May 2016 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] SUSE-SU-2016:1458-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 31 May '16

31 May '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1458-1 Rating: important References: #977646 #977648 #977650 #979252 #981087 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_6_0-ibm fixes the following issues: - Update to sr16 fp26 to fix a regression in TLS connections. (bsc#981087) - IBM Java 1.6.0 SR16 FP25 released (bsc#977646 bsc#977648 bsc#977650 bsc#979252) CVE-2016-0376 CVE-2016-0264 CVE-2016-0363 CVE-2016-3443 CVE-2016-0687 CVE-2016-0686 CVE-2016-3427 CVE-2016-3449 CVE-2016-3422 CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-865=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.26-37.1 java-1_6_0-ibm-fonts-1.6.0_sr16.26-37.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.26-37.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.26-37.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 https://bugzilla.suse.com/981087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1457-1: important: Security update for cyrus-imapd
by opensuse-security＠opensuse.org 31 May '16

31 May '16

SUSE Security Update: Security update for cyrus-imapd ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1457-1 Rating: important References: #860611 #901748 #954200 #954201 #981670 Cross-References: CVE-2014-3566 CVE-2015-8076 CVE-2015-8077 CVE-2015-8078 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: - Previous versions of cyrus-imapd would not allow its users to disable old protocols like SSLv1 and SSLv2 that are unsafe due to various known attacks like BEAST and POODLE. https://bugzilla.cyrusimap.org/show_bug.cgi?id=3867 remedies this issue by adding the configuration option 'tls_versions' to the imapd.conf file. Note that users who upgrade existing installation of this package will *not* have their imapd.conf file overwritten, i.e. their IMAP server will continue to support SSLv1 and SSLv2 like before. To disable support for those protocols, it's necessary to edit imapd.conf manually to state "tls_versions: tls1_0 tls1_1 tls1_2". New installations, however, will have an imapd.conf file that contains these settings already, i.e. newly installed IMAP servers do *not* support SSLv1 and SSLv2 unless that support is explicitly enabled by the user. (bsc#901748) - An integer overflow vulnerability in cyrus-imapd's urlfetch range checking code was fixed. (CVE-2015-8076, CVE-2015-8077, CVE-2015-8078, bsc#981670, bsc#954200, bsc#954201) - Support for Elliptic Curve Diffie–Hellman (ECDH) has been added to cyrus-imapd. (bsc#860611) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-864=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-864=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): cyrus-imapd-debuginfo-2.3.18-37.1 cyrus-imapd-debugsource-2.3.18-37.1 perl-Cyrus-IMAP-2.3.18-37.1 perl-Cyrus-IMAP-debuginfo-2.3.18-37.1 perl-Cyrus-SIEVE-managesieve-2.3.18-37.1 perl-Cyrus-SIEVE-managesieve-debuginfo-2.3.18-37.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): cyrus-imapd-debuginfo-2.3.18-37.1 cyrus-imapd-debugsource-2.3.18-37.1 perl-Cyrus-IMAP-2.3.18-37.1 perl-Cyrus-IMAP-debuginfo-2.3.18-37.1 perl-Cyrus-SIEVE-managesieve-2.3.18-37.1 perl-Cyrus-SIEVE-managesieve-debuginfo-2.3.18-37.1 References: https://www.suse.com/security/cve/CVE-2014-3566.html https://www.suse.com/security/cve/CVE-2015-8076.html https://www.suse.com/security/cve/CVE-2015-8077.html https://www.suse.com/security/cve/CVE-2015-8078.html https://bugzilla.suse.com/860611 https://bugzilla.suse.com/901748 https://bugzilla.suse.com/954200 https://bugzilla.suse.com/954201 https://bugzilla.suse.com/981670 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1445-1: important: Security update for Xen
by opensuse-security＠opensuse.org 30 May '16

30 May '16

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1445-1 Rating: important References: #960726 #962627 #964925 #964947 #965315 #965317 #967101 #969351 Cross-References: CVE-2014-0222 CVE-2014-7815 CVE-2015-5278 CVE-2015-8743 CVE-2016-2270 CVE-2016-2271 CVE-2016-2391 CVE-2016-2841 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: Xen was updated to fix the following security issues: * CVE-2016-2841: net: ne2000: infinite loop in ne2000_receive (bsc#969351) * CVE-2016-2391: usb: multiple eof_timers in ohci module leads to null pointer dereference (bsc#967101) * CVE-2016-2270: x86: inconsistent cachability flags on guest mappings (XSA-154) (bsc#965315) * CVE-2016-2271: VMX: guest user mode may crash guest with non-canonical RIP (XSA-170) (bsc#965317) * CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947) * CVE-2014-0222: qcow1: validate L2 table size to avoid integer overflows (bsc#964925) * CVE-2014-7815: vnc: insufficient bits_per_pixel from the client sanitization (bsc#962627) * CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726) Security Issues: * CVE-2016-2841 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2841> * CVE-2016-2391 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2391> * CVE-2016-2270 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2270> * CVE-2016-2271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2271> * CVE-2015-5278 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5278> * CVE-2014-0222 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222> * CVE-2014-7815 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7815> * CVE-2015-8743 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8743> Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): xen-3.2.3_17040_46-0.25.1 xen-devel-3.2.3_17040_46-0.25.1 xen-doc-html-3.2.3_17040_46-0.25.1 xen-doc-pdf-3.2.3_17040_46-0.25.1 xen-doc-ps-3.2.3_17040_46-0.25.1 xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-libs-3.2.3_17040_46-0.25.1 xen-tools-3.2.3_17040_46-0.25.1 xen-tools-domU-3.2.3_17040_46-0.25.1 xen-tools-ioemu-3.2.3_17040_46-0.25.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): xen-libs-32bit-3.2.3_17040_46-0.25.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.132.8-0.25.1 References: https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-7815.html https://www.suse.com/security/cve/CVE-2015-5278.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2016-2270.html https://www.suse.com/security/cve/CVE-2016-2271.html https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2841.html https://bugzilla.suse.com/960726 https://bugzilla.suse.com/962627 https://bugzilla.suse.com/964925 https://bugzilla.suse.com/964947 https://bugzilla.suse.com/965315 https://bugzilla.suse.com/965317 https://bugzilla.suse.com/967101 https://bugzilla.suse.com/969351 https://download.suse.com/patch/finder/?keywords=5674a3bc2ab2548e9b2b0ec997… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1441-1: important: Security update for expat
by opensuse-security＠opensuse.org 30 May '16

30 May '16

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1441-1 Rating: important References: #979441 #980391 Cross-References: CVE-2015-1283 CVE-2016-0718 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following security issues: - CVE-2015-1283: Fixed multiple integer overflows that could lead to buffer overflows [boo#980391] - CVE-2016-0718: Fixed Expat XML parser that mishandles certain kinds of malformed input documents [boo#979441]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-660=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): expat-2.1.0-14.3.1 expat-debuginfo-2.1.0-14.3.1 expat-debugsource-2.1.0-14.3.1 libexpat-devel-2.1.0-14.3.1 libexpat1-2.1.0-14.3.1 libexpat1-debuginfo-2.1.0-14.3.1 - openSUSE 13.2 (x86_64): expat-debuginfo-32bit-2.1.0-14.3.1 libexpat-devel-32bit-2.1.0-14.3.1 libexpat1-32bit-2.1.0-14.3.1 libexpat1-debuginfo-32bit-2.1.0-14.3.1 References: https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2016-0718.html https://bugzilla.suse.com/979441 https://bugzilla.suse.com/980391 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1433-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 28 May '16

28 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1433-1 Rating: important References: #981886 Cross-References: CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683 CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: Chromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886): - CVE-2016-1672: Cross-origin bypass in extension bindings - CVE-2016-1673: Cross-origin bypass in Blink - CVE-2016-1674: Cross-origin bypass in extensions - CVE-2016-1675: Cross-origin bypass in Blink - CVE-2016-1676: Cross-origin bypass in extension bindings - CVE-2016-1677: Type confusion in V8 - CVE-2016-1678: Heap overflow in V8 - CVE-2016-1679: Heap use-after-free in V8 bindings - CVE-2016-1680: Heap use-after-free in Skia - CVE-2016-1681: Heap overflow in PDFium - CVE-2016-1682: CSP bypass for ServiceWorker - CVE-2016-1683: Out-of-bounds access in libxslt - CVE-2016-1684: Integer overflow in libxslt - CVE-2016-1685: Out-of-bounds read in PDFium - CVE-2016-1686: Out-of-bounds read in PDFium - CVE-2016-1687: Information leak in extensions - CVE-2016-1688: Out-of-bounds read in V8 - CVE-2016-1689: Heap buffer overflow in media - CVE-2016-1690: Heap use-after-free in Autofill - CVE-2016-1691: Heap buffer-overflow in Skia - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker - CVE-2016-1693: HTTP Download of Software Removal Tool - CVE-2016-1694: HPKP pins removed on cache clearance - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-652=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-51.0.2704.63-78.1 chromedriver-debuginfo-51.0.2704.63-78.1 chromium-51.0.2704.63-78.1 chromium-debuginfo-51.0.2704.63-78.1 chromium-debugsource-51.0.2704.63-78.1 chromium-desktop-gnome-51.0.2704.63-78.1 chromium-desktop-kde-51.0.2704.63-78.1 chromium-ffmpegsumo-51.0.2704.63-78.1 chromium-ffmpegsumo-debuginfo-51.0.2704.63-78.1 References: https://www.suse.com/security/cve/CVE-2016-1672.html https://www.suse.com/security/cve/CVE-2016-1673.html https://www.suse.com/security/cve/CVE-2016-1674.html https://www.suse.com/security/cve/CVE-2016-1675.html https://www.suse.com/security/cve/CVE-2016-1676.html https://www.suse.com/security/cve/CVE-2016-1677.html https://www.suse.com/security/cve/CVE-2016-1678.html https://www.suse.com/security/cve/CVE-2016-1679.html https://www.suse.com/security/cve/CVE-2016-1680.html https://www.suse.com/security/cve/CVE-2016-1681.html https://www.suse.com/security/cve/CVE-2016-1682.html https://www.suse.com/security/cve/CVE-2016-1683.html https://www.suse.com/security/cve/CVE-2016-1684.html https://www.suse.com/security/cve/CVE-2016-1685.html https://www.suse.com/security/cve/CVE-2016-1686.html https://www.suse.com/security/cve/CVE-2016-1687.html https://www.suse.com/security/cve/CVE-2016-1688.html https://www.suse.com/security/cve/CVE-2016-1689.html https://www.suse.com/security/cve/CVE-2016-1690.html https://www.suse.com/security/cve/CVE-2016-1691.html https://www.suse.com/security/cve/CVE-2016-1692.html https://www.suse.com/security/cve/CVE-2016-1693.html https://www.suse.com/security/cve/CVE-2016-1694.html https://www.suse.com/security/cve/CVE-2016-1695.html https://bugzilla.suse.com/981886 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1430-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 28 May '16

