14-30.1 php5-intl-debuginfo-5.5.14-30.1 php5-json-5.5.14-30.1 php5-json-debuginfo-5.5.14-30.1 php5-ldap-5.5.14-30.1 php5-ldap-debuginfo-5.5.14-30.1 php5-mbstring-5.5.14-30.1 php5-mbstring-debuginfo-5.5.14-30.1 php5-mcrypt-5.5.14-30.1 php5-mcrypt-debuginfo-5.5.14-30.1 php5-mysql-5.5.14-30.1 php5-mysql-debuginfo-5.5.14-30.1 php5-odbc-5.5.14-30.1 php5-odbc-debuginfo-5.5.14-30.1 php5-openssl-5.5.14-30.1 php5-openssl-debuginfo-5.5.14-30.1 php5-pcntl-5.5.14-30.1 php5-pcntl-debuginfo-5.5.14-30.1 php5-pdo-5.5.14-30.1 php5-pdo-debuginfo-5.5.14-30.1 php5-pgsql-5.5.14-30.1 php5-pgsql-debuginfo-5.5.14-30.1 php5-pspell-5.5.14-30.1 php5-pspell-debuginfo-5.5.14-30.1 php5-shmop-5.5.14-30.1 php5-shmop-debuginfo-5.5.14-30.1 php5-snmp-5.5.14-30.1 php5-snmp-debuginfo-5.5.14-30.1 php5-soap-5.5.14-30.1 php5-soap-debuginfo-5.5.14-30.1 php5-sockets-5.5.14-30.1 php5-sockets-debuginfo-5.5.14-30.1 php5-sqlite-5.5.14-30.1 php5-sqlite-debuginfo-5.5.14-30.1 php5-suhosin-5.5.14-30.1 php5-suhosin-debuginfo-5.5.14-30.1 php5-sysvmsg-5.5.14-30.1 php5-sysvmsg-debuginfo-5.5.14-30.1 php5-sysvsem-5.5.14-30.1 php5-sysvsem-debuginfo-5.5.14-30.1 php5-sysvshm-5.5.14-30.1 php5-sysvshm-debuginfo-5.5.14-30.1 php5-tokenizer-5.5.14-30.1 php5-tokenizer-debuginfo-5.5.14-30.1 php5-wddx-5.5.14-30.1 php5-wddx-debuginfo-5.5.14-30.1 php5-xmlreader-5.5.14-30.1 php5-xmlreader-debuginfo-5.5.14-30.1 php5-xmlrpc-5.5.14-30.1 php5-xmlrpc-debuginfo-5.5.14-30.1 php5-xmlwriter-5.5.14-30.1 php5-xmlwriter-debuginfo-5.5.14-30.1 php5-xsl-5.5.14-30.1 php5-xsl-debuginfo-5.5.14-30.1 php5-zip-5.5.14-30.1 php5-zip-debuginfo-5.5.14-30.1 php5-zlib-5.5.14-30.1 php5-zlib-debuginfo-5.5.14-30.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-30.1 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4021.html https://www.suse.com/security/cve/CVE-2015-4022.html https://www.suse.com/security/cve/CVE-2015-4024.html https://www.suse.com/security/cve/CVE-2015-4026.html https://www.suse.com/security/cve/CVE-2015-4148.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/919080 https://bugzilla.suse.com/927147 https://bugzilla.suse.com/931421 https://bugzilla.suse.com/931769 https://bugzilla.suse.com/931772 https://bugzilla.suse.com/931776 https://bugzilla.suse.com/933227 https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1229-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 13 Jul '15

13 Jul '15

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1229-1 Rating: important References: #932142 #933439 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: MozillaFirefox was updated to version 39.0 to fix 21 security issues. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2727: Local files or privileged URLs in pages can be opened into new tabs (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2729: Out-of-bound read while computing an oscillator rendering range in Web Audio (bsc#935979). - CVE-2015-2731: Use-after-free in Content Policy due to microtask execution error (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2741: Key pinning is ignored when overridable errors are encountered (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935979). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). New features: - Share Hello URLs with social networks - Support for 'switch' role in ARIA 1.1 (web accessibility) - SafeBrowsing malware detection lookups enabled for downloads (Mac OS X and Linux) - Support for new Unicode 8.0 skin tone emoji - Removed support for insecure SSLv3 for network communications - Disable use of RC4 except for temporarily whitelisted hosts - NPAPI Plug-in performance improved via asynchronous initialization mozilla-nss was updated to version 3.19.2 to fix some of the security issues listed above. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-480=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-480=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-39.0-34.2 MozillaFirefox-branding-upstream-39.0-34.2 MozillaFirefox-buildsymbols-39.0-34.2 MozillaFirefox-debuginfo-39.0-34.2 MozillaFirefox-debugsource-39.0-34.2 MozillaFirefox-devel-39.0-34.2 MozillaFirefox-translations-common-39.0-34.2 MozillaFirefox-translations-other-39.0-34.2 libfreebl3-3.19.2-16.1 libfreebl3-debuginfo-3.19.2-16.1 libsoftokn3-3.19.2-16.1 libsoftokn3-debuginfo-3.19.2-16.1 mozilla-nss-3.19.2-16.1 mozilla-nss-certs-3.19.2-16.1 mozilla-nss-certs-debuginfo-3.19.2-16.1 mozilla-nss-debuginfo-3.19.2-16.1 mozilla-nss-debugsource-3.19.2-16.1 mozilla-nss-devel-3.19.2-16.1 mozilla-nss-sysinit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-3.19.2-16.1 mozilla-nss-tools-3.19.2-16.1 mozilla-nss-tools-debuginfo-3.19.2-16.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.19.2-16.1 libfreebl3-debuginfo-32bit-3.19.2-16.1 libsoftokn3-32bit-3.19.2-16.1 libsoftokn3-debuginfo-32bit-3.19.2-16.1 mozilla-nss-32bit-3.19.2-16.1 mozilla-nss-certs-32bit-3.19.2-16.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-16.1 mozilla-nss-debuginfo-32bit-3.19.2-16.1 mozilla-nss-sysinit-32bit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-16.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-39.0-78.1 MozillaFirefox-branding-upstream-39.0-78.1 MozillaFirefox-buildsymbols-39.0-78.1 MozillaFirefox-debuginfo-39.0-78.1 MozillaFirefox-debugsource-39.0-78.1 MozillaFirefox-devel-39.0-78.1 MozillaFirefox-translations-common-39.0-78.1 MozillaFirefox-translations-other-39.0-78.1 libfreebl3-3.19.2-59.1 libfreebl3-debuginfo-3.19.2-59.1 libsoftokn3-3.19.2-59.1 libsoftokn3-debuginfo-3.19.2-59.1 mozilla-nss-3.19.2-59.1 mozilla-nss-certs-3.19.2-59.1 mozilla-nss-certs-debuginfo-3.19.2-59.1 mozilla-nss-debuginfo-3.19.2-59.1 mozilla-nss-debugsource-3.19.2-59.1 mozilla-nss-devel-3.19.2-59.1 mozilla-nss-sysinit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-3.19.2-59.1 mozilla-nss-tools-3.19.2-59.1 mozilla-nss-tools-debuginfo-3.19.2-59.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.19.2-59.1 libfreebl3-debuginfo-32bit-3.19.2-59.1 libsoftokn3-32bit-3.19.2-59.1 libsoftokn3-debuginfo-32bit-3.19.2-59.1 mozilla-nss-32bit-3.19.2-59.1 mozilla-nss-certs-32bit-3.19.2-59.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-59.1 mozilla-nss-debuginfo-32bit-3.19.2-59.1 mozilla-nss-sysinit-32bit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-59.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2727.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2729.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2731.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2741.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/932142 https://bugzilla.suse.com/933439 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1177-2: important: Security update for MySQL
