January 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:0280-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 29 Jan '16

29 Jan '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0280-1 Rating: important References: #865096 #865259 #913996 #950178 #950998 #952621 #954324 #954532 #954647 #955422 #956708 #957152 #957988 #957990 #958439 #958463 #958504 #958510 #958886 #958951 #959190 #959399 #960021 #960710 #961263 #961509 #962075 #962597 Cross-References: CVE-2015-7550 CVE-2015-8539 CVE-2015-8543 CVE-2015-8550 CVE-2015-8551 CVE-2015-8552 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2016-0728 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 18 fixes is now available. Description: The Linux kernel for openSUSE Leap 42.1 was updated to the 4.1.15 stable release, and also includes security and bugfixes. Following security bugs were fixed: - CVE-2016-0728: A reference leak in keyring handling with join_session_keyring() could lead to local attackers gain root privileges. (bsc#962075). - CVE-2015-7550: A local user could have triggered a race between read and revoke in keyctl (bnc#958951). - CVE-2015-8767: A case can occur when sctp_accept() is called by the user during a heartbeat timeout event after the 4-way handshake. Since sctp_assoc_migrate() changes both assoc->base.sk and assoc->ep, the bh_sock_lock in sctp_generate_heartbeat_event() will be taken with the listening socket but released with the new association socket. The result is a deadlock on any future attempts to take the listening socket lock. (bsc#961509) - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958463). - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886). - CVE-2015-8575: Validate socket address length in sco_sock_bind() to prevent information leak (bsc#959399). - CVE-2015-8551, CVE-2015-8552: xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled (bsc#957990). - CVE-2015-8550: Compiler optimizations in the XEN PV backend drivers could have lead to double fetch vulnerabilities, causing denial of service or arbitrary code execution (depending on the configuration) (bsc#957988). The following non-security bugs were fixed: - ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd (bsc#958439). - ALSA: hda - Apply click noise workaround for Thinkpads generically (bsc#958439). - ALSA: hda - Fix noise problems on Thinkpad T440s (boo#958504). - ALSA: hda - Flush the pending probe work at remove (boo#960710). - ALSA: hda - Set codec to D3 at reboot/shutdown on Thinkpads (bsc#958439). - Add Cavium Thunderx network enhancements - Add RHEL to kernel-obs-build - Backport amd xgbe fixes and features - Backport arm64 patches from SLE12-SP1-ARM. - Btrfs: fix the number of transaction units needed to remove a block group (bsc#950178). - Btrfs: use global reserve when deleting unused block group after ENOSPC (bsc#950178). - Documentation: nousb is a module parameter (bnc#954324). - Driver for IBM System i/p VNIC protocol. - Enable CONFIG_PINCTRL_CHERRYVIEW (boo#954532) Needed for recent tablets/laptops. CONFIG_PINCTRL_BAYTRAIL is still disabled as it can't be built as a module. - Fix PCI generic host controller - Fix kABI breakage for max_dev_sectors addition to queue_limits (boo#961263). - HID: multitouch: Fetch feature reports on demand for Win8 devices (boo#954532). - HID: multitouch: fix input mode switching on some Elan panels (boo#954532). - Implement enable/disable for Display C6 state (boo#960021). - Input: aiptek - fix crash on detecting device without endpoints (bnc#956708). - Linux 4.1.15 (boo#954647 bsc#955422). - Move kabi patch to patches.kabi directory - Obsolete compat-wireless, rts5229 and rts_pstor KMPs These are found in SLE11-SP3, now replaced with the upstream drivers. - PCI: generic: Pass starting bus number to pci_scan_root_bus(). - Revert "block: remove artifical max_hw_sectors cap" (boo#961263). - Set system time through RTC device - Update arm64 config files. Enabled DRM_AST in the vanilla kernel since it is now enabled in the default kernel. - Update config files: CONFIG_IBMVNIC=m - block/sd: Fix device-imposed transfer length limits (boo#961263). - block: bump BLK_DEF_MAX_SECTORS to 2560 (boo#961263). - drm/i915/skl: Add DC5 Trigger Sequence (boo#960021). - drm/i915/skl: Add DC6 Trigger sequence (boo#960021). - drm/i915/skl: Add support to load SKL CSR firmware (boo#960021). - drm/i915/skl: Add the INIT power domain to the MISC I/O power well (boo#960021). - drm/i915/skl: Deinit/init the display at suspend/resume (boo#960021). - drm/i915/skl: Fix DMC API version in firmware file name (boo#960021). - drm/i915/skl: Fix WaDisableChickenBitTSGBarrierAckForFFSliceCS (boo#960021). - drm/i915/skl: Fix stepping check for a couple of W/As (boo#960021). - drm/i915/skl: Fix the CTRL typo in the DPLL_CRTL1 defines (boo#960021). - drm/i915/skl: Implement WaDisableVFUnitClockGating (boo#960021). - drm/i915/skl: Implement enable/disable for Display C5 state (boo#960021). - drm/i915/skl: Make the Misc I/O power well part of the PLLS domain (boo#960021). - drm/i915/skl: add F0 stepping ID (boo#960021). - drm/i915/skl: enable WaForceContextSaveRestoreNonCoherent (boo#960021). - drm/i915: Clear crtc atomic flags at beginning of transaction (boo#960021). - drm/i915: Fix CSR MMIO address check (boo#960021). - drm/i915: Switch to full atomic helpers for plane updates/disable, take two (boo#960021). - drm/i915: set CDCLK if DPLL0 enabled during resuming from S3 (boo#960021). - ethernet/atheros/alx: sanitize buffer sizing and padding (boo#952621). - genksyms: Handle string literals with spaces in reference files (bsc#958510). - group-source-files: mark module.lds as devel file ld: cannot open linker script file /usr/src/linux-4.2.5-1/arch/arm/kernel/module.lds: No such file or directory - hwrng: core - sleep interruptible in read (bnc#962597). - ipv6: distinguish frag queues by device for multicast and link-local packets (bsc#955422). - kABI fixes for linux-4.1.15. - rpm/compute-PATCHVERSION.sh: Skip stale directories in the package dir - rpm/constraints.in: Bump disk space requirements up a bit Require 10GB on s390x, 20GB elsewhere. - rpm/constraints.in: Require 14GB worth of disk space on POWER The builds started to fail randomly due to ENOSPC errors. - rpm/kernel-binary.spec.in: Do not explicitly set DEBUG_SECTION_MISMATCH CONFIG_DEBUG_SECTION_MISMATCH is a selectable Kconfig option since 2.6.39 and is enabled in our configs. - rpm/kernel-binary.spec.in: Do not obsolete ocfs2-kmp (bnc#865259)865259 - rpm/kernel-binary.spec.in: Fix build if no UEFI certs are installed - rpm/kernel-binary.spec.in: Install libopenssl-devel for newer sign-file - rpm/kernel-binary.spec.in: No scriptlets in kernel-zfcpdump The kernel should not be added to the bootloader nor are there any KMPs. - rpm/kernel-binary.spec.in: Obsolete the -base package from SLE11 (bnc#865096) - rpm/kernel-binary.spec.in: Use parallel make in all invocations Also, remove the lengthy comment, since we are using a standard rpm macro now. - thinkpad_acpi: Do not yell on unsupported brightness interfaces (boo#957152). - usb: make "nousb" a clear module parameter (bnc#954324). - usbvision fix overflow of interfaces array (bnc#950998). - x86/microcode/amd: Do not overwrite final patch levels (bsc#913996). - x86/microcode/amd: Extract current patch level read to a function (bsc#913996). - xen/pciback: Do not allow MSI-X ops if PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157). - xhci: refuse loading if nousb is used (bnc#954324). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-116=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.15-8.1 kernel-default-base-4.1.15-8.1 kernel-default-base-debuginfo-4.1.15-8.1 kernel-default-debuginfo-4.1.15-8.1 kernel-default-debugsource-4.1.15-8.1 kernel-default-devel-4.1.15-8.1 kernel-obs-build-4.1.15-8.2 kernel-obs-build-debugsource-4.1.15-8.2 kernel-obs-qa-4.1.15-8.1 kernel-obs-qa-xen-4.1.15-8.1 kernel-syms-4.1.15-8.1 - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.15-8.1 kernel-debug-base-4.1.15-8.1 kernel-debug-base-debuginfo-4.1.15-8.1 kernel-debug-debuginfo-4.1.15-8.1 kernel-debug-debugsource-4.1.15-8.1 kernel-debug-devel-4.1.15-8.1 kernel-debug-devel-debuginfo-4.1.15-8.1 kernel-ec2-4.1.15-8.1 kernel-ec2-base-4.1.15-8.1 kernel-ec2-base-debuginfo-4.1.15-8.1 kernel-ec2-debuginfo-4.1.15-8.1 kernel-ec2-debugsource-4.1.15-8.1 kernel-ec2-devel-4.1.15-8.1 kernel-pv-4.1.15-8.1 kernel-pv-base-4.1.15-8.1 kernel-pv-base-debuginfo-4.1.15-8.1 kernel-pv-debuginfo-4.1.15-8.1 kernel-pv-debugsource-4.1.15-8.1 kernel-pv-devel-4.1.15-8.1 kernel-vanilla-4.1.15-8.1 kernel-vanilla-debuginfo-4.1.15-8.1 kernel-vanilla-debugsource-4.1.15-8.1 kernel-vanilla-devel-4.1.15-8.1 kernel-xen-4.1.15-8.1 kernel-xen-base-4.1.15-8.1 kernel-xen-base-debuginfo-4.1.15-8.1 kernel-xen-debuginfo-4.1.15-8.1 kernel-xen-debugsource-4.1.15-8.1 kernel-xen-devel-4.1.15-8.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.15-8.1 kernel-docs-4.1.15-8.3 kernel-docs-html-4.1.15-8.3 kernel-docs-pdf-4.1.15-8.3 kernel-macros-4.1.15-8.1 kernel-source-4.1.15-8.1 kernel-source-vanilla-4.1.15-8.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.15-8.1 kernel-pae-base-4.1.15-8.1 kernel-pae-base-debuginfo-4.1.15-8.1 kernel-pae-debuginfo-4.1.15-8.1 kernel-pae-debugsource-4.1.15-8.1 kernel-pae-devel-4.1.15-8.1 References: https://www.suse.com/security/cve/CVE-2015-7550.html https://www.suse.com/security/cve/CVE-2015-8539.html https://www.suse.com/security/cve/CVE-2015-8543.