28 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1430-1 Rating: important References: #981886 Cross-References: CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683 CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: Chromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886): - CVE-2016-1672: Cross-origin bypass in extension bindings - CVE-2016-1673: Cross-origin bypass in Blink - CVE-2016-1674: Cross-origin bypass in extensions - CVE-2016-1675: Cross-origin bypass in Blink - CVE-2016-1676: Cross-origin bypass in extension bindings - CVE-2016-1677: Type confusion in V8 - CVE-2016-1678: Heap overflow in V8 - CVE-2016-1679: Heap use-after-free in V8 bindings - CVE-2016-1680: Heap use-after-free in Skia - CVE-2016-1681: Heap overflow in PDFium - CVE-2016-1682: CSP bypass for ServiceWorker - CVE-2016-1683: Out-of-bounds access in libxslt - CVE-2016-1684: Integer overflow in libxslt - CVE-2016-1685: Out-of-bounds read in PDFium - CVE-2016-1686: Out-of-bounds read in PDFium - CVE-2016-1687: Information leak in extensions - CVE-2016-1688: Out-of-bounds read in V8 - CVE-2016-1689: Heap buffer overflow in media - CVE-2016-1690: Heap use-after-free in Autofill - CVE-2016-1691: Heap buffer-overflow in Skia - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker - CVE-2016-1693: HTTP Download of Software Removal Tool - CVE-2016-1694: HPKP pins removed on cache clearance - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-652=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-51.0.2704.63-51.1 chromedriver-debuginfo-51.0.2704.63-51.1 chromium-51.0.2704.63-51.1 chromium-debuginfo-51.0.2704.63-51.1 chromium-debugsource-51.0.2704.63-51.1 chromium-desktop-gnome-51.0.2704.63-51.1 chromium-desktop-kde-51.0.2704.63-51.1 chromium-ffmpegsumo-51.0.2704.63-51.1 chromium-ffmpegsumo-debuginfo-51.0.2704.63-51.1 References: https://www.suse.com/security/cve/CVE-2016-1672.html https://www.suse.com/security/cve/CVE-2016-1673.html https://www.suse.com/security/cve/CVE-2016-1674.html https://www.suse.com/security/cve/CVE-2016-1675.html https://www.suse.com/security/cve/CVE-2016-1676.html https://www.suse.com/security/cve/CVE-2016-1677.html https://www.suse.com/security/cve/CVE-2016-1678.html https://www.suse.com/security/cve/CVE-2016-1679.html https://www.suse.com/security/cve/CVE-2016-1680.html https://www.suse.com/security/cve/CVE-2016-1681.html https://www.suse.com/security/cve/CVE-2016-1682.html https://www.suse.com/security/cve/CVE-2016-1683.html https://www.suse.com/security/cve/CVE-2016-1684.html https://www.suse.com/security/cve/CVE-2016-1685.html https://www.suse.com/security/cve/CVE-2016-1686.html https://www.suse.com/security/cve/CVE-2016-1687.html https://www.suse.com/security/cve/CVE-2016-1688.html https://www.suse.com/security/cve/CVE-2016-1689.html https://www.suse.com/security/cve/CVE-2016-1690.html https://www.suse.com/security/cve/CVE-2016-1691.html https://www.suse.com/security/cve/CVE-2016-1692.html https://www.suse.com/security/cve/CVE-2016-1693.html https://www.suse.com/security/cve/CVE-2016-1694.html https://www.suse.com/security/cve/CVE-2016-1695.html https://bugzilla.suse.com/981886 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1388-1: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 24 May '16

24 May '16

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1388-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.6.0 SR16 FP25 release fixes the following issues: Security issues fixed: * CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) * CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) * CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) * The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Security Issues: * CVE-2016-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0376> * CVE-2016-0363 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0363> * CVE-2016-0264 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0264> * CVE-2016-3443 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3443> * CVE-2016-0687 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0687> * CVE-2016-0686 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0686> * CVE-2016-3427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3427> * CVE-2016-3449 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3449> * CVE-2016-3422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3422> * CVE-2016-3426 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3426> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.25-0.11.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-0.11.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-0.11.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-0.11.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.25-0.11.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.25-0.11.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.25-0.11.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.25-0.11.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.25-0.11.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.25-0.11.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 https://download.suse.com/patch/finder/?keywords=133b4d37ec640a121ad2dbcba2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1382-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 23 May '16

23 May '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1382-1 Rating: important References: #957988 #970892 #970911 #970948 #970955 #970956 #970958 #970970 #971124 #971360 #971628 #972174 #973378 #974418 #975868 Cross-References: CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2847 CVE-2016-3136 CVE-2016-3137 CVE-2016-3138 CVE-2016-3140 CVE-2016-3156 CVE-2016-3689 CVE-2016-3951 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has four fixes is now available. Description: The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-2847: Limit the per-user amount of pages allocated in pipes (bsc#970948). - CVE-2016-3136: mct_u232: add sanity checking in probe (bnc#970955). - CVE-2016-2188: iowarrior: fix oops with malicious USB descriptors (bnc#970956). - CVE-2016-3138: cdc-acm: more sanity checking (bnc#970911). - CVE-2016-3137: cypress_m8: add endpoint sanity check (bnc#970970). - CVE-2016-3951: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind (bnc#974418). - CVE-2016-3140: digi_acceleport: do sanity checking for the number of ports (bnc#970892). - CVE-2016-2186: powermate: fix oops with malicious USB descriptors (bnc#970958). - CVE-2016-2185: usb_driver_claim_interface: add sanity checking (bnc#971124). - CVE-2016-3689: ims-pcu: sanity check against missing interfaces (bnc#971628). - CVE-2016-3156: ipv4: Do not do expensive useless work during inetdev destroy (bsc#971360). The following non-security bugs were fixed: - ALSA: timer: Call notifier in the same spinlock (bsc#973378). - ALSA: timer: Protect the whole snd_timer_close() with open race (bsc#973378). - ALSA: timer: Sync timer deletion at closing the system timer (bsc#973378). - ALSA: timer: Use mod_timer() for rearming the system timer (bsc#973378). - Backport arm64 patches from SLE12-SP1-ARM - Fix kABI additions for pipe: limit the per-user amount of pages allocated in pipes. - Revert "drm/radeon: call hpd_irq_event on resume" (boo#975868). - Update config files. Enable RTC_HCTOSYS, build I2C_XGENE_SLIMPRO as a module. - backends: guarantee one time reads of shared ring contents (bsc#957988). - ext4: fix races between buffered IO and collapse / insert range (bsc#972174). - ext4: fix races between page faults and hole punching (bsc#972174). - ext4: fix races of writeback with punch hole and zero range (bsc#972174). - ext4: move unlocked dio protection from ext4_alloc_file_blocks() (bsc#972174). - net: thunderx: Use napi_schedule_irqoff() - netback: do not use last request to determine minimum Tx credit (bsc#957988). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-629=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.21-14.2 kernel-debug-base-4.1.21-14.2 kernel-debug-base-debuginfo-4.1.21-14.2 kernel-debug-debuginfo-4.1.21-14.2 kernel-debug-debugsource-4.1.21-14.2 kernel-debug-devel-4.1.21-14.2 kernel-debug-devel-debuginfo-4.1.21-14.2 kernel-ec2-4.1.21-14.2 kernel-ec2-base-4.1.21-14.2 kernel-ec2-base-debuginfo-4.1.21-14.2 kernel-ec2-debuginfo-4.1.21-14.2 kernel-ec2-debugsource-4.1.21-14.2 kernel-ec2-devel-4.1.21-14.2 kernel-pv-4.1.21-14.2 kernel-pv-base-4.1.21-14.2 kernel-pv-base-debuginfo-4.1.21-14.2 kernel-pv-debuginfo-4.1.21-14.2 kernel-pv-debugsource-4.1.21-14.2 kernel-pv-devel-4.1.21-14.2 kernel-vanilla-4.1.21-14.2 kernel-vanilla-debuginfo-4.1.21-14.2 kernel-vanilla-debugsource-4.1.21-14.2 kernel-vanilla-devel-4.1.21-14.2 kernel-xen-4.1.21-14.2 kernel-xen-base-4.1.21-14.2 kernel-xen-base-debuginfo-4.1.21-14.2 kernel-xen-debuginfo-4.1.21-14.2 kernel-xen-debugsource-4.1.21-14.2 kernel-xen-devel-4.1.21-14.2 - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.21-14.2 kernel-default-base-4.1.21-14.2 kernel-default-base-debuginfo-4.1.21-14.2 kernel-default-debuginfo-4.1.21-14.2 kernel-default-debugsource-4.1.21-14.2 kernel-default-devel-4.1.21-14.2 kernel-obs-build-4.1.21-14.4 kernel-obs-build-debugsource-4.1.21-14.4 kernel-obs-qa-4.1.21-14.2 kernel-obs-qa-xen-4.1.21-14.2 kernel-syms-4.1.21-14.2 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.21-14.2 kernel-docs-4.1.21-14.5 kernel-docs-html-4.1.21-14.5 kernel-docs-pdf-4.1.21-14.5 kernel-macros-4.1.21-14.2 kernel-source-4.1.21-14.2 kernel-source-vanilla-4.1.21-14.2 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.21-14.2 kernel-pae-base-4.1.21-14.2 kernel-pae-base-debuginfo-4.1.21-14.2 kernel-pae-debuginfo-4.1.21-14.2 kernel-pae-debugsource-4.1.21-14.2 kernel-pae-devel-4.1.21-14.2 References: https://www.suse.com/security/cve/CVE-2016-2185.html https://www.suse.com/security/cve/CVE-2016-2186.html https://www.suse.com/security/cve/CVE-2016-2188.html https://www.suse.com/security/cve/CVE-2016-2847.html https://www.suse.com/security/cve/CVE-2016-3136.html https://www.suse.com/security/cve/CVE-2016-3137.html https://www.suse.com/security/cve/CVE-2016-3138.html https://www.suse.com/security/cve/CVE-2016-3140.html https://www.suse.com/security/cve/CVE-2016-3156.html https://www.suse.com/security/cve/CVE-2016-3689.html https://www.suse.com/security/cve/CVE-2016-3951.html https://bugzilla.suse.com/957988 https://bugzilla.suse.com/970892 https://bugzilla.suse.com/970911 https://bugzilla.suse.com/970948 https://bugzilla.suse.com/970955 https://bugzilla.suse.com/970956 https://bugzilla.suse.com/970958 https://bugzilla.suse.com/970970 https://bugzilla.suse.com/971124 https://bugzilla.suse.com/971360 https://bugzilla.suse.com/971628 https://bugzilla.suse.com/972174 https://bugzilla.suse.com/973378 https://bugzilla.suse.com/974418 https://bugzilla.suse.com/975868 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1379-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 21 May '16

21 May '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1379-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.6.0 SR16 FP25 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-java-1_6_0-ibm-12572=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-java-1_6_0-ibm-12572=1 - SUSE Manager 2.1: zypper in -t patch sleman21-java-1_6_0-ibm-12572=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_6_0-ibm-12572=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-java-1_6_0-ibm-12572=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): java-1_6_0-ibm-1.6.0_sr16.25-69.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-69.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-69.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-69.1 java-1_6_0-ibm-plugin-1.6.0_sr16.25-69.1 - SUSE Manager Proxy 2.1 (x86_64): java-1_6_0-ibm-1.6.0_sr16.25-69.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-69.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-69.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-69.1 java-1_6_0-ibm-plugin-1.6.0_sr16.25-69.1 - SUSE Manager 2.1 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.25-69.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-69.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-69.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-69.1 - SUSE Manager 2.1 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.25-69.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-69.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-69.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.25-69.1 java-1_6_0-ibm-devel-1.6.0_sr16.25-69.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-69.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.25-69.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.25-69.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1378-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 21 May '16

21 May '16

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1378-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.7.0 SR9 FP40 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-java-1_7_0-ibm-12571=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-java-1_7_0-ibm-12571=1 - SUSE Manager 2.1: zypper in -t patch sleman21-java-1_7_0-ibm-12571=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_7_0-ibm-12571=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-java-1_7_0-ibm-12571=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): java-1_7_0-ibm-1.7.0_sr9.40-52.1 java-1_7_0-ibm-alsa-1.7.0_sr9.40-52.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.40-52.1 java-1_7_0-ibm-plugin-1.7.0_sr9.40-52.1 - SUSE Manager Proxy 2.1 (x86_64): java-1_7_0-ibm-1.7.0_sr9.40-52.1 java-1_7_0-ibm-alsa-1.7.0_sr9.40-52.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.40-52.1 java-1_7_0-ibm-plugin-1.7.0_sr9.40-52.1 - SUSE Manager 2.1 (s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.40-52.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.40-52.1 - SUSE Manager 2.1 (x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.40-52.1 java-1_7_0-ibm-plugin-1.7.0_sr9.40-52.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.40-52.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.40-52.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.40-52.1 java-1_7_0-ibm-plugin-1.7.0_sr9.40-52.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.40-52.1 java-1_7_0-ibm-devel-1.7.0_sr9.40-52.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.40-52.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.40-52.1 java-1_7_0-ibm-plugin-1.7.0_sr9.40-52.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1374-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 20 May '16

