May 2016 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] openSUSE-SU-2016:1265-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1265-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-573=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.101-31.1 java-1_7_0-openjdk-accessibility-1.7.0.101-31.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-demo-1.7.0.101-31.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-devel-1.7.0.101-31.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-headless-1.7.0.101-31.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-src-1.7.0.101-31.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.101-31.1 - openSUSE Leap 42.1 (x86_64): java-1_7_0-openjdk-bootstrap-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.101-31.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1262-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1262-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-572=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.91-12.1 java-1_8_0-openjdk-accessibility-1.8.0.91-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-debugsource-1.8.0.91-12.1 java-1_8_0-openjdk-demo-1.8.0.91-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-devel-1.8.0.91-12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-headless-1.8.0.91-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-src-1.8.0.91-12.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.91-12.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1261-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1261-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: The update disables various insecure coders [boo#978061] These fix issues tracked in CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, CVE-2016-3718 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-569=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-18.1 ImageMagick-debuginfo-6.8.9.8-18.1 ImageMagick-debugsource-6.8.9.8-18.1 ImageMagick-devel-6.8.9.8-18.1 ImageMagick-extra-6.8.9.8-18.1 ImageMagick-extra-debuginfo-6.8.9.8-18.1 libMagick++-6_Q16-5-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-18.1 libMagick++-devel-6.8.9.8-18.1 libMagickCore-6_Q16-2-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-18.1 libMagickWand-6_Q16-2-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-18.1 perl-PerlMagick-6.8.9.8-18.1 perl-PerlMagick-debuginfo-6.8.9.8-18.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-18.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-18.1 libMagick++-devel-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1260-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1260-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing "/etc/ImageMagick-*/policy.xml" (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-733=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-733=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-733=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-733=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-733=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-733=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-733=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-733=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 ImageMagick-devel-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagick++-devel-6.8.8.1-19.1 perl-PerlMagick-6.8.8.1-19.1 perl-PerlMagick-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 ImageMagick-devel-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagick++-devel-6.8.8.1-19.1 perl-PerlMagick-6.8.8.1-19.1 perl-PerlMagick-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Desktop 12 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1258-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1258-1 Rating: important References: #977333 #977374 #977376 #977381 #977386 Cross-References: CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update to MozillaFirefox 38.8.0 ESR fixes the following issues (bsc#977333): - CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-732=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-732=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-732=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-732=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-732=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-732=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-devel-38.8.0esr-66.2 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-devel-38.8.0esr-66.2 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 References: https://www.suse.com/security/cve/CVE-2016-2805.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2808.html https://www.suse.com/security/cve/CVE-2016-2814.html https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977374 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/977381 https://bugzilla.suse.com/977386 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1250-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1250-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-725=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-725=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-725=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-725=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-demo-1.7.0.101-30.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-devel-1.7.0.101-30.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-demo-1.7.0.101-30.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-devel-1.7.0.101-30.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Desktop 12 (x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1248-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1248-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-724=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-724=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.91-11.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-debugsource-1.8.0.91-11.1 java-1_8_0-openjdk-demo-1.8.0.91-11.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-devel-1.8.0.91-11.1 java-1_8_0-openjdk-headless-1.8.0.91-11.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_8_0-openjdk-1.8.0.91-11.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-debugsource-1.8.0.91-11.1 java-1_8_0-openjdk-headless-1.8.0.91-11.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1247-1: important: Security update for ntp