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1177-2 Rating: important References: #934789 Cross-References: CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This MySQL update fixes the following security issue: * Logjam Attack: MySQL uses 512 bit DH groups in SSL connections. (bsc#934789) Security Issues: * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libmysqlclient-devel=10835 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libmysqlclient-devel=10834 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.8.8.2 libmysqlclient_r15-5.0.96-0.8.8.2 mysql-5.0.96-0.8.8.2 mysql-Max-5.0.96-0.8.8.2 mysql-client-5.0.96-0.8.8.2 mysql-tools-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.8.8.2 libmysqlclient_r15-5.0.96-0.8.8.2 mysql-5.0.96-0.8.8.2 mysql-Max-5.0.96-0.8.8.2 mysql-client-5.0.96-0.8.8.2 mysql-tools-5.0.96-0.8.8.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.8.8.2 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/934789 https://download.suse.com/patch/finder/?keywords=981d8f54c6495496c156cd451d… https://download.suse.com/patch/finder/?keywords=9bf49a65c370d89b69d6200ce0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1224-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1224-1 Rating: important References: #915517 #919007 #922583 #923908 #927355 #929525 #929647 #930786 #933429 #933896 #933904 #933907 #935705 #936831 Affected Products: SUSE Linux Enterprise Server 11-SP3-TERADATA ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following bugs and security issues. The following security issues have been fixed: - Update patches.fixes/udp-fix-behavior-of-wrong-checksums.patch (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Btrfs: make xattr replace operations atomic (bnc#923908, CVE-2014-9710). - udp: fix behavior of wrong checksums (bsc#936831, CVE-2015-5364, CVE-2015-5366). - vfs: read file_handle only once in handle_to_path (bsc#915517, CVE-2015-1420). - x86: bpf_jit: fix compilation of large bpf programs (bnc#935705,CVE-2015-4700). - udf: Check length of extended attributes and allocation (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Update patches.fixes/udf-Check-component-length-before-reading-it.patch (bsc#933904, CVE-2014-9728, CVE-2014-9730). - Update patches.fixes/udf-Verify-i_size-when-loading-inode.patch (bsc#933904, CVE-2014-9728, CVE-2014-9729). - Update patches.fixes/udf-Verify-symlink-size-before-loading-it.patch (bsc#933904, CVE-2014-9728). - Update patches.fixes/udf-Check-path-length-when-reading-symlink.patch (bnc#933896, CVE-2014-9731). - pipe: fix iov overrun for failed atomic copy (bsc#933429, CVE-2015-1805). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). The following non-security issues have been fixed: - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - net/mlx4_core: Don't disable SRIOV if there are active VFs (bsc#927355). - udf: Remove repeated loads blocksize (bsc#933907). - Refresh patches.fixes/deal-with-deadlock-in-d_walk-fix.patch. based on 3.2 stable fix 20defcec264c ("dcache: Fix locking bugs in backported "deal with deadlock in d_walk()""). Not harmfull for regular SLES kernels but RT or PREEMPT kernels would see disbalance. - sched: Fix potential near-infinite distribute_cfs_runtime() loop (bnc#930786) - tty: Correct tty buffer flush (bnc#929647). - tty: hold lock across tty buffer finding and buffer filling (bnc#929647). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-TERADATA: zypper in -t patch slessp3-kernel-201507-2=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-TERADATA (x86_64): kernel-default-3.0.101-57.TDC.2 kernel-default-base-3.0.101-57.TDC.2 kernel-default-devel-3.0.101-57.TDC.2 kernel-source-3.0.101-57.TDC.2 kernel-syms-3.0.101-57.TDC.2 kernel-trace-3.0.101-57.TDC.2 kernel-trace-base-3.0.101-57.TDC.2 kernel-trace-devel-3.0.101-57.TDC.2 kernel-xen-3.0.101-57.TDC.2 kernel-xen-base-3.0.101-57.TDC.2 kernel-xen-devel-3.0.101-57.TDC.2 References: https://bugzilla.suse.com/915517 https://bugzilla.suse.com/919007 https://bugzilla.suse.com/922583 https://bugzilla.suse.com/923908 https://bugzilla.suse.com/927355 https://bugzilla.suse.com/929525 https://bugzilla.suse.com/929647 https://bugzilla.suse.com/930786 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/933896 https://bugzilla.suse.com/933904 https://bugzilla.suse.com/933907 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/936831 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1207-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1207-1 Rating: critical References: #937339 Cross-References: CVE-2015-5119 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2015-5119: Unspecified vulnerability allowing remote attackers to take over the system (bsc#937339). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-473=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-473=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.481-2.61.1 flash-player-gnome-11.2.202.481-2.61.1 flash-player-kde4-11.2.202.481-2.61.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.481-126.1 flash-player-gnome-11.2.202.481-126.1 flash-player-kde4-11.2.202.481-126.1 References: https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

2 1

[security-announce] openSUSE not affected by OpenSSL CVE-2015-1793
by Andreas Stieger 09 Jul '15

09 Jul '15

Dear openSUSE users, The OpenSSL Project recently pre-announced [1], and how has released [2] an advisory for a security issue with a severity rated "high". This was picked up in various news articles [3] [4]. A detail which was not known to the general public at the time when these were written was that the issue affects 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o specifically. The fixed releases are 1.0.1p and 1.0.2d, and CVE-2015-1793 was assigned to the issue. The OpenSSL versions shipped in openSUSE 13.1 and 13.2 are not affected. The openSUSE Tumbleweed distribution never received a vulnerable version and was never affected. The next submission into Factory will skip any vulnerable versions. We have updated the Bugzilla entry [5] and CVE page [6] to that effect. [1] https://mta.openssl.org/pipermail/openssl-announce/2015-July/000037.html [2] https://www.openssl.org/news/secadv_20150709.txt [3] http://www.heise.de/security/meldung/Kritischer-OpenSSL-Patch-voraus-273980… [4] http://www.securityweek.com/openssl-preparing-updates-patch-high-severity-v… [5] https://bugzilla.opensuse.org/show_bug.cgi?id=CVE-2015-1793 [6] https://www.suse.com/security/cve/CVE-2015-1793.html On behalf of the SUSE Security team, Andreas Stieger -- Andreas Stieger <astieger(a)suse.com> Project Manager Security SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg)