20 May '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1374-1 Rating: important References: #977333 #977374 #977376 #977381 #977386 Cross-References: CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update to MozillaFirefox 38.8.0 ESR fixes the following security issues (bsc#977333): - CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-MozillaFirefox-12569=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-MozillaFirefox-12569=1 - SUSE Manager 2.1: zypper in -t patch sleman21-MozillaFirefox-12569=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-12569=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-12569=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-12569=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-12569=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-12569=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): MozillaFirefox-38.8.0esr-40.5 MozillaFirefox-translations-38.8.0esr-40.5 libfreebl3-3.20.2-30.1 libfreebl3-32bit-3.20.2-30.1 libsoftokn3-3.20.2-30.1 libsoftokn3-32bit-3.20.2-30.1 mozilla-nspr-32bit-4.12-26.1 mozilla-nspr-4.12-26.1 mozilla-nss-3.20.2-30.1 mozilla-nss-32bit-3.20.2-30.1 mozilla-nss-tools-3.20.2-30.1 - SUSE Manager Proxy 2.1 (x86_64): MozillaFirefox-38.8.0esr-40.5 MozillaFirefox-translations-38.8.0esr-40.5 libfreebl3-3.20.2-30.1 libfreebl3-32bit-3.20.2-30.1 libsoftokn3-3.20.2-30.1 libsoftokn3-32bit-3.20.2-30.1 mozilla-nspr-32bit-4.12-26.1 mozilla-nspr-4.12-26.1 mozilla-nss-3.20.2-30.1 mozilla-nss-32bit-3.20.2-30.1 mozilla-nss-tools-3.20.2-30.1 - SUSE Manager 2.1 (s390x x86_64): MozillaFirefox-38.8.0esr-40.5 MozillaFirefox-translations-38.8.0esr-40.5 libfreebl3-3.20.2-30.1 libfreebl3-32bit-3.20.2-30.1 libsoftokn3-3.20.2-30.1 libsoftokn3-32bit-3.20.2-30.1 mozilla-nspr-32bit-4.12-26.1 mozilla-nspr-4.12-26.1 mozilla-nss-3.20.2-30.1 mozilla-nss-32bit-3.20.2-30.1 mozilla-nss-tools-3.20.2-30.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-38.8.0esr-40.5 mozilla-nspr-devel-4.12-26.1 mozilla-nss-devel-3.20.2-30.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-38.8.0esr-40.5 MozillaFirefox-translations-38.8.0esr-40.5 libfreebl3-3.20.2-30.1 libsoftokn3-3.20.2-30.1 mozilla-nspr-4.12-26.1 mozilla-nss-3.20.2-30.1 mozilla-nss-tools-3.20.2-30.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libfreebl3-32bit-3.20.2-30.1 libsoftokn3-32bit-3.20.2-30.1 mozilla-nspr-32bit-4.12-26.1 mozilla-nss-32bit-3.20.2-30.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libfreebl3-x86-3.20.2-30.1 libsoftokn3-x86-3.20.2-30.1 mozilla-nspr-x86-4.12-26.1 mozilla-nss-x86-3.20.2-30.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-38.8.0esr-40.5 MozillaFirefox-translations-38.8.0esr-40.5 libfreebl3-3.20.2-30.1 libsoftokn3-3.20.2-30.1 mozilla-nspr-4.12-26.1 mozilla-nss-3.20.2-30.1 mozilla-nss-tools-3.20.2-30.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libfreebl3-32bit-3.20.2-30.1 libsoftokn3-32bit-3.20.2-30.1 mozilla-nspr-32bit-4.12-26.1 mozilla-nss-32bit-3.20.2-30.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-40.5 MozillaFirefox-debugsource-38.8.0esr-40.5 mozilla-nspr-debuginfo-4.12-26.1 mozilla-nspr-debugsource-4.12-26.1 mozilla-nss-debuginfo-3.20.2-30.1 mozilla-nss-debugsource-3.20.2-30.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64): mozilla-nspr-debuginfo-32bit-4.12-26.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64): mozilla-nspr-debuginfo-x86-4.12-26.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-40.5 MozillaFirefox-debugsource-38.8.0esr-40.5 mozilla-nspr-debuginfo-4.12-26.1 mozilla-nspr-debugsource-4.12-26.1 mozilla-nss-debuginfo-3.20.2-30.1 mozilla-nss-debugsource-3.20.2-30.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (s390x x86_64): mozilla-nspr-debuginfo-32bit-4.12-26.1 References: https://www.suse.com/security/cve/CVE-2016-2805.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2808.html https://www.suse.com/security/cve/CVE-2016-2814.html https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977374 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/977381 https://bugzilla.suse.com/977386 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1373-1: important: Security update for php5
by opensuse-security＠opensuse.org 20 May '16

20 May '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1373-1 Rating: important References: #976996 #976997 #977000 #977003 #977005 Cross-References: CVE-2015-8866 CVE-2015-8867 CVE-2016-4070 CVE-2016-4071 CVE-2016-4073 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) - CVE-2016-4071: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string formatting in php_snmp_error() (bsc#977000) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-626=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-47.1 apache2-mod_php5-debuginfo-5.5.14-47.1 php5-5.5.14-47.1 php5-bcmath-5.5.14-47.1 php5-bcmath-debuginfo-5.5.14-47.1 php5-bz2-5.5.14-47.1 php5-bz2-debuginfo-5.5.14-47.1 php5-calendar-5.5.14-47.1 php5-calendar-debuginfo-5.5.14-47.1 php5-ctype-5.5.14-47.1 php5-ctype-debuginfo-5.5.14-47.1 php5-curl-5.5.14-47.1 php5-curl-debuginfo-5.5.14-47.1 php5-dba-5.5.14-47.1 php5-dba-debuginfo-5.5.14-47.1 php5-debuginfo-5.5.14-47.1 php5-debugsource-5.5.14-47.1 php5-devel-5.5.14-47.1 php5-dom-5.5.14-47.1 php5-dom-debuginfo-5.5.14-47.1 php5-enchant-5.5.14-47.1 php5-enchant-debuginfo-5.5.14-47.1 php5-exif-5.5.14-47.1 php5-exif-debuginfo-5.5.14-47.1 php5-fastcgi-5.5.14-47.1 php5-fastcgi-debuginfo-5.5.14-47.1 php5-fileinfo-5.5.14-47.1 php5-fileinfo-debuginfo-5.5.14-47.1 php5-firebird-5.5.14-47.1 php5-firebird-debuginfo-5.5.14-47.1 php5-fpm-5.5.14-47.1 php5-fpm-debuginfo-5.5.14-47.1 php5-ftp-5.5.14-47.1 php5-ftp-debuginfo-5.5.14-47.1 php5-gd-5.5.14-47.1 php5-gd-debuginfo-5.5.14-47.1 php5-gettext-5.5.14-47.1 php5-gettext-debuginfo-5.5.14-47.1 php5-gmp-5.5.14-47.1 php5-gmp-debuginfo-5.5.14-47.1 php5-iconv-5.5.14-47.1 php5-iconv-debuginfo-5.5.14-47.1 php5-imap-5.5.14-47.1 php5-imap-debuginfo-5.5.14-47.1 php5-intl-5.5.14-47.1 php5-intl-debuginfo-5.5.14-47.1 php5-json-5.5.14-47.1 php5-json-debuginfo-5.5.14-47.1 php5-ldap-5.5.14-47.1 php5-ldap-debuginfo-5.5.14-47.1 php5-mbstring-5.5.14-47.1 php5-mbstring-debuginfo-5.5.14-47.1 php5-mcrypt-5.5.14-47.1 php5-mcrypt-debuginfo-5.5.14-47.1 php5-mssql-5.5.14-47.1 php5-mssql-debuginfo-5.5.14-47.1 php5-mysql-5.5.14-47.1 php5-mysql-debuginfo-5.5.14-47.1 php5-odbc-5.5.14-47.1 php5-odbc-debuginfo-5.5.14-47.1 php5-opcache-5.5.14-47.1 php5-opcache-debuginfo-5.5.14-47.1 php5-openssl-5.5.14-47.1 php5-openssl-debuginfo-5.5.14-47.1 php5-pcntl-5.5.14-47.1 php5-pcntl-debuginfo-5.5.14-47.1 php5-pdo-5.5.14-47.1 php5-pdo-debuginfo-5.5.14-47.1 php5-pgsql-5.5.14-47.1 php5-pgsql-debuginfo-5.5.14-47.1 php5-phar-5.5.14-47.1 php5-phar-debuginfo-5.5.14-47.1 php5-posix-5.5.14-47.1 php5-posix-debuginfo-5.5.14-47.1 php5-pspell-5.5.14-47.1 php5-pspell-debuginfo-5.5.14-47.1 php5-readline-5.5.14-47.1 php5-readline-debuginfo-5.5.14-47.1 php5-shmop-5.5.14-47.1 php5-shmop-debuginfo-5.5.14-47.1 php5-snmp-5.5.14-47.1 php5-snmp-debuginfo-5.5.14-47.1 php5-soap-5.5.14-47.1 php5-soap-debuginfo-5.5.14-47.1 php5-sockets-5.5.14-47.1 php5-sockets-debuginfo-5.5.14-47.1 php5-sqlite-5.5.14-47.1 php5-sqlite-debuginfo-5.5.14-47.1 php5-suhosin-5.5.14-47.1 php5-suhosin-debuginfo-5.5.14-47.1 php5-sysvmsg-5.5.14-47.1 php5-sysvmsg-debuginfo-5.5.14-47.1 php5-sysvsem-5.5.14-47.1 php5-sysvsem-debuginfo-5.5.14-47.1 php5-sysvshm-5.5.14-47.1 php5-sysvshm-debuginfo-5.5.14-47.1 php5-tidy-5.5.14-47.1 php5-tidy-debuginfo-5.5.14-47.1 php5-tokenizer-5.5.14-47.1 php5-tokenizer-debuginfo-5.5.14-47.1 php5-wddx-5.5.14-47.1 php5-wddx-debuginfo-5.5.14-47.1 php5-xmlreader-5.5.14-47.1 php5-xmlreader-debuginfo-5.5.14-47.1 php5-xmlrpc-5.5.14-47.1 php5-xmlrpc-debuginfo-5.5.14-47.1 php5-xmlwriter-5.5.14-47.1 php5-xmlwriter-debuginfo-5.5.14-47.1 php5-xsl-5.5.14-47.1 php5-xsl-debuginfo-5.5.14-47.1 php5-zip-5.5.14-47.1 php5-zip-debuginfo-5.5.14-47.1 php5-zlib-5.5.14-47.1 php5-zlib-debuginfo-5.5.14-47.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-47.1 References: https://www.suse.com/security/cve/CVE-2015-8866.html https://www.suse.com/security/cve/CVE-2015-8867.html https://www.suse.com/security/cve/CVE-2016-4070.html https://www.suse.com/security/cve/CVE-2016-4071.html https://www.suse.com/security/cve/CVE-2016-4073.html https://bugzilla.suse.com/976996 https://bugzilla.suse.com/976997 https://bugzilla.suse.com/977000 https://bugzilla.suse.com/977003 https://bugzilla.suse.com/977005 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1360-1: important: Security update for openssl
by opensuse-security＠opensuse.org 19 May '16

19 May '16

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1360-1 Rating: important References: #968050 #973223 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for OpenSSL fixes the following security issues: * CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) * CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) * CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) * CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) * CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) Additionally, the following non-security issues have been fixed: * Fix buffer overrun in ASN1_parse. (bsc#976943) * Allow weak DH groups. (bsc#973223) Security Issues: * CVE-2016-2105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2105> * CVE-2016-2106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2106> * CVE-2016-2108 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2108> * CVE-2016-2109 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2109> * CVE-2016-0702 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0702> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.96.1 openssl-devel-0.9.8a-18.96.1 openssl-doc-0.9.8a-18.96.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.96.1 openssl-devel-32bit-0.9.8a-18.96.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/968050 https://bugzilla.suse.com/973223 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 https://download.suse.com/patch/finder/?keywords=bfdaa5a35088a70db557cea0e2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1352-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 18 May '16