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8551.html https://www.suse.com/security/cve/CVE-2015-8552.html https://www.suse.com/security/cve/CVE-2015-8569.html https://www.suse.com/security/cve/CVE-2015-8575.html https://www.suse.com/security/cve/CVE-2015-8767.html https://www.suse.com/security/cve/CVE-2016-0728.html https://bugzilla.suse.com/865096 https://bugzilla.suse.com/865259 https://bugzilla.suse.com/913996 https://bugzilla.suse.com/950178 https://bugzilla.suse.com/950998 https://bugzilla.suse.com/952621 https://bugzilla.suse.com/954324 https://bugzilla.suse.com/954532 https://bugzilla.suse.com/954647 https://bugzilla.suse.com/955422 https://bugzilla.suse.com/956708 https://bugzilla.suse.com/957152 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/957990 https://bugzilla.suse.com/958439 https://bugzilla.suse.com/958463 https://bugzilla.suse.com/958504 https://bugzilla.suse.com/958510 https://bugzilla.suse.com/958886 https://bugzilla.suse.com/958951 https://bugzilla.suse.com/959190 https://bugzilla.suse.com/959399 https://bugzilla.suse.com/960021 https://bugzilla.suse.com/960710 https://bugzilla.suse.com/961263 https://bugzilla.suse.com/961509 https://bugzilla.suse.com/962075 https://bugzilla.suse.com/962597 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0279-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 28 Jan '16

28 Jan '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0279-1 Rating: critical References: #939523 #960996 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions The following bugs were fixed: - bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move libjavagtk to full package This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-115=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-25.1 java-1_7_0-openjdk-accessibility-1.7.0.95-25.1 java-1_7_0-openjdk-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-debugsource-1.7.0.95-25.1 java-1_7_0-openjdk-demo-1.7.0.95-25.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-devel-1.7.0.95-25.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-headless-1.7.0.95-25.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-src-1.7.0.95-25.1 - openSUSE Leap 42.1 (x86_64): java-1_7_0-openjdk-bootstrap-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.95-25.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.95-25.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.95-25.1 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0272-1: important: Security update for Java7
by opensuse-security＠opensuse.org 28 Jan '16

28 Jan '16

openSUSE Security Update: Security update for Java7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0272-1 Rating: important References: #939523 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Update OpenJDK to 7u95 / IcedTea 2.6.4 including the following fixes: * Security fixes - S8059054, CVE-2016-0402: Better URL processing - S8130710, CVE-2016-0448: Better attributes processing - S8132210: Reinforce JMX collector internals - S8132988: Better printing dialogues - S8133962, CVE-2016-0466: More general limits - S8137060: JMX memory management improvements - S8139012: Better font substitutions - S8139017, CVE-2016-0483: More stable image decoding - S8140543, CVE-2016-0494: Arrange font actions - S8143185: Cleanup for handling proxies - S8143941, CVE-2015-8126, CVE-2015-8472: Update splashscreen displays - S8144773, CVE-2015-7575: Further reduce use of MD5 (SLOTH) - S8142882, CVE-2015-4871: rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed * Import of OpenJDK 7 u95 build 0 - S7167988: PKIX CertPathBuilder in reverse mode doesn't work if more than one trust anchor is specified - S8068761: [TEST_BUG] java/nio/channels/ServerSocketChannel/AdaptServerSocket.java failed with SocketTimeoutException - S8074068: Cleanup in src/share/classes/sun/security/x509/ - S8075773: jps running as root fails after the fix of JDK-8050807 - S8081297: SSL Problem with Tomcat - S8131181: Increment minor version of HSx for 7u95 and initialize the build number - S8132082: Let OracleUcrypto accept RSAPrivateKey - S8134605: Partial rework of the fix for 8081297 - S8134861: XSLT: Extension func call cause exception if namespace URI contains partial package name - S8135307: CompletionFailure thrown when calling FieldDoc.type, if the field's type is missing - S8138716: (tz) Support tzdata2015g - S8140244: Port fix of JDK-8075773 to MacOSX - S8141213: [Parfait]Potentially blocking function GetArrayLength called in JNI critical region at line 239 of jdk/src/share/native/sun/awt/image/jpeg/jpegdecoder.c in function GET_ARRAYS - S8141287: Add MD5 to jdk.certpath.disabledAlgorithms - Take 2 - S8142928: [TEST_BUG] sun/security/provider/certpath/ReverseBuilder/ReverseBuild.java 8u71 failure - S8143132: L10n resource file translation update - S8144955: Wrong changes were pushed with 8143942 - S8145551: Test failed with Crash for Improved font lookups - S8147466: Add -fno-strict-overflow to IndicRearrangementProcessor{,2}.cpp * Backports - S8140244: Port fix of JDK-8075773 to AIX - S8133196, PR2712, RH1251935: HTTPS hostname invalid issue with InetAddress - S8140620, PR2710: Find and load default.sf2 as the default soundbank on Linux Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-110=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-24.27.1 java-1_7_0-openjdk-accessibility-1.7.0.95-24.27.1 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-debugsource-1.7.0.95-24.27.1 java-1_7_0-openjdk-demo-1.7.0.95-24.27.