2 1

[security-announce] openSUSE-SU-2015:1216-1: important: Security update for MariaDB
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

openSUSE Security Update: Security update for MariaDB ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1216-1 Rating: important References: #859345 #914370 #924663 #934789 #936407 #936408 #936409 Cross-References: CVE-2014-6464 CVE-2014-6469 CVE-2014-6491 CVE-2014-6494 CVE-2014-6496 CVE-2014-6500 CVE-2014-6507 CVE-2014-6555 CVE-2014-6559 CVE-2014-6568 CVE-2014-8964 CVE-2015-0374 CVE-2015-0381 CVE-2015-0382 CVE-2015-0411 CVE-2015-0432 CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2325 CVE-2015-2326 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-3152 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: MariaDB was updated to its current minor version, fixing bugs and security issues. These updates include a fix for Logjam (CVE-2015-4000), making MariaDB work with client software that no longer allows short DH groups over SSL, as e.g. our current openssl packages. On openSUSE 13.1, MariaDB was updated to 5.5.44. On openSUSE 13.2, MariaDB was updated from 10.0.13 to 10.0.20. Please read the release notes of MariaDB https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10019-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10017-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10016-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10015-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10014-release-notes/ for more information. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-479=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-479=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysqlclient-devel-10.0.20-2.9.1 libmysqlclient18-10.0.20-2.9.1 libmysqlclient18-debuginfo-10.0.20-2.9.1 libmysqlclient_r18-10.0.20-2.9.1 libmysqld-devel-10.0.20-2.9.1 libmysqld18-10.0.20-2.9.1 libmysqld18-debuginfo-10.0.20-2.9.1 mariadb-10.0.20-2.9.1 mariadb-bench-10.0.20-2.9.1 mariadb-bench-debuginfo-10.0.20-2.9.1 mariadb-client-10.0.20-2.9.1 mariadb-client-debuginfo-10.0.20-2.9.1 mariadb-debuginfo-10.0.20-2.9.1 mariadb-debugsource-10.0.20-2.9.1 mariadb-errormessages-10.0.20-2.9.1 mariadb-test-10.0.20-2.9.1 mariadb-test-debuginfo-10.0.20-2.9.1 mariadb-tools-10.0.20-2.9.1 mariadb-tools-debuginfo-10.0.20-2.9.1 - openSUSE 13.2 (x86_64): libmysqlclient18-32bit-10.0.20-2.9.1 libmysqlclient18-debuginfo-32bit-10.0.20-2.9.1 libmysqlclient_r18-32bit-10.0.20-2.9.1 - openSUSE 13.1 (i586 x86_64): libmysqlclient-devel-5.5.44-4.1 libmysqlclient18-5.5.44-4.1 libmysqlclient18-debuginfo-5.5.44-4.1 libmysqlclient_r18-5.5.44-4.1 libmysqld-devel-5.5.44-4.1 libmysqld18-5.5.44-4.1 libmysqld18-debuginfo-5.5.44-4.1 mariadb-5.5.44-4.1 mariadb-bench-5.5.44-4.1 mariadb-bench-debuginfo-5.5.44-4.1 mariadb-client-5.5.44-4.1 mariadb-client-debuginfo-5.5.44-4.1 mariadb-debuginfo-5.5.44-4.1 mariadb-debugsource-5.5.44-4.1 mariadb-errormessages-5.5.44-4.1 mariadb-test-5.5.44-4.1 mariadb-test-debuginfo-5.5.44-4.1 mariadb-tools-5.5.44-4.1 mariadb-tools-debuginfo-5.5.44-4.1 - openSUSE 13.1 (x86_64): libmysqlclient18-32bit-5.5.44-4.1 libmysqlclient18-debuginfo-32bit-5.5.44-4.1 libmysqlclient_r18-32bit-5.5.44-4.1 References: https://www.suse.com/security/cve/CVE-2014-6464.html https://www.suse.com/security/cve/CVE-2014-6469.html https://www.suse.com/security/cve/CVE-2014-6491.html https://www.suse.com/security/cve/CVE-2014-6494.html https://www.suse.com/security/cve/CVE-2014-6496.html https://www.suse.com/security/cve/CVE-2014-6500.html https://www.suse.com/security/cve/CVE-2014-6507.html https://www.suse.com/security/cve/CVE-2014-6555.html https://www.suse.com/security/cve/CVE-2014-6559.html https://www.suse.com/security/cve/CVE-2014-6568.html https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-0374.html https://www.suse.com/security/cve/CVE-2015-0381.html https://www.suse.com/security/cve/CVE-2015-0382.html https://www.suse.com/security/cve/CVE-2015-0411.html https://www.suse.com/security/cve/CVE-2015-0432.html https://www.suse.com/security/cve/CVE-2015-0433.html https://www.suse.com/security/cve/CVE-2015-0441.html https://www.suse.com/security/cve/CVE-2015-0499.html https://www.suse.com/security/cve/CVE-2015-0501.html https://www.suse.com/security/cve/CVE-2015-0505.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2326.html https://www.suse.com/security/cve/CVE-2015-2568.html https://www.suse.com/security/cve/CVE-2015-2571.html https://www.suse.com/security/cve/CVE-2015-2573.html https://www.suse.com/security/cve/CVE-2015-3152.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/859345 https://bugzilla.suse.com/914370 https://bugzilla.suse.com/924663 https://bugzilla.suse.com/934789 https://bugzilla.suse.com/936407 https://bugzilla.suse.com/936408 https://bugzilla.suse.com/936409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1214-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1214-1 Rating: critical References: #937339 Cross-References: CVE-2014-0578 CVE-2015-3114 CVE-2015-3115 CVE-2015-3116 CVE-2015-3117 CVE-2015-3118 CVE-2015-3119 CVE-2015-3120 CVE-2015-3121 CVE-2015-3122 CVE-2015-3123 CVE-2015-3124 CVE-2015-3125 CVE-2015-3126 CVE-2015-3127 CVE-2015-3128 CVE-2015-3129 CVE-2015-3130 CVE-2015-3131 CVE-2015-3132 CVE-2015-3133 CVE-2015-3134 CVE-2015-3135 CVE-2015-3136 CVE-2015-3137 CVE-2015-4428 CVE-2015-4429 CVE-2015-4430 CVE-2015-4431 CVE-2015-4432 CVE-2015-4433 CVE-2015-5116 CVE-2015-5117 CVE-2015-5118 CVE-2015-5119 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: flash-player was updated to fix 35 security issues. These security issues were fixed: - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer overflow vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory corruption vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3126, CVE-2015-4429: Null pointer dereference issues (bsc#937339). - CVE-2015-3114: A security bypass vulnerability that could lead to information disclosure (bsc#937339). - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433: Type confusion vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119: Use-after-free vulnerabilities that could lead to code execution (bsc#937339). - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (bsc#937339). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-20150708-1=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-flash-player-20150708-1=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.481-0.5.1 flash-player-gnome-11.2.202.481-0.5.1 flash-player-kde4-11.2.202.481-0.5.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): flash-player-11.2.202.481-0.5.1 flash-player-gnome-11.2.202.481-0.5.1 flash-player-kde4-11.2.202.481-0.5.1 References: https://www.suse.com/security/cve/CVE-2014-0578.html https://www.suse.com/security/cve/CVE-2015-3114.html https://www.suse.com/security/cve/CVE-2015-3115.html https://www.suse.com/security/cve/CVE-2015-3116.html https://www.suse.com/security/cve/CVE-2015-3117.html https://www.suse.com/security/cve/CVE-2015-3118.html https://www.suse.com/security/cve/CVE-2015-3119.html https://www.suse.com/security/cve/CVE-2015-3120.html https://www.suse.com/security/cve/CVE-2015-3121.html https://www.suse.com/security/cve/CVE-2015-3122.html https://www.suse.com/security/cve/CVE-2015-3123.html https://www.suse.com/security/cve/CVE-2015-3124.html https://www.suse.com/security/cve/CVE-2015-3125.html https://www.suse.com/security/cve/CVE-2015-3126.html https://www.suse.com/security/cve/CVE-2015-3127.html https://www.suse.com/security/cve/CVE-2015-3128.html https://www.suse.com/security/cve/CVE-2015-3129.html https://www.suse.com/security/cve/CVE-2015-3130.html https://www.suse.com/security/cve/CVE-2015-3131.html https://www.suse.com/security/cve/CVE-2015-3132.html https://www.suse.com/security/cve/CVE-2015-3133.html https://www.suse.com/security/cve/CVE-2015-3134.html https://www.suse.com/security/cve/CVE-2015-3135.html https://www.suse.com/security/cve/CVE-2015-3136.html https://www.suse.com/security/cve/CVE-2015-3137.html https://www.suse.com/security/cve/CVE-2015-4428.html https://www.suse.com/security/cve/CVE-2015-4429.html https://www.suse.com/security/cve/CVE-2015-4430.html https://www.suse.com/security/cve/CVE-2015-4431.html https://www.suse.com/security/cve/CVE-2015-4432.html https://www.suse.com/security/cve/CVE-2015-4433.html https://www.suse.com/security/cve/CVE-2015-5116.html https://www.suse.com/security/cve/CVE-2015-5117.html https://www.suse.com/security/cve/CVE-2015-5118.html https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1211-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1211-1 Rating: critical References: #937339 Cross-References: CVE-2014-0578 CVE-2015-3114 CVE-2015-3115 CVE-2015-3116 CVE-2015-3117 CVE-2015-3118 CVE-2015-3119 CVE-2015-3120 CVE-2015-3121 CVE-2015-3122 CVE-2015-3123 CVE-2015-3124 CVE-2015-3125 CVE-2015-3126 CVE-2015-3127 CVE-2015-3128 CVE-2015-3129 CVE-2015-3130 CVE-2015-3131 CVE-2015-3132 CVE-2015-3133 CVE-2015-3134 CVE-2015-3135 CVE-2015-3136 CVE-2015-3137 CVE-2015-4428 CVE-2015-4429 CVE-2015-4430 CVE-2015-4431 CVE-2015-4432 CVE-2015-4433 CVE-2015-5116 CVE-2015-5117 CVE-2015-5118 CVE-2015-5119 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: flash-player was updated to fix 35 security issues. These security issues were fixed: - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer overflow vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory corruption vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3126, CVE-2015-4429: Null pointer dereference issues (bsc#937339). - CVE-2015-3114: A security bypass vulnerability that could lead to information disclosure (bsc#937339). - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433: Type confusion vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119: Use-after-free vulnerabilities that could lead to code execution (bsc#937339). - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (bsc#937339). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-306=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-306=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.481-93.1 flash-player-gnome-11.2.202.481-93.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.481-93.1 flash-player-gnome-11.2.202.481-93.1 References: https://www.suse.com/security/cve/CVE-2014-0578.html https://www.suse.com/security/cve/CVE-2015-3114.html https://www.suse.com/security/cve/CVE-2015-3115.html https://www.suse.com/security/cve/CVE-2015-3116.html https://www.suse.com/security/cve/CVE-2015-3117.html https://www.suse.com/security/cve/CVE-2015-3118.html https://www.suse.com/security/cve/CVE-2015-3119.html https://www.suse.com/security/cve/CVE-2015-3120.html https://www.suse.com/security/cve/CVE-2015-3121.html https://www.suse.com/security/cve/CVE-2015-3122.html https://www.suse.com/security/cve/CVE-2015-3123.html https://www.suse.com/security/cve/CVE-2015-3124.html https://www.suse.com/security/cve/CVE-2015-3125.html https://www.suse.com/security/cve/CVE-2015-3126.html https://www.suse.com/security/cve/CVE-2015-3127.html https://www.suse.com/security/cve/CVE-2015-3128.html https://www.suse.com/security/cve/CVE-2015-3129.html https://www.suse.com/security/cve/CVE-2015-3130.html https://www.suse.com/security/cve/CVE-2015-3131.html https://www.suse.com/security/cve/CVE-2015-3132.html https://www.suse.com/security/cve/CVE-2015-3133.html https://www.suse.com/security/cve/CVE-2015-3134.html https://www.suse.com/security/cve/CVE-2015-3135.html https://www.suse.com/security/cve/CVE-2015-3136.html https://www.suse.com/security/cve/CVE-2015-3137.html https://www.suse.com/security/cve/CVE-2015-4428.html https://www.suse.com/security/cve/CVE-2015-4429.html https://www.suse.com/security/cve/CVE-2015-4430.html https://www.suse.com/security/cve/CVE-2015-4431.html https://www.suse.com/security/cve/CVE-2015-4432.html https://www.suse.com/security/cve/CVE-2015-4433.html https://www.suse.com/security/cve/CVE-2015-5116.html https://www.suse.com/security/cve/CVE-2015-5117.html https://www.suse.com/security/cve/CVE-2015-5118.html https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1210-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1210-1 Rating: critical References: #937339 Cross-References: CVE-2015-5119 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2015-5119: Unspecified vulnerability allowing remote attackers to take over the system (bsc#937339). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-475=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.481-170.1 flash-player-gnome-11.2.202.481-170.1 flash-player-kde4-11.2.202.481-170.1 References: https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1206-1: important: Security update for Xen