18 May '16

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1352-1 Rating: important References: #977333 #977374 #977376 #977381 #977386 Cross-References: CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: Mozilla Firefox was updated to fix the following vulnerabilities (bsc#977333): * CVE-2016-2805: Memory safety bug fixed in Firefox ESR 38.8 (MFSA 2016-39, bsc#977374) * CVE-2016-2807: Memory safety bugs fixed in Firefox ESR 45.1, Firefox ESR 38.8 and Firefox 46 (MFSA 2016-39, bsc#977376) * CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() (MFSA 2016-47, bsc#977386) * CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets (MFSA 2016-44, bsc#977381) Security Issues: * CVE-2016-2805 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2805> * CVE-2016-2807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2807> * CVE-2016-2808 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2808> * CVE-2016-2814 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2814> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x): MozillaFirefox-38.8.0esr-0.5.1 MozillaFirefox-translations-38.8.0esr-0.5.1 References: https://www.suse.com/security/cve/CVE-2016-2805.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2808.html https://www.suse.com/security/cve/CVE-2016-2814.html https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977374 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/977381 https://bugzilla.suse.com/977386 https://download.suse.com/patch/finder/?keywords=c4a992c726ddbf623907944154… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1332-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1332-1 Rating: important References: #959724 #962779 #963810 Cross-References: CVE-2015-3194 CVE-2016-0639 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0655 CVE-2016-0661 CVE-2016-0665 CVE-2016-0666 CVE-2016-0668 CVE-2016-0705 CVE-2016-2047 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This mysql-community-server version update to 5.6.30 fixes the following issues: Security issues fixed: - fixed CVEs (boo#962779, boo#959724): CVE-2016-0705, CVE-2016-0639, CVE-2015-3194, CVE-2016-0640, CVE-2016-2047, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0665, CVE-2016-0666, CVE-2016-0641, CVE-2016-0642, CVE-2016-0655, CVE-2016-0661, CVE-2016-0668, CVE-2016-0643 - changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html Bugs fixed: - don't delete the log data when migration fails - add 'log-error' and 'secure-file-priv' configuration options (added via configuration-tweaks.tar.bz2) [boo#963810] * add '/etc/my.cnf.d/error_log.conf' that specifies 'log-error = /var/log/mysql/mysqld.log'. If no path is set, the error log is written to '/var/lib/mysql/$HOSTNAME.err', which is not picked up by logrotate. * add '/etc/my.cnf.d/secure_file_priv.conf' which specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD FILE()' will only work with files in the directory specified by 'secure-file-priv' option (='/var/lib/mysql-files'). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-607=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-607=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.30-16.2 libmysql56client18-debuginfo-5.6.30-16.2 libmysql56client_r18-5.6.30-16.2 mysql-community-server-5.6.30-16.2 mysql-community-server-bench-5.6.30-16.2 mysql-community-server-bench-debuginfo-5.6.30-16.2 mysql-community-server-client-5.6.30-16.2 mysql-community-server-client-debuginfo-5.6.30-16.2 mysql-community-server-debuginfo-5.6.30-16.2 mysql-community-server-debugsource-5.6.30-16.2 mysql-community-server-errormessages-5.6.30-16.2 mysql-community-server-test-5.6.30-16.2 mysql-community-server-test-debuginfo-5.6.30-16.2 mysql-community-server-tools-5.6.30-16.2 mysql-community-server-tools-debuginfo-5.6.30-16.2 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.30-16.2 libmysql56client18-debuginfo-32bit-5.6.30-16.2 libmysql56client_r18-32bit-5.6.30-16.2 - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.30-2.20.2 libmysql56client18-debuginfo-5.6.30-2.20.2 libmysql56client_r18-5.6.30-2.20.2 mysql-community-server-5.6.30-2.20.2 mysql-community-server-bench-5.6.30-2.20.2 mysql-community-server-bench-debuginfo-5.6.30-2.20.2 mysql-community-server-client-5.6.30-2.20.2 mysql-community-server-client-debuginfo-5.6.30-2.20.2 mysql-community-server-debuginfo-5.6.30-2.20.2 mysql-community-server-debugsource-5.6.30-2.20.2 mysql-community-server-errormessages-5.6.30-2.20.2 mysql-community-server-test-5.6.30-2.20.2 mysql-community-server-test-debuginfo-5.6.30-2.20.2 mysql-community-server-tools-5.6.30-2.20.2 mysql-community-server-tools-debuginfo-5.6.30-2.20.2 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.30-2.20.2 libmysql56client18-debuginfo-32bit-5.6.30-2.20.2 libmysql56client_r18-32bit-5.6.30-2.20.2 References: https://www.suse.com/security/cve/CVE-2015-3194.html https://www.suse.com/security/cve/CVE-2016-0639.html https://www.suse.com/security/cve/CVE-2016-0640.html https://www.suse.com/security/cve/CVE-2016-0641.html https://www.suse.com/security/cve/CVE-2016-0642.html https://www.suse.com/security/cve/CVE-2016-0643.html https://www.suse.com/security/cve/CVE-2016-0644.html https://www.suse.com/security/cve/CVE-2016-0646.html https://www.suse.com/security/cve/CVE-2016-0647.html https://www.suse.com/security/cve/CVE-2016-0648.html https://www.suse.com/security/cve/CVE-2016-0649.html https://www.suse.com/security/cve/CVE-2016-0650.html https://www.suse.com/security/cve/CVE-2016-0655.html https://www.suse.com/security/cve/CVE-2016-0661.html https://www.suse.com/security/cve/CVE-2016-0665.html https://www.suse.com/security/cve/CVE-2016-0666.html https://www.suse.com/security/cve/CVE-2016-0668.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-2047.html https://bugzilla.suse.com/959724 https://bugzilla.suse.com/962779 https://bugzilla.suse.com/963810 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1329-1: important: Security update for ntp
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1329-1 Rating: important References: #957226 #977446 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for ntp to 4.2.8p7 fixes the following issues: * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 Bugs fixed: - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-599=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p7-21.1 ntp-debuginfo-4.2.8p7-21.1 ntp-debugsource-4.2.8p7-21.1 ntp-doc-4.2.8p7-21.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/977446 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1326-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1326-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - Multiple security issues in GraphicsMagick/ImageMagick [boo#978061] (CVE-2016-3714, CVE-2016-3718, CVE-2016-3715, CVE-2016-3717) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-602=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-602=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-5.1 GraphicsMagick-debuginfo-1.3.21-5.1 GraphicsMagick-debugsource-1.3.21-5.1 GraphicsMagick-devel-1.3.21-5.1 libGraphicsMagick++-Q16-11-1.3.21-5.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-5.1 libGraphicsMagick++-devel-1.3.21-5.1 libGraphicsMagick-Q16-3-1.3.21-5.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-5.1 libGraphicsMagick3-config-1.3.21-5.1 libGraphicsMagickWand-Q16-2-1.3.21-5.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-5.1 perl-GraphicsMagick-1.3.21-5.1 perl-GraphicsMagick-debuginfo-1.3.21-5.1 - openSUSE 13.2 (i586 x86_64): GraphicsMagick-1.3.20-3.1 GraphicsMagick-debuginfo-1.3.20-3.1 GraphicsMagick-debugsource-1.3.20-3.1 GraphicsMagick-devel-1.3.20-3.1 libGraphicsMagick++-Q16-3-1.3.20-3.1 libGraphicsMagick++-Q16-3-debuginfo-1.3.20-3.1 libGraphicsMagick++-devel-1.3.20-3.1 libGraphicsMagick-Q16-3-1.3.20-3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.20-3.1 libGraphicsMagick3-config-1.3.20-3.1 libGraphicsMagickWand-Q16-2-1.3.20-3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.20-3.1 perl-GraphicsMagick-1.3.20-3.1 perl-GraphicsMagick-debuginfo-1.3.20-3.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1319-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1319-1 Rating: important References: #979859 Cross-References: CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859): - CVE-2016-1667: Same origin bypass in DOM - CVE-2016-1668: Same origin bypass in Blink V8 bindings - CVE-2016-1669: Buffer overflow in V8 - CVE-2016-1670: Race condition in loader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-598=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-50.0.2661.102-75.1 chromium-50.0.2661.102-75.1 chromium-desktop-gnome-50.0.2661.102-75.1 chromium-desktop-kde-50.0.2661.102-75.1 chromium-ffmpegsumo-50.0.2661.102-75.1 References: https://www.suse.com/security/cve/CVE-2016-1667.html https://www.suse.com/security/cve/CVE-2016-1668.html https://www.suse.com/security/cve/CVE-2016-1669.html https://www.suse.com/security/cve/CVE-2016-1670.html https://bugzilla.suse.com/979859 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1318-1: important: Security update for xen
by opensuse-security＠opensuse.org 17 May '16

17 May '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1318-1 Rating: important References: #954872 #956832 #957988 #958007 #958009 #958493 #958523 #958918 #959006 #959387 #959695 #960707 #960726 #960836 #960861 #960862 #961332 #961358 #961692 #962321 #962335 #962360 #962611 #962627 #962632 #962642 #962758 #963783 #963923 #964415 #964431 #964452 #964644 #964746 #964925 #964929 #964947 #964950 #965112 #965156 #965269 #965315 #965317 #967090 #967101 #968004 #969125 #969126 Cross-References: CVE-2013-4527 CVE-2013-4529 CVE-2013-4530 CVE-2013-4533 CVE-2013-4534 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3640 CVE-2014-3689 CVE-2014-7815 CVE-2014-9718 CVE-2015-1779 CVE-2015-5278 CVE-2015-6855 CVE-2015-7512 CVE-2015-7549 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2015-8817 CVE-2015-8818 CVE-2016-1568 CVE-2016-1570 CVE-2016-1571 CVE-2016-1714 CVE-2016-1922 CVE-2016-1981 CVE-2016-2198 CVE-2016-2270 CVE-2016-2271 CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 45 vulnerabilities and has three fixes is now available. Description: xen was updated to fix 46 security issues. These security issues were fixed: - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746). - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929). - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950). - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#964644). - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925). - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627). - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431). - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#962632). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#964947). - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360). - CVE-2015-7549: pci: NULL pointer dereference issue (bsc#958918). - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956832). - CVE-2015-8504: VNC: floating point exception (bsc#958493). - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988). - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007). - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009). - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959006). - CVE-2015-8567: vmxnet3: host memory leakage (bsc#959387). - CVE-2015-8568: vmxnet3: host memory leakage (bsc#959387). - CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358). - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#965269). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960726). - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960836). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2015-8817: OOB access in address_space_rw lead to segmentation fault (I) (bsc#969125). - CVE-2015-8818: OOB access in address_space_rw lead to segmentation fault (II) (bsc#969126). - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961692). - CVE-2016-1922: NULL pointer dereference in vapic_write() (bsc#962321). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963783). - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964415). - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315). - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967101). - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967090). - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#968004). - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523). These non-security issues were fixed: - bsc#954872: script block-dmmd not working as expected - bsc#963923: domain weights not honored when sched-credit tslice is reduced - bsc#959695: Missing docs for xen Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-779=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-779=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-779=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.4_02-22.19.1 xen-devel-4.4.4_02-22.19.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.4_02-22.19.1 xen-debugsource-4.4.4_02-22.19.1 xen-doc-html-4.4.4_02-22.19.1 xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1 xen-kmp-default-debuginfo-4.4.4_02_k3.12.55_52.42-22.19.1 xen-libs-32bit-4.4.4_02-22.19.1 xen-libs-4.4.4_02-22.19.1 xen-libs-debuginfo-32bit-4.4.4_02-22.19.1 xen-libs-debuginfo-4.4.4_02-22.19.1 xen-tools-4.4.4_02-22.19.1 xen-tools-debuginfo-4.4.4_02-22.19.1 xen-tools-domU-4.4.4_02-22.19.1 xen-tools-domU-debuginfo-4.4.4_02-22.19.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.4_02-22.19.1 xen-debugsource-4.4.4_02-22.19.1 xen-kmp-default-4.4.4_02_k3.12.55_52.42-22.19.1 xen-kmp-default-debuginfo-4.4.4_02_k3.12.55_52.42-22.19.1 xen-libs-32bit-4.4.4_02-22.19.1 xen-libs-4.4.4_02-22.19.1 xen-libs-debuginfo-32bit-4.4.4_02-22.19.1 xen-libs-debuginfo-4.4.4_02-22.19.1 References: https://www.suse.com/security/cve/CVE-2013-4527.html https://www.suse.com/security/cve/CVE-2013-4529.html https://www.suse.com/security/cve/CVE-2013-4530.html https://www.suse.com/security/cve/CVE-2013-4533.html https://www.suse.com/security/cve/CVE-2013-4534.html https://www.suse.com/security/cve/CVE-2013-4537.html https://www.suse.com/security/cve/CVE-2013-4538.html https://www.suse.com/security/cve/CVE-2013-4539.html https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-3640.html https://www.suse.com/security/cve/CVE-2014-3689.html https://www.suse.com/security/cve/CVE-2014-7815.html https://www.suse.com/security/cve/CVE-2014-9718.html https://www.suse.com/security/cve/CVE-2015-1779.html https://www.suse.com/security/cve/CVE-2015-5278.html https://www.suse.com/security/cve/CVE-2015-6855.html https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8554.html https://www.suse.com/security/cve/CVE-2015-8555.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8567.html https://www.suse.com/security/cve/CVE-2015-8568.html https://www.suse.com/security/cve/CVE-2015-8613.html https://www.suse.com/security/cve/CVE-2015-8619.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8744.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2015-8817.html https://www.suse.com/security/cve/CVE-2015-8818.html https://www.suse.com/security/cve/CVE-2016-1568.html https://www.suse.com/security/cve/CVE-2016-1570.html https://www.suse.com/security/cve/CVE-2016-1571.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1922.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2198.html https://www.suse.com/security/cve/CVE-2016-2270.html https://www.suse.com/security/cve/CVE-2016-2271.html https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2392.html https://www.suse.com/security/cve/CVE-2016-2538.html https://bugzilla.suse.com/954872 https://bugzilla.suse.com/956832 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/958007 https://bugzilla.suse.com/958009 https://bugzilla.suse.com/958493 https://bugzilla.suse.com/958523 https://bugzilla.suse.com/958918 https://bugzilla.suse.com/959006 https://bugzilla.suse.com/959387 https://bugzilla.suse.com/959695 https://bugzilla.suse.com/960707 https://bugzilla.suse.com/960726 https://bugzilla.suse.com/960836 https://bugzilla.suse.com/960861 https://bugzilla.suse.com/960862 https://bugzilla.suse.com/961332 https://bugzilla.suse.com/961358 https://bugzilla.suse.com/961692 https://bugzilla.suse.com/962321 https://bugzilla.suse.com/962335 https://bugzilla.suse.com/962360 https://bugzilla.suse.com/962611 https://bugzilla.suse.com/962627 https://bugzilla.suse.com/962632 https://bugzilla.suse.com/962642 https://bugzilla.suse.com/962758 https://bugzilla.suse.com/963783 https://bugzilla.suse.com/963923 https://bugzilla.suse.com/964415 https://bugzilla.suse.com/964431 https://bugzilla.suse.com/964452 https://bugzilla.suse.com/964644 https://bugzilla.suse.com/964746 https://bugzilla.suse.com/964925 https://bugzilla.suse.com/964929 https://bugzilla.suse.com/964947 https://bugzilla.suse.com/964950 https://bugzilla.suse.com/965112 https://bugzilla.suse.com/965156 https://bugzilla.suse.com/965269 https://bugzilla.suse.com/965315 https://bugzilla.suse.com/965317 https://bugzilla.suse.com/967090 https://bugzilla.suse.com/967101 https://bugzilla.suse.com/968004 https://bugzilla.suse.com/969125 https://bugzilla.suse.com/969126 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1311-1: important: Security update for ntp
by opensuse-security＠opensuse.org 17 May '16

