September 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1487-1: important: Live patch for the Linux Kernel
by opensuse-security＠opensuse.org 04 Sep '15

04 Sep '15

SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1487-1 Rating: important References: #939044 #939241 #939262 #939263 #939270 #939273 #939276 #939277 Cross-References: CVE-2014-8159 CVE-2015-1805 CVE-2015-3331 CVE-2015-3339 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.38-44 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-486=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_38-44-default-2-7.1 kgraft-patch-3_12_38-44-xen-2-7.1 References: https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939241 https://bugzilla.suse.com/939262 https://bugzilla.suse.com/939263 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 https://bugzilla.suse.com/939277 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1481-1: important: Security update for bind
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1481-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-478=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-478=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-478=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-devel-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bind-9.9.6P1-26.1 bind-chrootenv-9.9.6P1-26.1 bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-libs-9.9.6P1-26.1 bind-libs-debuginfo-9.9.6P1-26.1 bind-utils-9.9.6P1-26.1 bind-utils-debuginfo-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): bind-libs-32bit-9.9.6P1-26.1 bind-libs-debuginfo-32bit-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (noarch): bind-doc-9.9.6P1-26.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-libs-32bit-9.9.6P1-26.1 bind-libs-9.9.6P1-26.1 bind-libs-debuginfo-32bit-9.9.6P1-26.1 bind-libs-debuginfo-9.9.6P1-26.1 bind-utils-9.9.6P1-26.1 bind-utils-debuginfo-9.9.6P1-26.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1480-1: important: Security update for bind
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1480-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-12067=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-bind-12067=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-bind-12067=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-12067=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-bind-12067=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-bind-12067=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-bind-12067=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-bind-12067=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64): bind-devel-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): bind-libs-x86-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-devel-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1479-2: important: Security update for xen
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1479-2 Rating: important References: #922709 #932996 #935634 #938344 #939709 #939712 Cross-References: CVE-2015-2751 CVE-2015-3259 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 CVE-2015-5166 Affected Products: SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: xen was updated to fix the following security issues: * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model (bsc#939712, XSA-140) * CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol (bsc#939709, XSA-139) * CVE-2015-2751: Certain domctl operations could have be used to lock up the host (bsc#922709, XSA-127) * CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137) * CVE-2015-4164: DoS through iret hypercall handler (bsc#932996, XSA-136) * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-xen-12066=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): xen-4.2.5_12-15.1 xen-doc-html-4.2.5_12-15.1 xen-doc-pdf-4.2.5_12-15.1 xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-32bit-4.2.5_12-15.1 xen-libs-4.2.5_12-15.1 xen-tools-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-4164.html https://www.suse.com/security/cve/CVE-2015-5154.html https://www.suse.com/security/cve/CVE-2015-5165.html https://www.suse.com/security/cve/CVE-2015-5166.html https://bugzilla.suse.com/922709 https://bugzilla.suse.com/932996 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 https://bugzilla.suse.com/939709 https://bugzilla.suse.com/939712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1479-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1479-1 Rating: important References: #922709 #932996 #935634 #938344 #939709 #939712 Cross-References: CVE-2015-2751 CVE-2015-3259 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 CVE-2015-5166 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: xen was updated to fix the following security issues: * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model (bsc#939712, XSA-140) * CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol (bsc#939709, XSA-139) * CVE-2015-2751: Certain domctl operations could have be used to lock up the host (bsc#922709, XSA-127) * CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137) * CVE-2015-4164: DoS through iret hypercall handler (bsc#932996, XSA-136) * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-xen-12066=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-xen-12066=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-xen-12066=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-12066=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 x86_64): xen-devel-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (i586 x86_64): xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (x86_64): xen-4.2.5_12-15.1 xen-doc-html-4.2.5_12-15.1 xen-doc-pdf-4.2.5_12-15.1 xen-libs-32bit-4.2.5_12-15.1 xen-tools-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (i586): xen-kmp-pae-4.2.5_12_3.0.101_0.47.55-15.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586): xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-kmp-pae-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_12-15.1 xen-debugsource-4.2.5_12-15.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-4164.html https://www.suse.com/security/cve/CVE-2015-5154.html https://www.suse.com/security/cve/CVE-2015-5165.html https://www.suse.com/security/cve/CVE-2015-5166.html https://bugzilla.suse.com/922709 https://bugzilla.suse.com/932996 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 https://bugzilla.suse.com/939709 https://bugzilla.suse.com/939712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1478-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1478-1 Rating: important References: #798406 #821931 #860593 #879878 #891087 #897995 #898693 #900881 #904671 #908870 #909477 #912916 #914742 #915200 #915517 #915577 #916010 #917093 #917830 #918333 #919007 #919018 #919463 #921769 #922583 #923245 #926240 #927257 #928801 #929148 #929283 #929360 #929525 #930284 #930934 #931474 #933429 #935705 #936831 #937032 #937986 #940338 #940398 Cross-References: CVE-2014-8086 CVE-2014-8159 CVE-2014-9683 CVE-2015-0777 CVE-2015-1420 CVE-2015-1421 CVE-2015-1805 CVE-2015-2041 CVE-2015-2042 CVE-2015-2150 CVE-2015-2830 CVE-2015-2922 CVE-2015-3331 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 CVE-2015-5707 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 18 vulnerabilities and has 25 fixes is now available. Description: The SUSE Linux Enterprise Server 11 SP2 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code. - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240). - CVE-2015-0777: drivers/xen/usbback/usbback.c in the Linux kernel allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830). - CVE-2015-2150: Xen and the Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bnc#919463). - CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-1420: CVE-2015-1420: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517). - CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705). - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun" (bnc#933429). - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket (bnc#927257). - CVE-2015-2922: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel allowed remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message (bnc#922583). - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bnc#919007). - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect (bnc#929525). - CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bnc#900881). - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bnc#914742). - CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel allowed local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename (bnc#918333). - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bnc#919018). - CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel allowed remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data (bnc#915577). The following non-security bugs were fixed: - HID: add ALWAYS_POLL quirk for a Logitech 0xc007 (bnc#931474). - HID: add HP OEM mouse to quirk ALWAYS_POLL (bnc#931474). - HID: add quirk for PIXART OEM mouse used by HP (bnc#931474). - HID: usbhid: add always-poll quirk (bnc#931474). - HID: usbhid: add another mouse that needs QUIRK_ALWAYS_POLL (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 009b (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 0103 (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 016f (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen. - HID: usbhid: fix PIXART optical mouse (bnc#931474). - HID: usbhid: more mice with ALWAYS_POLL (bnc#931474). - HID: usbhid: yet another mouse with ALWAYS_POLL (bnc#931474). - bnx2x: Fix kdump when iommu=on (bug#921769). - cifs: fix use-after-free bug in find_writable_file (bnc#909477). - coredump: ensure the fpu state is flushed for proper multi-threaded core dump (bsc#904671, bsc#929360). - dm: fixed that LVM merge snapshot of root logical volume