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1206-1 Rating: important References: #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Xen was updated to fix two security issues: * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): xen-3.2.3_17040_46-0.17.1 xen-devel-3.2.3_17040_46-0.17.1 xen-doc-html-3.2.3_17040_46-0.17.1 xen-doc-pdf-3.2.3_17040_46-0.17.1 xen-doc-ps-3.2.3_17040_46-0.17.1 xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-libs-3.2.3_17040_46-0.17.1 xen-tools-3.2.3_17040_46-0.17.1 xen-tools-domU-3.2.3_17040_46-0.17.1 xen-tools-ioemu-3.2.3_17040_46-0.17.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): xen-libs-32bit-3.2.3_17040_46-0.17.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=f26fb5291b18bbfa26447df16a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1205-1: important: Security update for bind
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1205-1 Rating: important References: #918330 #936476 Cross-References: CVE-2015-1349 CVE-2015-4620 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: bind was updated to fix two security issues: * CVE-2015-1349: A problem with trust anchor management could have caused named to crash (bsc#918330). * CVE-2015-4620: Fix resolver crash when validating (bsc#936476). Security Issues: * CVE-2015-1349 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1349> * CVE-2015-4620 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4620> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bind=10833 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bind=10833 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bind=10833 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bind=10833 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-devel-9.9.6P1-0.7.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64) [New Version: 9.9.6P1]: bind-devel-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.7.1 bind-chrootenv-9.9.6P1-0.7.1 bind-doc-9.9.6P1-0.7.1 bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.7.1 bind-chrootenv-9.9.6P1-0.7.1 bind-doc-9.9.6P1-0.7.1 bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 9.9.6P1]: bind-libs-x86-9.9.6P1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.9.6P1]: bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-1349.html https://www.suse.com/security/cve/CVE-2015-4620.html https://bugzilla.suse.com/918330 https://bugzilla.suse.com/936476 https://download.suse.com/patch/finder/?keywords=62fe9017ea5999fde9990f72b7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1197-1: important: Security update for php5
by opensuse-security＠opensuse.org 06 Jul '15

06 Jul '15

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1197-1 Rating: important References: #935224 #935225 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4604 CVE-2015-4605 CVE-2015-4643 CVE-2015-4644 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: The PHP script interpreter was updated to receive various security fixes: * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-471=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-471=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-30.6 apache2-mod_php5-debuginfo-5.6.1-30.6 php5-5.6.1-30.6 php5-bcmath-5.6.1-30.6 php5-bcmath-debuginfo-5.6.1-30.6 php5-bz2-5.6.1-30.6 php5-bz2-debuginfo-5.6.1-30.6 php5-calendar-5.6.1-30.6 php5-calendar-debuginfo-5.6.1-30.6 php5-ctype-5.6.1-30.6 php5-ctype-debuginfo-5.6.1-30.6 php5-curl-5.6.1-30.6 php5-curl-debuginfo-5.6.1-30.6 php5-dba-5.6.1-30.6 php5-dba-debuginfo-5.6.1-30.6 php5-debuginfo-5.6.1-30.6 php5-debugsource-5.6.1-30.6 php5-devel-5.6.1-30.6 php5-dom-5.6.1-30.6 php5-dom-debuginfo-5.6.1-30.6 php5-enchant-5.6.1-30.6 php5-enchant-debuginfo-5.6.1-30.6 php5-exif-5.6.1-30.6 php5-exif-debuginfo-5.6.1-30.6 php5-fastcgi-5.6.1-30.6 php5-fastcgi-debuginfo-5.6.1-30.6 php5-fileinfo-5.6.1-30.6 php5-fileinfo-debuginfo-5.6.1-30.6 php5-firebird-5.6.1-30.6 php5-firebird-debuginfo-5.6.1-30.6 php5-fpm-5.6.1-30.6 php5-fpm-debuginfo-5.6.1-30.6 php5-ftp-5.6.1-30.6 php5-ftp-debuginfo-5.6.1-30.6 php5-gd-5.6.1-30.6 php5-gd-debuginfo-5.6.1-30.6 php5-gettext-5.6.1-30.6 php5-gettext-debuginfo-5.6.1-30.6 php5-gmp-5.6.1-30.6 php5-gmp-debuginfo-5.6.1-30.6 php5-iconv-5.6.1-30.6 php5-iconv-debuginfo-5.6.1-30.6 php5-imap-5.6.1-30.6 php5-imap-debuginfo-5.6.1-30.6 php5-intl-5.6.1-30.6 php5-intl-debuginfo-5.6.1-30.6 php5-json-5.6.1-30.6 php5-json-debuginfo-5.6.1-30.6 php5-ldap-5.6.1-30.6 php5-ldap-debuginfo-5.6.1-30.6 php5-mbstring-5.6.1-30.6 php5-mbstring-debuginfo-5.6.1-30.6 php5-mcrypt-5.6.1-30.6 php5-mcrypt-debuginfo-5.6.1-30.6 php5-mssql-5.6.1-30.6 php5-mssql-debuginfo-5.6.1-30.6 php5-mysql-5.6.1-30.6 php5-mysql-debuginfo-5.6.1-30.6 php5-odbc-5.6.1-30.6 php5-odbc-debuginfo-5.6.1-30.6 php5-opcache-5.6.1-30.6 php5-opcache-debuginfo-5.6.1-30.6 php5-openssl-5.6.1-30.6 php5-openssl-debuginfo-5.6.1-30.6 php5-pcntl-5.6.1-30.6 php5-pcntl-debuginfo-5.6.1-30.6 php5-pdo-5.6.1-30.6 php5-pdo-debuginfo-5.6.1-30.6 php5-pgsql-5.6.1-30.6 php5-pgsql-debuginfo-5.6.1-30.6 php5-phar-5.6.1-30.6 php5-phar-debuginfo-5.6.1-30.6 php5-posix-5.6.1-30.6 php5-posix-debuginfo-5.6.1-30.6 php5-pspell-5.6.1-30.6 php5-pspell-debuginfo-5.6.1-30.6 php5-readline-5.6.1-30.6 php5-readline-debuginfo-5.6.1-30.6 php5-shmop-5.6.1-30.6 php5-shmop-debuginfo-5.6.1-30.6 php5-snmp-5.6.1-30.6 php5-snmp-debuginfo-5.6.1-30.6 php5-soap-5.6.1-30.6 php5-soap-debuginfo-5.6.1-30.6 php5-sockets-5.6.1-30.6 php5-sockets-debuginfo-5.6.1-30.6 php5-sqlite-5.6.1-30.6 php5-sqlite-debuginfo-5.6.1-30.6 php5-suhosin-5.6.1-30.6 php5-suhosin-debuginfo-5.6.1-30.6 php5-sysvmsg-5.6.1-30.6 php5-sysvmsg-debuginfo-5.6.1-30.6 php5-sysvsem-5.6.1-30.6 php5-sysvsem-debuginfo-5.6.1-30.6 php5-sysvshm-5.6.1-30.6 php5-sysvshm-debuginfo-5.6.1-30.6 php5-tidy-5.6.1-30.6 php5-tidy-debuginfo-5.6.1-30.6 php5-tokenizer-5.6.1-30.6 php5-tokenizer-debuginfo-5.6.1-30.6 php5-wddx-5.6.1-30.6 