17 May '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1311-1 Rating: important References: #782060 #784760 #905885 #910063 #916617 #920183 #920238 #926510 #936327 #937837 #942441 #942587 #943216 #943218 #944300 #946386 #951351 #951559 #951608 #951629 #954982 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5194 CVE-2015-5219 CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 30 vulnerabilities and has 6 fixes is now available. Description: This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues: Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) Major functional changes: - The "sntp" commandline tool changed its option handling in a major way. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. - The local clock is being disabled during update. - ntpd is no longer running chrooted. Other functional changes: - ntp-signd is installed. - "enable mode7" can be added to the configuration to allow ntdpc to work as compatibility mode option. - "kod" was removed from the default restrictions. - SHA1 keys are used by default instead of MD5 keys. These security issues were fixed: - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608). - CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608). - CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608). - CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608). - CVE-2015-7850: remote config logfile-keyfile (bsc#951608). - CVE-2015-7849: trusted key use-after-free (bsc#951608). - CVE-2015-7848: mode 7 loop counter underrun (bsc#951608). - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608). - CVE-2015-7703: configuration directives "pidfile" and "driftfile" should only be allowed locally (bsc#951608). - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608). - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq. - bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution. - bsc#905885: Use SHA1 instead of MD5 for symmetric keys. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - Fix legacy action scripts to pass on command line arguments. - bsc#944300: Remove "kod" from the restrict line in ntp.conf. - bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd. - Don't let "keysdir" lines in ntp.conf trigger the "keys" parser. - Disable mode 7 (ntpdc) again, now that we don't use it anymore. - Add "addserver" as a new legacy action. - bsc#910063: Fix the comment regarding addserver in ntp.conf. - bsc#926510: Disable chroot by default. - bsc#920238: Enable ntpdc for backwards compatibility. - bsc#784760: Remove local clock from default configuration. - bsc#942441/fate#319496: Require perl-Socket6. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - bsc#920183: Allow -4 and -6 address qualifiers in "server" directives. - Use upstream ntp-wait, because our version is incompatible with the new ntpq command line syntax. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ntp-12561=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ntp-12561=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ntp-12561=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ntp-12561=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ntp-12561=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ntp-12561=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-ntp-12561=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): ntp-4.2.8p6-41.1 ntp-doc-4.2.8p6-41.1 - SUSE Manager Proxy 2.1 (x86_64): ntp-4.2.8p6-41.1 ntp-doc-4.2.8p6-41.1 - SUSE Manager 2.1 (s390x x86_64): ntp-4.2.8p6-41.1 ntp-doc-4.2.8p6-41.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): ntp-4.2.8p6-41.1 ntp-doc-4.2.8p6-41.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): ntp-4.2.8p6-41.1 ntp-doc-4.2.8p6-41.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (noarch): yast2-ntp-client-2.17.14.1-1.12.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ntp-debuginfo-4.2.8p6-41.1 ntp-debugsource-4.2.8p6-41.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): ntp-debuginfo-4.2.8p6-41.1 ntp-debugsource-4.2.8p6-41.1 References: https://www.suse.com/security/cve/CVE-2015-5194.html https://www.suse.com/security/cve/CVE-2015-5219.html https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7691.html https://www.suse.com/security/cve/CVE-2015-7692.html https://www.suse.com/security/cve/CVE-2015-7701.html https://www.suse.com/security/cve/CVE-2015-7702.html https://www.suse.com/security/cve/CVE-2015-7703.html https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7848.html https://www.suse.com/security/cve/CVE-2015-7849.html https://www.suse.com/security/cve/CVE-2015-7850.html https://www.suse.com/security/cve/CVE-2015-7851.html https://www.suse.com/security/cve/CVE-2015-7852.html https://www.suse.com/security/cve/CVE-2015-7853.html https://www.suse.com/security/cve/CVE-2015-7854.html https://www.suse.com/security/cve/CVE-2015-7855.html https://www.suse.com/security/cve/CVE-2015-7871.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/784760 https://bugzilla.suse.com/905885 https://bugzilla.suse.com/910063 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/920183 https://bugzilla.suse.com/920238 https://bugzilla.suse.com/926510 https://bugzilla.suse.com/936327 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/942441 https://bugzilla.suse.com/942587 https://bugzilla.suse.com/943216 https://bugzilla.suse.com/943218 https://bugzilla.suse.com/944300 https://bugzilla.suse.com/946386 https://bugzilla.suse.com/951351 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951608 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/954982 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1309-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1309-1 Rating: important References: #979422 Cross-References: CVE-2016-4117 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-587=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.621-162.1 flash-player-gnome-11.2.202.621-162.1 flash-player-kde4-11.2.202.621-162.1 References: https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1308-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1308-1 Rating: important References: #979422 Cross-References: CVE-2016-4117 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-587=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.621-185.1 flash-player-gnome-11.2.202.621-185.1 flash-player-kde4-11.2.202.621-185.1 References: https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1306-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1306-1 Rating: important References: #979422 Cross-References: CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 CVE-2016-4117 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Some CVEs were not listed in the last submission: * APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-585=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.621-2.97.1 flash-player-gnome-11.2.202.621-2.97.1 flash-player-kde4-11.2.202.621-2.97.1 References: https://www.suse.com/security/cve/CVE-2016-1006.html https://www.suse.com/security/cve/CVE-2016-1011.html https://www.suse.com/security/cve/CVE-2016-1012.html https://www.suse.com/security/cve/CVE-2016-1013.html https://www.suse.com/security/cve/CVE-2016-1014.html https://www.suse.com/security/cve/CVE-2016-1015.html https://www.suse.com/security/cve/CVE-2016-1016.html https://www.suse.com/security/cve/CVE-2016-1017.html https://www.suse.com/security/cve/CVE-2016-1018.html https://www.suse.com/security/cve/CVE-2016-1019.html https://www.suse.com/security/cve/CVE-2016-1020.html https://www.suse.com/security/cve/CVE-2016-1021.html https://www.suse.com/security/cve/CVE-2016-1022.html https://www.suse.com/security/cve/CVE-2016-1023.html https://www.suse.com/security/cve/CVE-2016-1024.html https://www.suse.com/security/cve/CVE-2016-1025.html https://www.suse.com/security/cve/CVE-2016-1026.html https://www.suse.com/security/cve/CVE-2016-1027.html https://www.suse.com/security/cve/CVE-2016-1028.html https://www.suse.com/security/cve/CVE-2016-1029.html https://www.suse.com/security/cve/CVE-2016-1030.html https://www.suse.com/security/cve/CVE-2016-1031.html https://www.suse.com/security/cve/CVE-2016-1032.html https://www.suse.com/security/cve/CVE-2016-1033.html https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1305-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 16 May '16

16 May '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1305-1 Rating: important References: #979422 Cross-References: CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 CVE-2016-1096 CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115 CVE-2016-4116 CVE-2016-4117 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 49 vulnerabilities is now available. Description: This update for flash-player fixes the following issues: - Security update to 11.2.202.621 (bsc#979422): * APSA16-02, APSB16-15, CVE-2016-1096, CVE-2016-1097, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103, CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4109, CVE-2016-4110, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4116, CVE-2016-4117 - The following CVEs got fixed during the previous release, but got published afterwards: * APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-772=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-772=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-772=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-772=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): flash-player-11.2.202.621-130.1 flash-player-gnome-11.2.202.621-130.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): flash-player-11.2.202.621-130.1 flash-player-gnome-11.2.202.621-130.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): flash-player-11.2.202.621-130.1 flash-player-gnome-11.2.202.621-130.1 - SUSE Linux Enterprise Desktop 12 (x86_64): flash-player-11.2.202.621-130.1 flash-player-gnome-11.2.202.621-130.1 References: https://www.suse.com/security/cve/CVE-2016-1006.html https://www.suse.com/security/cve/CVE-2016-1011.html https://www.suse.com/security/cve/CVE-2016-1012.html https://www.suse.com/security/cve/CVE-2016-1013.html https://www.suse.com/security/cve/CVE-2016-1014.html https://www.suse.com/security/cve/CVE-2016-1015.html https://www.suse.com/security/cve/CVE-2016-1016.html https://www.suse.com/security/cve/CVE-2016-1017.html https://www.suse.com/security/cve/CVE-2016-1018.html https://www.suse.com/security/cve/CVE-2016-1019.html https://www.suse.com/security/cve/CVE-2016-1020.html https://www.suse.com/security/cve/CVE-2016-1021.html https://www.suse.com/security/cve/CVE-2016-1022.html https://www.suse.com/security/cve/CVE-2016-1023.html https://www.suse.com/security/cve/CVE-2016-1024.html https://www.suse.com/security/cve/CVE-2016-1025.html https://www.suse.com/security/cve/CVE-2016-1026.html https://www.suse.com/security/cve/CVE-2016-1027.html https://www.suse.com/security/cve/CVE-2016-1028.html https://www.suse.com/security/cve/CVE-2016-1029.html https://www.suse.com/security/cve/CVE-2016-1030.html https://www.suse.com/security/cve/CVE-2016-1031.html https://www.suse.com/security/cve/CVE-2016-1032.html https://www.suse.com/security/cve/CVE-2016-1033.html https://www.suse.com/security/cve/CVE-2016-1096.html https://www.suse.com/security/cve/CVE-2016-1097.html https://www.suse.com/security/cve/CVE-2016-1098.html https://www.suse.com/security/cve/CVE-2016-1099.html https://www.suse.com/security/cve/CVE-2016-1100.html https://www.suse.com/security/cve/CVE-2016-1101.html https://www.suse.com/security/cve/CVE-2016-1102.html https://www.suse.com/security/cve/CVE-2016-1103.html https://www.suse.com/security/cve/CVE-2016-1104.html https://www.suse.com/security/cve/CVE-2016-1105.html https://www.suse.com/security/cve/CVE-2016-1106.html https://www.suse.com/security/cve/CVE-2016-1107.html https://www.suse.com/security/cve/CVE-2016-1108.html https://www.suse.com/security/cve/CVE-2016-1109.html https://www.suse.com/security/cve/CVE-2016-1110.html https://www.suse.com/security/cve/CVE-2016-4108.html https://www.suse.com/security/cve/CVE-2016-4109.html https://www.suse.com/security/cve/CVE-2016-4110.html https://www.suse.com/security/cve/CVE-2016-4111.html https://www.suse.com/security/cve/CVE-2016-4112.html https://www.suse.com/security/cve/CVE-2016-4113.html https://www.suse.com/security/cve/CVE-2016-4114.html https://www.suse.com/security/cve/CVE-2016-4115.html https://www.suse.com/security/cve/CVE-2016-4116.html https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1304-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 16 May '16