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1247-1 Rating: important References: #782060 #905885 #910063 #916617 #920238 #926510 #936327 #937837 #942587 #944300 #946386 #951559 #951608 #951629 #954982 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 28 vulnerabilities and has two fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 28 security issues. Major functional changes: - The "sntp" commandline tool changed its option handling in a major way, some options have been renamed or dropped. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. - The local clock is being disabled during update. - ntpd is no longer running chrooted. Other functional changes: - ntp-signd is installed. - "enable mode7" can be added to the configuration to allow ntdpc to work as compatibility mode option. - "kod" was removed from the default restrictions. - SHA1 keys are used by default instead of MD5 keys. Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608). - CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608). - CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608). - CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608). - CVE-2015-7850: remote config logfile-keyfile (bsc#951608). - CVE-2015-7849: trusted key use-after-free (bsc#951608). - CVE-2015-7848: mode 7 loop counter underrun (bsc#951608). - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608). - CVE-2015-7703: configuration directives "pidfile" and "driftfile" should only be allowed locally (bsc#951608). - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608). - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq. - bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution. - bsc#905885: Use SHA1 instead of MD5 for symmetric keys. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - Fix legacy action scripts to pass on command line arguments. - bsc#944300: Remove "kod" from the restrict line in ntp.conf. - bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd. - Add a controlkey to ntp.conf to make the above work. - Don't let "keysdir" lines in ntp.conf trigger the "keys" parser. - Disable mode 7 (ntpdc) again, now that we don't use it anymore. - Add "addserver" as a new legacy action. - bsc#910063: Fix the comment regarding addserver in ntp.conf. - bsc#926510: Disable chroot by default. - bsc#920238: Enable ntpdc for backwards compatibility. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-727=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-727=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-727=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (noarch): yast2-ntp-client-devel-doc-3.1.12.4-8.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ntp-4.2.8p6-46.5.2 ntp-debuginfo-4.2.8p6-46.5.2 ntp-debugsource-4.2.8p6-46.5.2 ntp-doc-4.2.8p6-46.5.2 - SUSE Linux Enterprise Server 12 (noarch): yast2-ntp-client-3.1.12.4-8.2 - SUSE Linux Enterprise Desktop 12 (noarch): yast2-ntp-client-3.1.12.4-8.2 - SUSE Linux Enterprise Desktop 12 (x86_64): ntp-4.2.8p6-46.5.2 ntp-debuginfo-4.2.8p6-46.5.2 ntp-debugsource-4.2.8p6-46.5.2 ntp-doc-4.2.8p6-46.5.2 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7691.html https://www.suse.com/security/cve/CVE-2015-7692.html https://www.suse.com/security/cve/CVE-2015-7701.html https://www.suse.com/security/cve/CVE-2015-7702.html https://www.suse.com/security/cve/CVE-2015-7703.html https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7848.html https://www.suse.com/security/cve/CVE-2015-7849.html https://www.suse.com/security/cve/CVE-2015-7850.html https://www.suse.com/security/cve/CVE-2015-7851.html https://www.suse.com/security/cve/CVE-2015-7852.html https://www.suse.com/security/cve/CVE-2015-7853.html https://www.suse.com/security/cve/CVE-2015-7854.html https://www.suse.com/security/cve/CVE-2015-7855.html https://www.suse.com/security/cve/CVE-2015-7871.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/905885 https://bugzilla.suse.com/910063 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/920238 https://bugzilla.suse.com/926510 https://bugzilla.suse.com/936327 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/942587 https://bugzilla.suse.com/944300 https://bugzilla.suse.com/946386 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951608 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/954982 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1243-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1243-1 Rating: important References: #958501 #976942 #976943 #977614 #977615 #977616 #977617 #977621 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse - bsc#977621: Preserve negotiated digests for SNI (bsc#977621) - bsc#958501: Fix openssl enc -non-fips-allow option in FIPS mode (bsc#958501) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-564=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-15.1 libopenssl1_0_0-1.0.1i-15.1 libopenssl1_0_0-debuginfo-1.0.1i-15.1 libopenssl1_0_0-hmac-1.0.1i-15.1 openssl-1.0.1i-15.1 openssl-debuginfo-1.0.1i-15.1 openssl-debugsource-1.0.1i-15.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-15.1 libopenssl1_0_0-32bit-1.0.1i-15.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-15.1 libopenssl1_0_0-hmac-32bit-1.0.1i-15.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-15.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/958501 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617 https://bugzilla.suse.com/977621 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1242-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1242-1 Rating: important References: #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-565=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-565=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl0_9_8-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-0.9.8zh-17.1 libopenssl0_9_8-debugsource-0.9.8zh-17.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-17.1 - openSUSE 13.2 (i586 x86_64): libopenssl0_9_8-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-0.9.8zh-9.6.1 libopenssl0_9_8-debugsource-0.9.8zh-9.6.1 - openSUSE 13.2 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-9.6.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0