php5-wddx-debuginfo-5.6.1-30.6 php5-xmlreader-5.6.1-30.6 php5-xmlreader-debuginfo-5.6.1-30.6 php5-xmlrpc-5.6.1-30.6 php5-xmlrpc-debuginfo-5.6.1-30.6 php5-xmlwriter-5.6.1-30.6 php5-xmlwriter-debuginfo-5.6.1-30.6 php5-xsl-5.6.1-30.6 php5-xsl-debuginfo-5.6.1-30.6 php5-zip-5.6.1-30.6 php5-zip-debuginfo-5.6.1-30.6 php5-zlib-5.6.1-30.6 php5-zlib-debuginfo-5.6.1-30.6 - openSUSE 13.2 (noarch): php5-pear-5.6.1-30.6 - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-61.5 apache2-mod_php5-debuginfo-5.4.20-61.5 php5-5.4.20-61.5 php5-bcmath-5.4.20-61.5 php5-bcmath-debuginfo-5.4.20-61.5 php5-bz2-5.4.20-61.5 php5-bz2-debuginfo-5.4.20-61.5 php5-calendar-5.4.20-61.5 php5-calendar-debuginfo-5.4.20-61.5 php5-ctype-5.4.20-61.5 php5-ctype-debuginfo-5.4.20-61.5 php5-curl-5.4.20-61.5 php5-curl-debuginfo-5.4.20-61.5 php5-dba-5.4.20-61.5 php5-dba-debuginfo-5.4.20-61.5 php5-debuginfo-5.4.20-61.5 php5-debugsource-5.4.20-61.5 php5-devel-5.4.20-61.5 php5-dom-5.4.20-61.5 php5-dom-debuginfo-5.4.20-61.5 php5-enchant-5.4.20-61.5 php5-enchant-debuginfo-5.4.20-61.5 php5-exif-5.4.20-61.5 php5-exif-debuginfo-5.4.20-61.5 php5-fastcgi-5.4.20-61.5 php5-fastcgi-debuginfo-5.4.20-61.5 php5-fileinfo-5.4.20-61.5 php5-fileinfo-debuginfo-5.4.20-61.5 php5-firebird-5.4.20-61.5 php5-firebird-debuginfo-5.4.20-61.5 php5-fpm-5.4.20-61.5 php5-fpm-debuginfo-5.4.20-61.5 php5-ftp-5.4.20-61.5 php5-ftp-debuginfo-5.4.20-61.5 php5-gd-5.4.20-61.5 php5-gd-debuginfo-5.4.20-61.5 php5-gettext-5.4.20-61.5 php5-gettext-debuginfo-5.4.20-61.5 php5-gmp-5.4.20-61.5 php5-gmp-debuginfo-5.4.20-61.5 php5-iconv-5.4.20-61.5 php5-iconv-debuginfo-5.4.20-61.5 php5-imap-5.4.20-61.5 php5-imap-debuginfo-5.4.20-61.5 php5-intl-5.4.20-61.5 php5-intl-debuginfo-5.4.20-61.5 php5-json-5.4.20-61.5 php5-json-debuginfo-5.4.20-61.5 php5-ldap-5.4.20-61.5 php5-ldap-debuginfo-5.4.20-61.5 php5-mbstring-5.4.20-61.5 php5-mbstring-debuginfo-5.4.20-61.5 php5-mcrypt-5.4.20-61.5 php5-mcrypt-debuginfo-5.4.20-61.5 php5-mssql-5.4.20-61.5 php5-mssql-debuginfo-5.4.20-61.5 php5-mysql-5.4.20-61.5 php5-mysql-debuginfo-5.4.20-61.5 php5-odbc-5.4.20-61.5 php5-odbc-debuginfo-5.4.20-61.5 php5-openssl-5.4.20-61.5 php5-openssl-debuginfo-5.4.20-61.5 php5-pcntl-5.4.20-61.5 php5-pcntl-debuginfo-5.4.20-61.5 php5-pdo-5.4.20-61.5 php5-pdo-debuginfo-5.4.20-61.5 php5-pgsql-5.4.20-61.5 php5-pgsql-debuginfo-5.4.20-61.5 php5-phar-5.4.20-61.5 php5-phar-debuginfo-5.4.20-61.5 php5-posix-5.4.20-61.5 php5-posix-debuginfo-5.4.20-61.5 php5-pspell-5.4.20-61.5 php5-pspell-debuginfo-5.4.20-61.5 php5-readline-5.4.20-61.5 php5-readline-debuginfo-5.4.20-61.5 php5-shmop-5.4.20-61.5 php5-shmop-debuginfo-5.4.20-61.5 php5-snmp-5.4.20-61.5 php5-snmp-debuginfo-5.4.20-61.5 php5-soap-5.4.20-61.5 php5-soap-debuginfo-5.4.20-61.5 php5-sockets-5.4.20-61.5 php5-sockets-debuginfo-5.4.20-61.5 php5-sqlite-5.4.20-61.5 php5-sqlite-debuginfo-5.4.20-61.5 php5-suhosin-5.4.20-61.5 php5-suhosin-debuginfo-5.4.20-61.5 php5-sysvmsg-5.4.20-61.5 php5-sysvmsg-debuginfo-5.4.20-61.5 php5-sysvsem-5.4.20-61.5 php5-sysvsem-debuginfo-5.4.20-61.5 php5-sysvshm-5.4.20-61.5 php5-sysvshm-debuginfo-5.4.20-61.5 php5-tidy-5.4.20-61.5 php5-tidy-debuginfo-5.4.20-61.5 php5-tokenizer-5.4.20-61.5 php5-tokenizer-debuginfo-5.4.20-61.5 php5-wddx-5.4.20-61.5 php5-wddx-debuginfo-5.4.20-61.5 php5-xmlreader-5.4.20-61.5 php5-xmlreader-debuginfo-5.4.20-61.5 php5-xmlrpc-5.4.20-61.5 php5-xmlrpc-debuginfo-5.4.20-61.5 php5-xmlwriter-5.4.20-61.5 php5-xmlwriter-debuginfo-5.4.20-61.5 php5-xsl-5.4.20-61.5 php5-xsl-debuginfo-5.4.20-61.5 php5-zip-5.4.20-61.5 php5-zip-debuginfo-5.4.20-61.5 php5-zlib-5.4.20-61.5 php5-zlib-debuginfo-5.4.20-61.5 - openSUSE 13.1 (noarch): php5-pear-5.4.20-61.5 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4604.html https://www.suse.com/security/cve/CVE-2015-4605.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935225 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1183-2: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1183-2 Rating: important References: #929678 #931698 #934489 #934491 Cross-References: CVE-2015-1789 CVE-2015-1790 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 SLES for SAP Applications ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) Security Issues: * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-compat-openssl097g=10790 - SLES for SAP Applications: zypper in -t patch slesappsp3-compat-openssl097g=10790 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): compat-openssl097g-0.9.7g-13.31.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): compat-openssl097g-32bit-0.9.7g-13.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): compat-openssl097g-0.9.7g-146.22.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): compat-openssl097g-32bit-0.9.7g-146.22.31.1 - SLES for SAP Applications (x86_64): compat-openssl097g-0.9.7g-146.22.31.1 compat-openssl097g-32bit-0.9.7g-146.22.31.1 References: https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://download.suse.com/patch/finder/?keywords=31613a0a584dc47c4e6779e1a0… https://download.suse.com/patch/finder/?keywords=9cebc5e391114f90b2cb9133b6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1182-2: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1182-2 Rating: important References: #879179 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: OpenSSL 0.9.8k was updated to fix several security issues: * CVE-2015-4000: The Logjam Attack (weakdh.org) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. 2048-bit DH parameters are now generated by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * CVE-2015-1792: A CMS verification infinite loop when using an unknown hash function was fixed. * CVE-2015-1791: Fixed a race condition in NewSessionTicket creation. * CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to locking regression. * Fixed a timing side channel in RSA decryption. (bsc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bsc#931698) * Added the ECC ciphersuites to the DEFAULT cipher class. (bsc#879179) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-1791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791> * CVE-2015-1792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792> * CVE-2015-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3216> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libopenssl-devel=10781 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libopenssl-devel=10781 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libopenssl-devel=10781 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libopenssl-devel=10781 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): libopenssl0_9_8-0.9.8j-0.72.1 libopenssl0_9_8-hmac-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 openssl-doc-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.72.