16 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1304-1 Rating: important References: #979859 Cross-References: CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859): - CVE-2016-1667: Same origin bypass in DOM - CVE-2016-1668: Same origin bypass in Blink V8 bindings - CVE-2016-1669: Buffer overflow in V8 - CVE-2016-1670: Race condition in loader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-584=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-584=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-50.0.2661.102-48.1 chromedriver-debuginfo-50.0.2661.102-48.1 chromium-50.0.2661.102-48.1 chromium-debuginfo-50.0.2661.102-48.1 chromium-debugsource-50.0.2661.102-48.1 chromium-desktop-gnome-50.0.2661.102-48.1 chromium-desktop-kde-50.0.2661.102-48.1 chromium-ffmpegsumo-50.0.2661.102-48.1 chromium-ffmpegsumo-debuginfo-50.0.2661.102-48.1 - openSUSE 13.2 (i586 x86_64): chromedriver-50.0.2661.102-100.1 chromedriver-debuginfo-50.0.2661.102-100.1 chromium-50.0.2661.102-100.1 chromium-debuginfo-50.0.2661.102-100.1 chromium-debugsource-50.0.2661.102-100.1 chromium-desktop-gnome-50.0.2661.102-100.1 chromium-desktop-kde-50.0.2661.102-100.1 chromium-ffmpegsumo-50.0.2661.102-100.1 chromium-ffmpegsumo-debuginfo-50.0.2661.102-100.1 References: https://www.suse.com/security/cve/CVE-2016-1667.html https://www.suse.com/security/cve/CVE-2016-1668.html https://www.suse.com/security/cve/CVE-2016-1669.html https://www.suse.com/security/cve/CVE-2016-1670.html https://bugzilla.suse.com/979859 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1303-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 13 May '16

13 May '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1303-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.6.0 SR16 FP25 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-771=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.25-34.1 java-1_6_0-ibm-fonts-1.6.0_sr16.25-34.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.25-34.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.25-34.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1301-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 13 May '16

13 May '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1301-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - bsc#978061: A vulnerability in ImageMagick's "https" module allowed users to execute arbitrary shell commands on the host performing the image conversion. The issue had the potential for remote command injection. This update mitigates the vulnerability by disabling all access to the "https" module in the "delegates.xml" config file. (CVE-2016-3714) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ImageMagick-12560=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ImageMagick-12560=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ImageMagick-12560=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ImageMagick-12560=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ImageMagick-12560=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ImageMagick-12560=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ImageMagick-12560=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ImageMagick-12560=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ImageMagick-12560=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-ImageMagick-12560=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 libMagickCore1-6.4.3.6-7.37.1 - SUSE Manager Proxy 2.1 (x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 libMagickCore1-6.4.3.6-7.37.1 - SUSE Manager 2.1 (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 libMagickCore1-6.4.3.6-7.37.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-6.4.3.6-7.37.1 ImageMagick-devel-6.4.3.6-7.37.1 libMagick++-devel-6.4.3.6-7.37.1 libMagick++1-6.4.3.6-7.37.1 libMagickWand1-6.4.3.6-7.37.1 perl-PerlMagick-6.4.3.6-7.37.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libMagickWand1-32bit-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libMagickCore1-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.37.1 ImageMagick-debugsource-6.4.3.6-7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.37.1 ImageMagick-debugsource-6.4.3.6-7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.37.1 ImageMagick-debugsource-6.4.3.6-7.37.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1300-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 13 May '16

13 May '16

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1300-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.7.1 SR3 FP40 relese fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-java-1_7_1-ibm-12558=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-java-1_7_1-ibm-12558=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.40-13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.40-13.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.40-13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.40-13.1 java-1_7_1-ibm-plugin-1.7.1_sr3.40-13.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1299-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 13 May '16

13 May '16

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1299-1 Rating: important References: #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This IBM Java 1.7.1 SR3 FP40 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-766=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-766=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-766=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-766=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.40-25.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.40-25.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.40-25.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.40-25.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.40-25.1 java-1_7_1-ibm-plugin-1.7.1_sr3.40-25.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.40-25.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.40-25.1 - SUSE Linux Enterprise Server 12 (x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.40-25.1 java-1_7_1-ibm-plugin-1.7.1_sr3.40-25.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1292-1: important: Security update for ntp
by opensuse-security＠opensuse.org 12 May '16

12 May '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1292-1 Rating: important References: #782060 #916617 #937837 #951559 #951629 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 8 fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 12 security issues. Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-578=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p6-15.1 ntp-debuginfo-4.2.8p6-15.1 ntp-debugsource-4.2.8p6-15.1 ntp-doc-4.2.8p6-15.1 - openSUSE Leap 42.1 (noarch): yast2-ntp-client-3.1.22-6.1 yast2-ntp-client-devel-doc-3.1.22-6.1 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1291-1: important: Security update for ntp
by opensuse-security＠opensuse.org 12 May '16

12 May '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1291-1 Rating: important References: #957226 #977446 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for ntp to 4.2.8p7 fixes the following issues: * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 Bugs fixed: - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-764=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-764=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ntp-4.2.8p7-11.1 ntp-debuginfo-4.2.8p7-11.1 ntp-debugsource-4.2.8p7-11.1 ntp-doc-4.2.8p7-11.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ntp-4.2.8p7-11.1 ntp-debuginfo-4.2.8p7-11.1 ntp-debugsource-4.2.8p7-11.1 ntp-doc-4.2.8p7-11.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/977446 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1290-1: important: Security update for openssl
by opensuse-security＠opensuse.org 12 May '16

12 May '16

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1290-1 Rating: important References: #889013 #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: SUSE Studio Onsite 1.3 SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) Bugs fixed: - fate#320304: build 32bit devel package - bsc#976943: Fix buffer overrun in ASN1_parse - bsc#973223: allow weak DH groups, vulnerable to the logjam attack, when environment variable OPENSSL_ALLOW_LOGJAM_ATTACK is set - bsc#889013: Rename README.SuSE to the new spelling Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-openssl-12557=1 - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-openssl-12557=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-openssl-12557=1 - SUSE Manager 2.1: zypper in -t patch sleman21-openssl-12557=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-openssl-12557=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openssl-12557=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-openssl-12557=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-openssl-12557=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssl-12557=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssl-12557=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-openssl-12557=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): libopenssl-devel-0.9.8j-0.97.1 - SUSE OpenStack Cloud 5 (x86_64): libopenssl-devel-0.9.8j-0.97.1 libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Manager Proxy 2.1 (x86_64): libopenssl-devel-0.9.8j-0.97.1 libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Manager 2.1 (s390x x86_64): libopenssl-devel-0.9.8j-0.97.1 libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.97.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libopenssl-devel-32bit-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libopenssl0_9_8-x86-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.97.1 libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.97.1 libopenssl0_9_8-0.9.8j-0.97.1 libopenssl0_9_8-hmac-0.9.8j-0.97.1 openssl-0.9.8j-0.97.1 openssl-doc-0.9.8j-0.97.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.97.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.97.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssl-debuginfo-0.9.8j-0.97.1 openssl-debugsource-0.9.8j-0.97.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): openssl-debuginfo-0.9.8j-0.97.1 openssl-debugsource-0.9.8j-0.97.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): openssl-debuginfo-0.9.8j-0.97.1 openssl-debugsource-0.9.8j-0.97.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/889013 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1279-1: important: Security update for mysql
by opensuse-security＠opensuse.org 11 May '16

11 May '16

SUSE Security Update: Security update for mysql ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1279-1 Rating: important References: #963806 #976341 Cross-References: CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0651 CVE-2016-0666 CVE-2016-2047 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: mysql was updated to version 5.5.49 to fix 13 security issues. These security issues were fixed: - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#976341). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#976341). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#976341). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#976341). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#976341). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#976341). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#976341). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#976341). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#976341). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#976341). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#976341). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#976341). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com (bsc#963806). More details are available at - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-mysql-12554=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-mysql-12554=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-mysql-12554=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.49-0.20.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ia64): libmysql55client_r18-x86-5.5.49-0.20.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libmysql55client18-5.5.49-0.20.1 libmysql55client_r18-5.5.49-0.20.1 mysql-5.5.49-0.20.1 mysql-client-5.5.49-0.20.1 mysql-tools-5.5.49-0.20.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libmysql55client18-32bit-5.5.49-0.20.1 libmysql55client_r18-32bit-5.5.49-0.20.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libmysql55client18-x86-5.5.49-0.20.1 libmysql55client_r18-x86-5.5.49-0.20.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): mysql-debuginfo-5.5.49-0.20.1 mysql-debugsource-5.5.49-0.20.1 References: https://www.suse.com/security/cve/CVE-2016-0640.html https://www.suse.com/security/cve/CVE-2016-0641.html https://www.suse.com/security/cve/CVE-2016-0642.html https://www.suse.com/security/cve/CVE-2016-0643.html https://www.suse.com/security/cve/CVE-2016-0644.html https://www.suse.com/security/cve/CVE-2016-0646.html https://www.suse.com/security/cve/CVE-2016-0647.html https://www.suse.com/security/cve/CVE-2016-0648.html https://www.suse.com/security/cve/CVE-2016-0649.html https://www.suse.com/security/cve/CVE-2016-0650.html https://www.suse.com/security/cve/CVE-2016-0651.html https://www.suse.com/security/cve/CVE-2016-0666.html https://www.suse.com/security/cve/CVE-2016-2047.html https://bugzilla.suse.com/963806 https://bugzilla.suse.com/976341 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1278-1: important: Security update for ntp
by opensuse-security＠opensuse.org 11 May '16

11 May '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1278-1 Rating: important References: #957226 #977446 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for ntp to 4.2.8p7 fixes the following issues: * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 Bugs fixed: - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ntp-12553=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ntp-12553=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-4.2.8p7-11.1 ntp-doc-4.2.8p7-11.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-debuginfo-4.2.8p7-11.1 ntp-debugsource-4.2.8p7-11.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/977446 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1277-1: important: Security update for php5
by opensuse-security＠opensuse.org 11 May '16