were not working (bsc#928801) - deal with deadlock in d_walk fix (bnc#929148, bnc#929283). - e1000: do not enable dma receives until after dma address has been setup (bsc#821931). - fsnotify: Fix handling of renames in audit (bnc#915200). - inet: add a redirect generation id in inetpeer (bnc#860593). - inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). - kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). - kernel: fix data corruption when reading /proc/sysinfo (bsc#891087, bsc#937986, LTC#114480). - libata: prevent HSM state change race between ISR and PIO (bsc#923245). - time, ntp: Do not update time_state in middle of leap second (bsc#912916). - s390-3215-tty-close-crash.patch: kernel: 3215 tty close crash (bsc#916010, LTC#120873). - s390-3215-tty-close-race.patch: kernel: 3215 console crash (bsc#916010, LTC#94302). - s390-3215-tty-hang.patch: Renamed from patches.arch/s390-tty-hang.patch. - s390-3215-tty-hang.patch: Update references (bnc#898693, bnc#897995, LTC#114562). - s390-dasd-retry-partition-detection.patch: s390/dasd: retry partition detection (bsc#916010, LTC#94302). - s390-dasd-retry-partition-detection.patch: Update references (bsc#916010, LTC#120565). - s390-sclp-tty-refcount.patch: kernel: sclp console tty reference counting (bsc#916010, LTC#115466). - scsi: vmw_pvscsi: Fix pvscsi_abort() function (bnc#940398 bsc#930934). - scsi/sg: sg_start_req(): make sure that there is not too many elements in iovec (bsc#940338). - x86, xsave: remove thread_has_fpu() bug check in __sanitize_i387_state() (bsc#904671, bsc#929360). - x86-mm-send-tlb-flush-ipis-to-online-cpus-only.patch: x86, mm: Send tlb flush IPIs to online cpus only (bnc#798406). - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - x86/reboot: Fix a warning message triggered by stop_other_cpus() (bnc#930284). - xen: Correctly re-enable interrupts in xen_spin_wait() (bsc#879878, bsc#908870). - xfs: prevent deadlock trying to cover an active log (bsc#917093). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-kernel-20150819-12065=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-kernel-20150819-12065=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.7.37.1 kernel-default-base-3.0.101-0.7.37.1 kernel-default-devel-3.0.101-0.7.37.1 kernel-source-3.0.101-0.7.37.1 kernel-syms-3.0.101-0.7.37.1 kernel-trace-3.0.101-0.7.37.1 kernel-trace-base-3.0.101-0.7.37.1 kernel-trace-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.7.37.1 kernel-ec2-base-3.0.101-0.7.37.1 kernel-ec2-devel-3.0.101-0.7.37.1 kernel-xen-3.0.101-0.7.37.1 kernel-xen-base-3.0.101-0.7.37.1 kernel-xen-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x): kernel-default-man-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): kernel-pae-3.0.101-0.7.37.1 kernel-pae-base-3.0.101-0.7.37.1 kernel-pae-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.7.37.1 kernel-default-debugsource-3.0.101-0.7.37.1 kernel-default-devel-debuginfo-3.0.101-0.7.37.1 kernel-trace-debuginfo-3.0.101-0.7.37.1 kernel-trace-debugsource-3.0.101-0.7.37.1 kernel-trace-devel-debuginfo-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.7.37.1 kernel-ec2-debugsource-3.0.101-0.7.37.1 kernel-xen-debuginfo-3.0.101-0.7.37.1 kernel-xen-debugsource-3.0.101-0.7.37.1 kernel-xen-devel-debuginfo-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586): kernel-pae-debuginfo-3.0.101-0.7.37.1 kernel-pae-debugsource-3.0.101-0.7.37.1 kernel-pae-devel-debuginfo-3.0.101-0.7.37.1 References: https://www.suse.com/security/cve/CVE-2014-8086.html https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2014-9683.html https://www.suse.com/security/cve/CVE-2015-0777.html https://www.suse.com/security/cve/CVE-2015-1420.html https://www.suse.com/security/cve/CVE-2015-1421.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-2041.html https://www.suse.com/security/cve/CVE-2015-2042.html https://www.suse.com/security/cve/CVE-2015-2150.html https://www.suse.com/security/cve/CVE-2015-2830.html https://www.suse.com/security/cve/CVE-2015-2922.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://www.suse.com/security/cve/CVE-2015-5707.html https://bugzilla.suse.com/798406 https://bugzilla.suse.com/821931 https://bugzilla.suse.com/860593 https://bugzilla.suse.com/879878 https://bugzilla.suse.com/891087 https://bugzilla.suse.com/897995 https://bugzilla.suse.com/898693 https://bugzilla.suse.com/900881 https://bugzilla.suse.com/904671 https://bugzilla.suse.com/908870 https://bugzilla.suse.com/909477 https://bugzilla.suse.com/912916 https://bugzilla.suse.com/914742 https://bugzilla.suse.com/915200 https://bugzilla.suse.com/915517 https://bugzilla.suse.com/915577 https://bugzilla.suse.com/916010 https://bugzilla.suse.com/917093 https://bugzilla.suse.com/917830 https://bugzilla.suse.com/918333 https://bugzilla.suse.com/919007 https://bugzilla.suse.com/919018 https://bugzilla.suse.com/919463 https://bugzilla.suse.com/921769 https://bugzilla.suse.com/922583 https://bugzilla.suse.com/923245 https://bugzilla.suse.com/926240 https://bugzilla.suse.com/927257 https://bugzilla.suse.com/928801 https://bugzilla.suse.com/929148 https://bugzilla.suse.com/929283 https://bugzilla.suse.com/929360 https://bugzilla.suse.com/929525 https://bugzilla.suse.com/930284 https://bugzilla.suse.com/930934 https://bugzilla.suse.com/931474 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/936831 https://bugzilla.suse.com/937032 https://bugzilla.suse.com/937986 https://bugzilla.suse.com/940338 https://bugzilla.suse.com/940398 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1476-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 02 Sep '15