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.72.1 libopenssl0_9_8-hmac-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 openssl-doc-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.72.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libopenssl0_9_8-x86-0.9.8j-0.72.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): libopenssl0_9_8-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/879179 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://download.suse.com/patch/finder/?keywords=fcf228a4143edf49a5ca32558b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1181-2: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1181-2 Rating: important References: #929678 #931698 #934487 #934489 #934491 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.92.1 openssl-devel-0.9.8a-18.92.1 openssl-doc-0.9.8a-18.92.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.92.1 openssl-devel-32bit-0.9.8a-18.92.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://download.suse.com/patch/finder/?keywords=9f7ad0f893ed0c841ceae726da… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1184-2: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1184-2 Rating: important References: #929678 #931698 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: OpenSSL 0.9.8j was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * CVE-2015-1792: A CMS verification infinite loop when using an unknown hash function was fixed. * CVE-2015-1791: Fixed a race condition in NewSessionTicket creation. * CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to locking regression. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) * Added the ECC ciphersuites to the DEFAULT cipher class (bnc#879179) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-1791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791> * CVE-2015-1792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792> * CVE-2015-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3216> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libopenssl-devel=10795 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.72.1 libopenssl0_9_8-0.9.8j-0.72.1 libopenssl0_9_8-hmac-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 openssl-doc-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.72.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://download.suse.com/patch/finder/?keywords=75ca56dc2ed43571b870081da3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1185-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1185-1 Rating: important References: #929678 #931698 #933911 #934487 #934489 #934491 #934493 #934494 Cross-References: CVE-2014-8176 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Security Module 11 SP3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: OpenSSL 1.0.1 was updated to fix several security issues: * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. 2048-bit DH parameters are now generated by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * CVE-2015-1792: A CMS verification infinite loop when using an unknown hash function was fixed. * CVE-2015-1791: Fixed a race condition in NewSessionTicket creation. * CVE-2014-8176: Fixed an invalid free in DTLS. * Fixed a timing side channel in RSA decryption. (bsc#929678) Security Issues: * CVE-2014-8176 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8176> * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-1791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791> * CVE-2015-1792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Security Module 11 SP3: zypper in -t patch secsp3-libopenssl1-devel=10778 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Security Module 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl1-devel-1.0.1g-0.30.1 libopenssl1_0_0-1.0.1g-0.30.1 openssl1-1.0.1g-0.30.1 openssl1-doc-1.0.1g-0.30.1 - SUSE Linux Enterprise Security Module 11 SP3 (ppc64 s390x x86_64): libopenssl1_0_0-32bit-1.0.1g-0.30.1 - SUSE Linux Enterprise Security Module 11 SP3 (ia64): libopenssl1_0_0-x86-1.0.1g-0.30.1 References: https://www.suse.com/security/cve/CVE-2014-8176.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 https://download.suse.com/patch/finder/?keywords=5afbe87912753d6ca074e9e870… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1184-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1184-1 Rating: important References: #929678 #931698 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes one version update. Description: OpenSSL 0.9.8j was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * CVE-2015-1792: A CMS verification infinite loop when using an unknown hash function was fixed. * CVE-2015-1791: Fixed a race condition in NewSessionTicket creation. * CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to locking regression. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) * Added the ECC ciphersuites to the DEFAULT cipher class (bnc#879179) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-1791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791> * CVE-2015-1792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792> * CVE-2015-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3216> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libopenssl-devel=10794 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]: libopenssl-devel-0.9.8j-0.72.1 libopenssl0_9_8-0.9.8j-0.72.1 libopenssl0_9_8-hmac-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 openssl-doc-0.9.8j-0.72.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.72.