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-devel-1.7.0.95-24.27.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-headless-1.7.0.95-24.27.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-src-1.7.0.95-24.27.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.95-24.27.1 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0271-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0271-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-109=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-48.0.2564.82-122.1 chromedriver-debuginfo-48.0.2564.82-122.1 chromium-48.0.2564.82-122.1 chromium-debuginfo-48.0.2564.82-122.1 chromium-debugsource-48.0.2564.82-122.1 chromium-desktop-gnome-48.0.2564.82-122.1 chromium-desktop-kde-48.0.2564.82-122.1 chromium-ffmpegsumo-48.0.2564.82-122.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-122.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0270-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0270-1 Rating: critical References: #951376 #960996 #962743 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743) The following vulnerabilities were fixed: - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Includes the following fixes from the October 2015 update: (bsc#951376) - CVE-2015-4734: A remote user can exploit a flaw in the Embedded JGSS component to partially access data - CVE-2015-4803: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4805: A remote user can exploit a flaw in the Embedded Serialization component to gain elevated privileges - CVE-2015-4806: A remote user can exploit a flaw in the Java SE Embedded Libraries component to partially access and partially modify data - CVE-2015-4835: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4842: A remote user can exploit a flaw in the Embedded JAXP component to partially access data - CVE-2015-4843: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4844: A remote user can exploit a flaw in the Embedded 2D component to gain elevated privileges - CVE-2015-4860: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4872: A remote user can exploit a flaw in the JRockit Security component to partially modify data []. - CVE-2015-4881: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4882: A remote user can exploit a flaw in the Embedded CORBA component to cause partial denial of service conditions - CVE-2015-4883: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4893: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4902: A remote user can exploit a flaw in the Java SE Deployment component to partially modify data - CVE-2015-4903: A remote user can exploit a flaw in the Embedded RMI component to partially access data - CVE-2015-4911: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4810: A local user can exploit a flaw in the Java SE Deployment component to gain elevated privileges - CVE-2015-4840: A remote user can exploit a flaw in the Embedded 2D component to partially access data - CVE-2015-4868: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4901: A remote user can exploit a flaw in the JavaFX component to gain elevated privileges - CVE-2015-4906: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4908: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4916: A remote user can exploit a flaw in the JavaFX component to partially access data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-106=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.72-6.1 java-1_8_0-openjdk-accessibility-1.8.0.72-6.1 java-1_8_0-openjdk-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-debugsource-1.8.0.72-6.1 java-1_8_0-openjdk-demo-1.8.0.72-6.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-devel-1.8.0.72-6.1 java-1_8_0-openjdk-headless-1.8.0.72-6.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-src-1.8.0.72-6.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.72-6.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4868.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4901.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4906.html https://www.suse.com/security/cve/CVE-2015-4908.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-4916.