11 May '16

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1277-1 Rating: important References: #976996 #976997 #977000 #977003 #977005 Cross-References: CVE-2015-8866 CVE-2015-8867 CVE-2016-4070 CVE-2016-4071 CVE-2016-4073 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) - CVE-2016-4071: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string formatting in php_snmp_error() (bsc#977000) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-752=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-752=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-752=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-56.1 php5-debugsource-5.5.14-56.1 php5-devel-5.5.14-56.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-56.1 php5-debugsource-5.5.14-56.1 php5-devel-5.5.14-56.1 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php5-5.5.14-56.1 apache2-mod_php5-debuginfo-5.5.14-56.1 php5-5.5.14-56.1 php5-bcmath-5.5.14-56.1 php5-bcmath-debuginfo-5.5.14-56.1 php5-bz2-5.5.14-56.1 php5-bz2-debuginfo-5.5.14-56.1 php5-calendar-5.5.14-56.1 php5-calendar-debuginfo-5.5.14-56.1 php5-ctype-5.5.14-56.1 php5-ctype-debuginfo-5.5.14-56.1 php5-curl-5.5.14-56.1 php5-curl-debuginfo-5.5.14-56.1 php5-dba-5.5.14-56.1 php5-dba-debuginfo-5.5.14-56.1 php5-debuginfo-5.5.14-56.1 php5-debugsource-5.5.14-56.1 php5-dom-5.5.14-56.1 php5-dom-debuginfo-5.5.14-56.1 php5-enchant-5.5.14-56.1 php5-enchant-debuginfo-5.5.14-56.1 php5-exif-5.5.14-56.1 php5-exif-debuginfo-5.5.14-56.1 php5-fastcgi-5.5.14-56.1 php5-fastcgi-debuginfo-5.5.14-56.1 php5-fileinfo-5.5.14-56.1 php5-fileinfo-debuginfo-5.5.14-56.1 php5-fpm-5.5.14-56.1 php5-fpm-debuginfo-5.5.14-56.1 php5-ftp-5.5.14-56.1 php5-ftp-debuginfo-5.5.14-56.1 php5-gd-5.5.14-56.1 php5-gd-debuginfo-5.5.14-56.1 php5-gettext-5.5.14-56.1 php5-gettext-debuginfo-5.5.14-56.1 php5-gmp-5.5.14-56.1 php5-gmp-debuginfo-5.5.14-56.1 php5-iconv-5.5.14-56.1 php5-iconv-debuginfo-5.5.14-56.1 php5-intl-5.5.14-56.1 php5-intl-debuginfo-5.5.14-56.1 php5-json-5.5.14-56.1 php5-json-debuginfo-5.5.14-56.1 php5-ldap-5.5.14-56.1 php5-ldap-debuginfo-5.5.14-56.1 php5-mbstring-5.5.14-56.1 php5-mbstring-debuginfo-5.5.14-56.1 php5-mcrypt-5.5.14-56.1 php5-mcrypt-debuginfo-5.5.14-56.1 php5-mysql-5.5.14-56.1 php5-mysql-debuginfo-5.5.14-56.1 php5-odbc-5.5.14-56.1 php5-odbc-debuginfo-5.5.14-56.1 php5-opcache-5.5.14-56.1 php5-opcache-debuginfo-5.5.14-56.1 php5-openssl-5.5.14-56.1 php5-openssl-debuginfo-5.5.14-56.1 php5-pcntl-5.5.14-56.1 php5-pcntl-debuginfo-5.5.14-56.1 php5-pdo-5.5.14-56.1 php5-pdo-debuginfo-5.5.14-56.1 php5-pgsql-5.5.14-56.1 php5-pgsql-debuginfo-5.5.14-56.1 php5-phar-5.5.14-56.1 php5-phar-debuginfo-5.5.14-56.1 php5-posix-5.5.14-56.1 php5-posix-debuginfo-5.5.14-56.1 php5-pspell-5.5.14-56.1 php5-pspell-debuginfo-5.5.14-56.1 php5-shmop-5.5.14-56.1 php5-shmop-debuginfo-5.5.14-56.1 php5-snmp-5.5.14-56.1 php5-snmp-debuginfo-5.5.14-56.1 php5-soap-5.5.14-56.1 php5-soap-debuginfo-5.5.14-56.1 php5-sockets-5.5.14-56.1 php5-sockets-debuginfo-5.5.14-56.1 php5-sqlite-5.5.14-56.1 php5-sqlite-debuginfo-5.5.14-56.1 php5-suhosin-5.5.14-56.1 php5-suhosin-debuginfo-5.5.14-56.1 php5-sysvmsg-5.5.14-56.1 php5-sysvmsg-debuginfo-5.5.14-56.1 php5-sysvsem-5.5.14-56.1 php5-sysvsem-debuginfo-5.5.14-56.1 php5-sysvshm-5.5.14-56.1 php5-sysvshm-debuginfo-5.5.14-56.1 php5-tokenizer-5.5.14-56.1 php5-tokenizer-debuginfo-5.5.14-56.1 php5-wddx-5.5.14-56.1 php5-wddx-debuginfo-5.5.14-56.1 php5-xmlreader-5.5.14-56.1 php5-xmlreader-debuginfo-5.5.14-56.1 php5-xmlrpc-5.5.14-56.1 php5-xmlrpc-debuginfo-5.5.14-56.1 php5-xmlwriter-5.5.14-56.1 php5-xmlwriter-debuginfo-5.5.14-56.1 php5-xsl-5.5.14-56.1 php5-xsl-debuginfo-5.5.14-56.1 php5-zip-5.5.14-56.1 php5-zip-debuginfo-5.5.14-56.1 php5-zlib-5.5.14-56.1 php5-zlib-debuginfo-5.5.14-56.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-56.1 References: https://www.suse.com/security/cve/CVE-2015-8866.html https://www.suse.com/security/cve/CVE-2015-8867.html https://www.suse.com/security/cve/CVE-2016-4070.html https://www.suse.com/security/cve/CVE-2016-4071.html https://www.suse.com/security/cve/CVE-2016-4073.html https://bugzilla.suse.com/976996 https://bugzilla.suse.com/976997 https://bugzilla.suse.com/977000 https://bugzilla.suse.com/977003 https://bugzilla.suse.com/977005 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1275-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 11 May '16

11 May '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1275-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled. They can be re-enabled by exporting the following environment variable MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/modules-Q16/coders/vu lnerable/ (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ImageMagick-12549=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ImageMagick-12549=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ImageMagick-12549=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ImageMagick-12549=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ImageMagick-12549=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ImageMagick-12549=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ImageMagick-12549=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ImageMagick-12549=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ImageMagick-12549=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-ImageMagick-12549=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 libMagickCore1-6.4.3.6-7.34.1 - SUSE Manager Proxy 2.1 (x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 libMagickCore1-6.4.3.6-7.34.1 - SUSE Manager 2.1 (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 libMagickCore1-6.4.3.6-7.34.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-6.4.3.6-7.34.1 ImageMagick-devel-6.4.3.6-7.34.1 libMagick++-devel-6.4.3.6-7.34.1 libMagick++1-6.4.3.6-7.34.1 libMagickWand1-6.4.3.6-7.34.1 perl-PerlMagick-6.4.3.6-7.34.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libMagickWand1-32bit-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libMagickCore1-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.34.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.34.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.34.1 ImageMagick-debugsource-6.4.3.6-7.34.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.34.1 ImageMagick-debugsource-6.4.3.6-7.34.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.34.1 ImageMagick-debugsource-6.4.3.6-7.34.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1274-1: important: Security update for php5
by opensuse-security＠opensuse.org 11 May '16

11 May '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1274-1 Rating: important References: #976775 #976996 #976997 #977000 #977003 #977005 Cross-References: CVE-2015-8866 CVE-2015-8867 CVE-2016-3074 CVE-2016-4070 CVE-2016-4071 CVE-2016-4073 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2016-3074: Signedness vulnerability in bundled libgd may have resulted in a heap overflow when processing compressed gd2 data. (boo#976775) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) - CVE-2016-4071: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string formatting in php_snmp_error() (bsc#977000) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-576=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-57.1 apache2-mod_php5-debuginfo-5.6.1-57.1 php5-5.6.1-57.1 php5-bcmath-5.6.1-57.1 php5-bcmath-debuginfo-5.6.1-57.1 php5-bz2-5.6.1-57.1 php5-bz2-debuginfo-5.6.1-57.1 php5-calendar-5.6.1-57.1 php5-calendar-debuginfo-5.6.1-57.1 php5-ctype-5.6.1-57.1 php5-ctype-debuginfo-5.6.1-57.1 php5-curl-5.6.1-57.1 php5-curl-debuginfo-5.6.1-57.1 php5-dba-5.6.1-57.1 php5-dba-debuginfo-5.6.1-57.1 php5-debuginfo-5.6.1-57.1 php5-debugsource-5.6.1-57.1 php5-devel-5.6.1-57.1 php5-dom-5.6.1-57.1 php5-dom-debuginfo-5.6.1-57.1 php5-enchant-5.6.1-57.1 php5-enchant-debuginfo-5.6.1-57.1 php5-exif-5.6.1-57.1 php5-exif-debuginfo-5.6.1-57.1 php5-fastcgi-5.6.1-57.1 php5-fastcgi-debuginfo-5.6.1-57.1 php5-fileinfo-5.6.1-57.1 php5-fileinfo-debuginfo-5.6.1-57.1 php5-firebird-5.6.1-57.1 php5-firebird-debuginfo-5.6.1-57.1 php5-fpm-5.6.1-57.1 php5-fpm-debuginfo-5.6.1-57.1 php5-ftp-5.6.1-57.1 php5-ftp-debuginfo-5.6.1-57.1 php5-gd-5.6.1-57.1 php5-gd-debuginfo-5.6.1-57.1 php5-gettext-5.6.1-57.1 php5-gettext-debuginfo-5.6.1-57.1 php5-gmp-5.6.1-57.1 php5-gmp-debuginfo-5.6.1-57.1 php5-iconv-5.6.1-57.1 php5-iconv-debuginfo-5.6.1-57.1 php5-imap-5.6.1-57.1 php5-imap-debuginfo-5.6.1-57.1 php5-intl-5.6.1-57.1 php5-intl-debuginfo-5.6.1-57.1 php5-json-5.6.1-57.1 php5-json-debuginfo-5.6.1-57.1 php5-ldap-5.6.1-57.1 php5-ldap-debuginfo-5.6.1-57.1 php5-mbstring-5.6.1-57.1 php5-mbstring-debuginfo-5.6.1-57.1 php5-mcrypt-5.6.1-57.1 php5-mcrypt-debuginfo-5.6.1-57.1 php5-mssql-5.6.1-57.1 php5-mssql-debuginfo-5.6.1-57.1 php5-mysql-5.6.1-57.1 php5-mysql-debuginfo-5.6.1-57.1 php5-odbc-5.6.1-57.1 php5-odbc-debuginfo-5.6.1-57.1 php5-opcache-5.6.1-57.1 php5-opcache-debuginfo-5.6.1-57.1 php5-openssl-5.6.1-57.1 php5-openssl-debuginfo-5.6.1-57.1 php5-pcntl-5.6.1-57.1 php5-pcntl-debuginfo-5.6.1-57.1 php5-pdo-5.6.1-57.1 php5-pdo-debuginfo-5.6.1-57.1 php5-pgsql-5.6.1-57.1 php5-pgsql-debuginfo-5.6.1-57.1 php5-phar-5.6.1-57.1 php5-phar-debuginfo-5.6.1-57.1 php5-posix-5.6.1-57.1 php5-posix-debuginfo-5.6.1-57.1 php5-pspell-5.6.1-57.1 php5-pspell-debuginfo-5.6.1-57.1 php5-readline-5.6.1-57.1 php5-readline-debuginfo-5.6.1-57.1 php5-shmop-5.6.1-57.1 php5-shmop-debuginfo-5.6.1-57.1 php5-snmp-5.6.1-57.1 php5-snmp-debuginfo-5.6.1-57.1 php5-soap-5.6.1-57.1 php5-soap-debuginfo-5.6.1-57.1 php5-sockets-5.6.1-57.1 php5-sockets-debuginfo-5.6.1-57.1 php5-sqlite-5.6.1-57.1 php5-sqlite-debuginfo-5.6.1-57.1 php5-suhosin-5.6.1-57.1 php5-suhosin-debuginfo-5.6.1-57.1 php5-sysvmsg-5.6.1-57.1 php5-sysvmsg-debuginfo-5.6.1-57.1 php5-sysvsem-5.6.1-57.1 php5-sysvsem-debuginfo-5.6.1-57.1 php5-sysvshm-5.6.1-57.1 php5-sysvshm-debuginfo-5.6.1-57.1 php5-tidy-5.6.1-57.1 php5-tidy-debuginfo-5.6.1-57.1 php5-tokenizer-5.6.1-57.1 php5-tokenizer-debuginfo-5.6.1-57.1 php5-wddx-5.6.1-57.1 php5-wddx-debuginfo-5.6.1-57.1 php5-xmlreader-5.6.1-57.1 php5-xmlreader-debuginfo-5.6.1-57.1 php5-xmlrpc-5.6.1-57.1 php5-xmlrpc-debuginfo-5.6.1-57.1 php5-xmlwriter-5.6.1-57.1 php5-xmlwriter-debuginfo-5.6.1-57.1 php5-xsl-5.6.1-57.1 php5-xsl-debuginfo-5.6.1-57.1 php5-zip-5.6.1-57.1 php5-zip-debuginfo-5.6.1-57.1 php5-zlib-5.6.1-57.1 php5-zlib-debuginfo-5.6.1-57.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-57.1 References: https://www.suse.com/security/cve/CVE-2015-8866.html https://www.suse.com/security/cve/CVE-2015-8867.html https://www.suse.com/security/cve/CVE-2016-3074.html https://www.suse.com/security/cve/CVE-2016-4070.html https://www.suse.com/security/cve/CVE-2016-4071.html https://www.suse.com/security/cve/CVE-2016-4073.html https://bugzilla.suse.com/976775 https://bugzilla.suse.com/976996 https://bugzilla.suse.com/976997 https://bugzilla.suse.com/977000 https://bugzilla.suse.com/977003 https://bugzilla.suse.com/977005 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1273-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 11 May '16