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://download.suse.com/patch/finder/?keywords=ab1c52f77471cf8a61e7eae79f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1183-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1183-1 Rating: important References: #929678 #931698 #934489 #934491 Cross-References: CVE-2015-1789 CVE-2015-1790 CVE-2015-4000 Affected Products: SUSE Linux Enterprise for SAP Applications 11 SP2 SUSE Linux Enterprise for SAP Applications 11 SP1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) Security Issues: * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise for SAP Applications 11 SP2: zypper in -t patch slesapp2-compat-openssl097g=10802 - SUSE Linux Enterprise for SAP Applications 11 SP1: zypper in -t patch slesapp1-compat-openssl097g=10793 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise for SAP Applications 11 SP2 (x86_64): compat-openssl097g-0.9.7g-146.22.31.1 compat-openssl097g-32bit-0.9.7g-146.22.31.1 - SUSE Linux Enterprise for SAP Applications 11 SP1 (x86_64): compat-openssl097g-0.9.7g-146.22.31.1 compat-openssl097g-32bit-0.9.7g-146.22.31.1 References: https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://download.suse.com/patch/finder/?keywords=988a9debe1ac4ac25cd6b815d5… https://download.suse.com/patch/finder/?keywords=b18733973cc66be5941bc1514b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1182-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1182-1 Rating: important References: #879179 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Studio Onsite 1.3 SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: OpenSSL 0.9.8k was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * CVE-2015-1792: A CMS verification infinite loop when using an unknown hash function was fixed. * CVE-2015-1791: Fixed a race condition in NewSessionTicket creation. * CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to locking regression. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) * Added the ECC ciphersuites to the DEFAULT cipher class (bnc#879179) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-1791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791> * CVE-2015-1792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792> * CVE-2015-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3216> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-libopenssl-devel=10780 - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-libopenssl-devel=10780 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): libopenssl-devel-0.9.8j-0.72.1 - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): libopenssl0_9_8-0.9.8j-0.72.1 libopenssl0_9_8-32bit-0.9.8j-0.72.1 libopenssl0_9_8-hmac-0.9.8j-0.72.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1 openssl-0.9.8j-0.72.1 openssl-doc-0.9.8j-0.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/879179 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://download.suse.com/patch/finder/?keywords=5f8d475ae46705d05176f539f9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1181-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1181-1 Rating: important References: #929678 #931698 #934487 #934489 #934491 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-4000 Affected Products: SLE CLIENT TOOLS 10 for x86_64 SLE CLIENT TOOLS 10 for s390x SLE CLIENT TOOLS 10 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1788: Malformed ECParameters could cause an infinite loop. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) Security Issues: * CVE-2015-1788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788> * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Package List: - SLE CLIENT TOOLS 10 for x86_64 (x86_64): openssl-0.9.8a-18.92.1 openssl-32bit-0.9.8a-18.92.1 - SLE CLIENT TOOLS 10 for s390x (s390x): openssl-0.9.8a-18.92.1 openssl-32bit-0.9.8a-18.92.1 - SLE CLIENT TOOLS 10 (i586): openssl-0.9.8a-18.92.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://download.suse.com/patch/finder/?keywords=4a7ecd7eeea5e8090f179934ad… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1180-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1180-1 Rating: important References: #935701 Cross-References: CVE-2015-3113 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed: * CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution (bsc#935701, APSB15-14) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-462=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.468-167.1 flash-player-gnome-11.2.202.468-167.1 flash-player-kde4-11.2.202.468-167.1 References: https://www.suse.com/security/cve/CVE-2015-3113.html https://bugzilla.suse.com/935701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1177-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 02 Jul '15

02 Jul '15

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1177-1 Rating: important References: #934789 Cross-References: CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update fixes the following security issue: * Logjam Attack: MySQL uses 512 bit dh groups in SSL (bnc#934789) Security Issues: * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18=10826 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18=10826 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18=10826 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18=10826 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.43-0.9.1 libmysqlclient_r15-32bit-5.0.96-0.8.8.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.43-0.9.1 libmysqlclient_r15-x86-5.0.96-0.8.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.9.1 libmysql55client_r18-5.5.43-0.9.1 libmysqlclient15-5.0.96-0.8.8.1 libmysqlclient_r15-5.0.96-0.8.8.1 mysql-5.5.43-0.9.1 mysql-client-5.5.43-0.9.1 mysql-tools-5.5.43-0.9.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.9.1 libmysqlclient15-32bit-5.0.96-0.8.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.9.1 libmysql55client_r18-5.5.43-0.9.1 libmysqlclient15-5.0.96-0.8.8.1 libmysqlclient_r15-5.0.96-0.8.8.1 mysql-5.5.43-0.9.1 mysql-client-5.5.43-0.9.1 mysql-tools-5.5.43-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.9.1 libmysqlclient15-32bit-5.0.96-0.8.8.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.43]: libmysql55client18-x86-5.5.43-0.9.1 libmysqlclient15-x86-5.0.96-0.8.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.43]: libmysql55client18-5.5.43-0.9.1 libmysql55client_r18-5.5.43-0.9.1 libmysqlclient15-5.0.96-0.8.8.1 libmysqlclient_r15-5.0.96-0.8.8.1 mysql-5.5.43-0.9.1 mysql-client-5.5.43-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.43]: libmysql55client18-32bit-5.5.43-0.9.1 libmysql55client_r18-32bit-5.5.43-0.9.1 libmysqlclient15-32bit-5.0.96-0.8.8.1 libmysqlclient_r15-32bit-5.0.96-0.8.8.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/934789 https://download.suse.com/patch/finder/?keywords=753e69cc9c9eccad4cba2c1ef6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0