02 Sep '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1476-1 Rating: important References: #940806 #943557 #943558 #943608 Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4495 CVE-2015-4497 CVE-2015-4498 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities. - Firefox was updated to 38.2.1 ESR (bsc#943608) * MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling * MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs - Firefox was updated to 38.2.0 ESR (bsc#940806) * MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262) Same origin violation and local file stealing via PDF reader * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130, bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068, bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711) Miscellaneous memory safety hazards (rv:40.0 / rv:38.2) * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107, bmo#1170344, bmo#1186718) Overflow issues in libstagefright * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities found through code inspection * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-472=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-472=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-472=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-devel-38.2.1esr-45.1 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-devel-3.19.2.0-26.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.2.1esr-45.1 MozillaFirefox-branding-SLE-31.0-14.1 MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-translations-38.2.1esr-45.1 libfreebl3-3.19.2.0-26.2 libfreebl3-debuginfo-3.19.2.0-26.2 libfreebl3-hmac-3.19.2.0-26.2 libsoftokn3-3.19.2.0-26.2 libsoftokn3-debuginfo-3.19.2.0-26.2 libsoftokn3-hmac-3.19.2.0-26.2 mozilla-nss-3.19.2.0-26.2 mozilla-nss-certs-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-3.19.2.0-26.2 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-tools-3.19.2.0-26.2 mozilla-nss-tools-debuginfo-3.19.2.0-26.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.19.2.0-26.2 libfreebl3-debuginfo-32bit-3.19.2.0-26.2 libfreebl3-hmac-32bit-3.19.2.0-26.2 libsoftokn3-32bit-3.19.2.0-26.2 libsoftokn3-debuginfo-32bit-3.19.2.0-26.2 libsoftokn3-hmac-32bit-3.19.2.0-26.2 mozilla-nss-32bit-3.19.2.0-26.2 mozilla-nss-certs-32bit-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debuginfo-32bit-3.19.2.0-26.2 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.2.1esr-45.1 MozillaFirefox-branding-SLE-31.0-14.1 MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-translations-38.2.1esr-45.1 libfreebl3-3.19.2.0-26.2 libfreebl3-32bit-3.19.2.0-26.2 libfreebl3-debuginfo-3.19.2.0-26.2 libfreebl3-debuginfo-32bit-3.19.2.0-26.2 libsoftokn3-3.19.2.0-26.2 libsoftokn3-32bit-3.19.2.0-26.2 libsoftokn3-debuginfo-3.19.2.0-26.2 libsoftokn3-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-3.19.2.0-26.2 mozilla-nss-32bit-3.19.2.0-26.2 mozilla-nss-certs-3.19.2.0-26.2 mozilla-nss-certs-32bit-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-tools-3.19.2.0-26.2 mozilla-nss-tools-debuginfo-3.19.2.0-26.2 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4474.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4495.html https://www.suse.com/security/cve/CVE-2015-4497.html https://www.suse.com/security/cve/CVE-2015-4498.html https://bugzilla.suse.com/940806 https://bugzilla.suse.com/943557 https://bugzilla.suse.com/943558 https://bugzilla.suse.com/943608 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1472-1: important: Security update for kvm
by opensuse-security＠opensuse.org 01 Sep '15

01 Sep '15

SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1472-1 Rating: important References: #938344 Cross-References: CVE-2015-5154 Affected Products: SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: kvm was updated to fix one security issue. This security issue was fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-kvm-12062=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-kvm-12062=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3 (i586 s390x x86_64): kvm-1.4.2-0.22.34.3 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): kvm-1.4.2-0.22.34.3 References: https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/938344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0