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/951376 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0269-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0269-1 Rating: critical References: #960996 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-java-1_7_0-openjdk-12374=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk-12374=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-java-1_7_0-openjdk-12374=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-java-1_7_0-openjdk-12374=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-0.17.2 java-1_7_0-openjdk-demo-1.7.0.95-0.17.2 java-1_7_0-openjdk-devel-1.7.0.95-0.17.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-0.17.2 java-1_7_0-openjdk-demo-1.7.0.95-0.17.2 java-1_7_0-openjdk-devel-1.7.0.95-0.17.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): java-1_7_0-openjdk-debuginfo-1.7.0.95-0.17.2 java-1_7_0-openjdk-debugsource-1.7.0.95-0.17.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): java-1_7_0-openjdk-debuginfo-1.7.0.95-0.17.2 java-1_7_0-openjdk-debugsource-1.7.0.95-0.17.2 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0268-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0268-1 Rating: critical References: #939523 #960996 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions The following bugs were fixed: - bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move libjavagtk to full package Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-107=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-16.1 java-1_7_0-openjdk-accessibility-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-debugsource-1.7.0.95-16.1 java-1_7_0-openjdk-demo-1.7.0.95-16.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-devel-1.7.0.95-16.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-headless-1.7.0.95-16.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-src-1.7.0.95-16.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.95-16.1 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0265-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0265-1 Rating: critical References: #939523 #960996 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions The following bugs were fixed: - bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move libjavagtk to full package Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-169=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-169=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-169=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-169=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.95-24.2 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-debugsource-1.7.0.95-24.2 java-1_7_0-openjdk-demo-1.7.0.95-24.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-devel-1.7.0.95-24.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-headless-1.7.0.95-24.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.95-24.2 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-debugsource-1.7.0.95-24.2 java-1_7_0-openjdk-demo-1.7.0.95-24.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-devel-1.7.0.95-24.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-headless-1.7.0.95-24.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_7_0-openjdk-1.7.0.95-24.2 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-debugsource-1.7.0.95-24.2 java-1_7_0-openjdk-headless-1.7.0.95-24.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2 - SUSE Linux Enterprise Desktop 12 (x86_64): java-1_7_0-openjdk-1.7.0.95-24.2 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.2 java-1_7_0-openjdk-debugsource-1.7.0.95-24.2 java-1_7_0-openjdk-headless-1.7.0.95-24.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.2 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0263-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0263-1 Rating: critical References: #960996 #962743 Cross-References: CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-105=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.72-21.1 java-1_8_0-openjdk-accessibility-1.8.0.72-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-debugsource-1.8.0.72-21.1 java-1_8_0-openjdk-demo-1.8.0.72-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-devel-1.8.0.72-21.1 java-1_8_0-openjdk-headless-1.8.0.72-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-src-1.8.0.72-21.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.72-21.1 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0262-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

SUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0262-1 Rating: important References: #937766 #945582 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: SUSE Studio Onsite 1.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-openldap2-20160114-12372=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): openldap2-devel-2.4.26-0.17.23.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0