August 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1345-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 05 Aug '15

05 Aug '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1345-1 Rating: important References: #935540 #936844 #938895 Cross-References: CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: IBM Java was updated to 6.0-16.7 to fix several security issues. The following vulnerabilities were fixed: * CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. The following non-security bugs were fixed: * bsc#936844: misconfigured update-alternative entries Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-369=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.7-22.2 java-1_6_0-ibm-fonts-1.6.0_sr16.7-22.2 java-1_6_0-ibm-jdbc-1.6.0_sr16.7-22.2 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.7-22.2 References: https://www.suse.com/security/cve/CVE-2015-1931.html https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/935540 https://bugzilla.suse.com/936844 https://bugzilla.suse.com/938895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1335-1: important: Security update for bind
by opensuse-security＠opensuse.org 03 Aug '15

03 Aug '15

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1335-1 Rating: important References: #939567 Cross-References: CVE-2015-5477 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (boo#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-530=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-530=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.7.1 bind-chrootenv-9.9.6P1-2.7.1 bind-debuginfo-9.9.6P1-2.7.1 bind-debugsource-9.9.6P1-2.7.1 bind-devel-9.9.6P1-2.7.1 bind-libs-9.9.6P1-2.7.1 bind-libs-debuginfo-9.9.6P1-2.7.1 bind-lwresd-9.9.6P1-2.7.1 bind-lwresd-debuginfo-9.9.6P1-2.7.1 bind-utils-9.9.6P1-2.7.1 bind-utils-debuginfo-9.9.6P1-2.7.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.7.1 bind-libs-debuginfo-32bit-9.9.6P1-2.7.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.7.1 - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.14.1 bind-chrootenv-9.9.4P2-2.14.1 bind-debuginfo-9.9.4P2-2.14.1 bind-debugsource-9.9.4P2-2.14.1 bind-devel-9.9.4P2-2.14.1 bind-libs-9.9.4P2-2.14.1 bind-libs-debuginfo-9.9.4P2-2.14.1 bind-lwresd-9.9.4P2-2.14.1 bind-lwresd-debuginfo-9.9.4P2-2.14.1 bind-utils-9.9.4P2-2.14.1 bind-utils-debuginfo-9.9.4P2-2.14.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.14.1 bind-libs-debuginfo-32bit-9.9.4P2-2.14.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.14.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://bugzilla.suse.com/939567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1332-1: important: Security update for libuser
by opensuse-security＠opensuse.org 03 Aug '15

03 Aug '15

openSUSE Security Update: Security update for libuser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1332-1 Rating: important References: #937533 Cross-References: CVE-2015-3246 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libuser was updated to fix on security issue. The following vulnerability was fixed: * CVE-2015-3246: local root exploit through passwd file handling (boo#937533) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-529=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libuser-0.60-3.3.1 libuser-debuginfo-0.60-3.3.1 libuser-debugsource-0.60-3.3.1 libuser-devel-0.60-3.3.1 libuser-python-0.60-3.3.1 libuser-python-debuginfo-0.60-3.3.1 libuser1-0.60-3.3.1 libuser1-debuginfo-0.60-3.3.1 - openSUSE 13.2 (noarch): libuser-lang-0.60-3.3.1 References: https://www.suse.com/security/cve/CVE-2015-3246.html https://bugzilla.suse.com/937533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0