11 May '16

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1273-1 Rating: important References: #889013 #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for compat-openssl098 fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse The following non-security bugs were fixed: - bsc#889013: Rename README.SuSE to the new spelling (bsc#889013) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-575=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-12.2 libopenssl0_9_8-0.9.8j-12.2 libopenssl0_9_8-debuginfo-0.9.8j-12.2 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-12.2 libopenssl0_9_8-debuginfo-32bit-0.9.8j-12.2 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/889013 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1267-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 09 May '16

09 May '16

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1267-1 Rating: important References: #889013 #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for compat-openssl098 fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse The following non-security bugs were fixed: - bsc#889013: Rename README.SuSE to the new spelling (bsc#889013) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2016-735=1 - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-735=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-735=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-735=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): compat-openssl098-debugsource-0.9.8j-97.1 libopenssl0_9_8-0.9.8j-97.1 libopenssl0_9_8-debuginfo-0.9.8j-97.1 - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-97.1 libopenssl0_9_8-0.9.8j-97.1 libopenssl0_9_8-32bit-0.9.8j-97.1 libopenssl0_9_8-debuginfo-0.9.8j-97.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-97.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): compat-openssl098-debugsource-0.9.8j-97.1 libopenssl0_9_8-0.9.8j-97.1 libopenssl0_9_8-32bit-0.9.8j-97.1 libopenssl0_9_8-debuginfo-0.9.8j-97.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-97.1 - SUSE Linux Enterprise Desktop 12 (x86_64): compat-openssl098-debugsource-0.9.8j-97.1 libopenssl0_9_8-0.9.8j-97.1 libopenssl0_9_8-32bit-0.9.8j-97.1 libopenssl0_9_8-debuginfo-0.9.8j-97.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-97.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/889013 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1266-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1266-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing "/etc/ImageMagick-*/policy.xml" (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-574=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-9.1 ImageMagick-debuginfo-6.8.8.1-9.1 ImageMagick-debugsource-6.8.8.1-9.1 ImageMagick-devel-6.8.8.1-9.1 ImageMagick-extra-6.8.8.1-9.1 ImageMagick-extra-debuginfo-6.8.8.1-9.1 libMagick++-6_Q16-3-6.8.8.1-9.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-9.1 libMagick++-devel-6.8.8.1-9.1 libMagickCore-6_Q16-1-6.8.8.1-9.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-9.1 libMagickWand-6_Q16-1-6.8.8.1-9.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-9.1 perl-PerlMagick-6.8.8.1-9.1 perl-PerlMagick-debuginfo-6.8.8.1-9.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-9.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-9.1 libMagick++-6_Q16-3-32bit-6.8.8.1-9.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-9.1 libMagick++-devel-32bit-6.8.8.1-9.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-9.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-9.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1265-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1265-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-573=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.101-31.1 java-1_7_0-openjdk-accessibility-1.7.0.101-31.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-demo-1.7.0.101-31.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-devel-1.7.0.101-31.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-headless-1.7.0.101-31.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-src-1.7.0.101-31.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.101-31.1 - openSUSE Leap 42.1 (x86_64): java-1_7_0-openjdk-bootstrap-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.101-31.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1262-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1262-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-572=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.91-12.1 java-1_8_0-openjdk-accessibility-1.8.0.91-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-debugsource-1.8.0.91-12.1 java-1_8_0-openjdk-demo-1.8.0.91-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-devel-1.8.0.91-12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-headless-1.8.0.91-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-src-1.8.0.91-12.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.91-12.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1261-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1261-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: The update disables various insecure coders [boo#978061] These fix issues tracked in CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, CVE-2016-3718 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-569=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-18.1 ImageMagick-debuginfo-6.8.9.8-18.1 ImageMagick-debugsource-6.8.9.8-18.1 ImageMagick-devel-6.8.9.8-18.1 ImageMagick-extra-6.8.9.8-18.1 ImageMagick-extra-debuginfo-6.8.9.8-18.1 libMagick++-6_Q16-5-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-18.1 libMagick++-devel-6.8.9.8-18.1 libMagickCore-6_Q16-2-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-18.1 libMagickWand-6_Q16-2-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-18.1 perl-PerlMagick-6.8.9.8-18.1 perl-PerlMagick-debuginfo-6.8.9.8-18.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-18.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-18.1 libMagick++-devel-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1260-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1260-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing "/etc/ImageMagick-*/policy.xml" (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-733=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-733=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-733=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-733=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-733=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-733=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-733=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-733=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 ImageMagick-devel-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagick++-devel-6.8.8.1-19.1 perl-PerlMagick-6.8.8.1-19.1 perl-PerlMagick-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 ImageMagick-devel-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagick++-devel-6.8.8.1-19.1 perl-PerlMagick-6.8.8.1-19.1 perl-PerlMagick-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 - SUSE Linux Enterprise Desktop 12 (x86_64): ImageMagick-6.8.8.1-19.1 ImageMagick-debuginfo-6.8.8.1-19.1 ImageMagick-debugsource-6.8.8.1-19.1 libMagick++-6_Q16-3-6.8.8.1-19.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-19.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-19.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-19.1 libMagickWand-6_Q16-1-6.8.8.1-19.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-19.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1258-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1258-1 Rating: important References: #977333 #977374 #977376 #977381 #977386 Cross-References: CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update to MozillaFirefox 38.8.0 ESR fixes the following issues (bsc#977333): - CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-732=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-732=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-732=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-732=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-732=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-732=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-devel-38.8.0esr-66.2 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-devel-38.8.0esr-66.2 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.8.0esr-66.2 MozillaFirefox-debuginfo-38.8.0esr-66.2 MozillaFirefox-debugsource-38.8.0esr-66.2 MozillaFirefox-translations-38.8.0esr-66.2 References: https://www.suse.com/security/cve/CVE-2016-2805.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2808.html https://www.suse.com/security/cve/CVE-2016-2814.html https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977374 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/977381 https://bugzilla.suse.com/977386 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1250-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1250-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-725=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-725=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-725=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-725=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-demo-1.7.0.101-30.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-devel-1.7.0.101-30.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-demo-1.7.0.101-30.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-devel-1.7.0.101-30.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 - SUSE Linux Enterprise Desktop 12 (x86_64): java-1_7_0-openjdk-1.7.0.101-30.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-30.1 java-1_7_0-openjdk-debugsource-1.7.0.101-30.1 java-1_7_0-openjdk-headless-1.7.0.101-30.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-30.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1248-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1248-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-724=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-724=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.91-11.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-debugsource-1.8.0.91-11.1 java-1_8_0-openjdk-demo-1.8.0.91-11.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-devel-1.8.0.91-11.1 java-1_8_0-openjdk-headless-1.8.0.91-11.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_8_0-openjdk-1.8.0.91-11.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-11.1 java-1_8_0-openjdk-debugsource-1.8.0.91-11.1 java-1_8_0-openjdk-headless-1.8.0.91-11.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-11.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1247-1: important: Security update for ntp
by opensuse-security＠opensuse.org 06 May '16

06 May '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1247-1 Rating: important References: #782060 #905885 #910063 #916617 #920238 #926510 #936327 #937837 #942587 #944300 #946386 #951559 #951608 #951629 #954982 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 28 vulnerabilities and has two fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 28 security issues. Major functional changes: - The "sntp" commandline tool changed its option handling in a major way, some options have been renamed or dropped. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. - The local clock is being disabled during update. - ntpd is no longer running chrooted. Other functional changes: - ntp-signd is installed. - "enable mode7" can be added to the configuration to allow ntdpc to work as compatibility mode option. - "kod" was removed from the default restrictions. - SHA1 keys are used by default instead of MD5 keys. Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608). - CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608). - CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608). - CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608). - CVE-2015-7850: remote config logfile-keyfile (bsc#951608). - CVE-2015-7849: trusted key use-after-free (bsc#951608). - CVE-2015-7848: mode 7 loop counter underrun (bsc#951608). - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608). - CVE-2015-7703: configuration directives "pidfile" and "driftfile" should only be allowed locally (bsc#951608). - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608). - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq. - bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution. - bsc#905885: Use SHA1 instead of MD5 for symmetric keys. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - Fix legacy action scripts to pass on command line arguments. - bsc#944300: Remove "kod" from the restrict line in ntp.conf. - bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd. - Add a controlkey to ntp.conf to make the above work. - Don't let "keysdir" lines in ntp.conf trigger the "keys" parser. - Disable mode 7 (ntpdc) again, now that we don't use it anymore. - Add "addserver" as a new legacy action. - bsc#910063: Fix the comment regarding addserver in ntp.conf. - bsc#926510: Disable chroot by default. - bsc#920238: Enable ntpdc for backwards compatibility. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-727=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-727=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-727=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (noarch): yast2-ntp-client-devel-doc-3.1.12.4-8.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ntp-4.2.8p6-46.5.2 ntp-debuginfo-4.2.8p6-46.5.2 ntp-debugsource-4.2.8p6-46.5.2 ntp-doc-4.2.8p6-46.5.2 - SUSE Linux Enterprise Server 12 (noarch): yast2-ntp-client-3.1.12.4-8.2 - SUSE Linux Enterprise Desktop 12 (noarch): yast2-ntp-client-3.1.12.4-8.2 - SUSE Linux Enterprise Desktop 12 (x86_64): ntp-4.2.8p6-46.5.2 ntp-debuginfo-4.2.8p6-46.5.2 ntp-debugsource-4.2.8p6-46.5.2 ntp-doc-4.2.8p6-46.5.2 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7691.html https://www.suse.com/security/cve/CVE-2015-7692.html https://www.suse.com/security/cve/CVE-2015-7701.html https://www.suse.com/security/cve/CVE-2015-7702.html https://www.suse.com/security/cve/CVE-2015-7703.html https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7848.html https://www.suse.com/security/cve/CVE-2015-7849.html https://www.suse.com/security/cve/CVE-2015-7850.html https://www.suse.com/security/cve/CVE-2015-7851.html https://www.suse.com/security/cve/CVE-2015-7852.html https://www.suse.com/security/cve/CVE-2015-7853.html https://www.suse.com/security/cve/CVE-2015-7854.html https://www.suse.com/security/cve/CVE-2015-7855.html https://www.suse.com/security/cve/CVE-2015-7871.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/905885 https://bugzilla.suse.com/910063 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/920238 https://bugzilla.suse.com/926510 https://bugzilla.suse.com/936327 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/942587 https://bugzilla.suse.com/944300 https://bugzilla.suse.com/946386 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951608 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/954982 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1243-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1243-1 Rating: important References: #958501 #976942 #976943 #977614 #977615 #977616 #977617 #977621 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse - bsc#977621: Preserve negotiated digests for SNI (bsc#977621) - bsc#958501: Fix openssl enc -non-fips-allow option in FIPS mode (bsc#958501) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-564=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-15.1 libopenssl1_0_0-1.0.1i-15.1 libopenssl1_0_0-debuginfo-1.0.1i-15.1 libopenssl1_0_0-hmac-1.0.1i-15.1 openssl-1.0.1i-15.1 openssl-debuginfo-1.0.1i-15.1 openssl-debugsource-1.0.1i-15.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-15.1 libopenssl1_0_0-32bit-1.0.1i-15.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-15.1 libopenssl1_0_0-hmac-32bit-1.0.1i-15.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-15.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/958501 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617 https://bugzilla.suse.com/977621 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1242-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1242-1 Rating: important References: #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-565=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-565=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl0_9_8-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-0.9.8zh-17.1 libopenssl0_9_8-debugsource-0.9.8zh-17.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-17.1 - openSUSE 13.2 (i586 x86_64): libopenssl0_9_8-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-0.9.8zh-9.6.1 libopenssl0_9_8-debugsource-0.9.8zh-9.6.1 - openSUSE 13.2 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-9.6.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0