January 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:0261-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0261-1 Rating: important References: #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment This update adds the following functionality: - fate#319300: SHA2 password hashing module that can be loaded on-demand. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-104=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-libldap-2_3-0-2.3.37-11.1 compat-libldap-2_3-0-debuginfo-2.3.37-11.1 libldap-2_4-2-2.4.41-11.1 libldap-2_4-2-debuginfo-2.4.41-11.1 openldap2-2.4.41-11.1 openldap2-back-meta-2.4.41-11.1 openldap2-back-meta-debuginfo-2.4.41-11.1 openldap2-back-perl-2.4.41-11.1 openldap2-back-perl-debuginfo-2.4.41-11.1 openldap2-back-sql-2.4.41-11.1 openldap2-back-sql-debuginfo-2.4.41-11.1 openldap2-client-2.4.41-11.1 openldap2-client-debuginfo-2.4.41-11.1 openldap2-client-debugsource-2.4.41-11.1 openldap2-debuginfo-2.4.41-11.1 openldap2-debugsource-2.4.41-11.1 openldap2-devel-2.4.41-11.1 openldap2-devel-static-2.4.41-11.1 - openSUSE Leap 42.1 (x86_64): libldap-2_4-2-32bit-2.4.41-11.1 libldap-2_4-2-debuginfo-32bit-2.4.41-11.1 openldap2-devel-32bit-2.4.41-11.1 - openSUSE Leap 42.1 (noarch): openldap2-doc-2.4.41-11.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0256-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0256-1 Rating: critical References: #960996 #962743 Cross-References: CVE-2015-7575 CVE-2015-8126 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0475 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743) The following vulnerabilities were fixed: - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-160=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-160=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.72-3.2 java-1_8_0-openjdk-debuginfo-1.8.0.72-3.2 java-1_8_0-openjdk-debugsource-1.8.0.72-3.2 java-1_8_0-openjdk-demo-1.8.0.72-3.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-3.2 java-1_8_0-openjdk-devel-1.8.0.72-3.2 java-1_8_0-openjdk-headless-1.8.0.72-3.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-3.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): java-1_8_0-openjdk-1.8.0.72-3.2 java-1_8_0-openjdk-debuginfo-1.8.0.72-3.2 java-1_8_0-openjdk-debugsource-1.8.0.72-3.2 java-1_8_0-openjdk-headless-1.8.0.72-3.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-3.2 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0475.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0255-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0255-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libldap-2_4-2-2.4.33-8.6.1 libldap-2_4-2-debuginfo-2.4.33-8.6.1 openldap2-2.4.33-8.6.1 openldap2-back-meta-2.4.33-8.6.1 openldap2-back-meta-debuginfo-2.4.33-8.6.1 openldap2-back-perl-2.4.33-8.6.1 openldap2-back-perl-debuginfo-2.4.33-8.6.1 openldap2-back-sql-2.4.33-8.6.1 openldap2-back-sql-debuginfo-2.4.33-8.6.1 openldap2-client-2.4.33-8.6.1 openldap2-client-debuginfo-2.4.33-8.6.1 openldap2-client-debugsource-2.4.33-8.6.1 openldap2-debuginfo-2.4.33-8.6.1 openldap2-debugsource-2.4.33-8.6.1 openldap2-devel-2.4.33-8.6.1 openldap2-devel-static-2.4.33-8.6.1 - openSUSE 13.1 (x86_64): libldap-2_4-2-32bit-2.4.33-8.6.1 libldap-2_4-2-debuginfo-32bit-2.4.33-8.6.1 openldap2-devel-32bit-2.4.33-8.6.1 - openSUSE 13.1 (noarch): openldap2-doc-2.4.33-8.6.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0250-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0250-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-99=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-99=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-48.0.2564.82-13.1 chromedriver-debuginfo-48.0.2564.82-13.1 chromium-48.0.2564.82-13.1 chromium-debuginfo-48.0.2564.82-13.1 chromium-debugsource-48.0.2564.82-13.1 chromium-desktop-gnome-48.0.2564.82-13.1 chromium-desktop-kde-48.0.2564.82-13.1 chromium-ffmpegsumo-48.0.2564.82-13.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-13.1 - openSUSE 13.2 (i586 x86_64): chromedriver-48.0.2564.82-67.1 chromedriver-debuginfo-48.0.2564.82-67.1 chromium-48.0.2564.82-67.1 chromium-debuginfo-48.0.2564.82-67.1 chromium-debugsource-48.0.2564.82-67.1 chromium-desktop-gnome-48.0.2564.82-67.1 chromium-desktop-kde-48.0.2564.82-67.1 chromium-ffmpegsumo-48.0.2564.82-67.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-67.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0249-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0249-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-99=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-48.0.2564.82-41.1 chromedriver-debuginfo-48.0.2564.82-41.1 chromium-48.0.2564.82-41.1 chromium-debuginfo-48.0.2564.82-41.1 chromium-debugsource-48.0.2564.82-41.1 chromium-desktop-gnome-48.0.2564.82-41.1 chromium-desktop-kde-48.0.2564.82-41.1 chromium-ffmpegsumo-48.0.2564.82-41.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-41.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0243-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0243-1 Rating: important References: #961937 Cross-References: CVE-2016-1897 CVE-2016-1898 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to ffmpeg 2.8.5 fixes the following issues: * CVE-2016-1897: Cross-origin issue in URL processing (concat) - local file disclosure (boo#961937) * CVE-2016-1898: Cross-origin issue in URL processing (subfile) - local file disclosure (boo#961937) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-94=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffmpeg-2.8.5-12.1 ffmpeg-debuginfo-2.8.5-12.1 ffmpeg-debugsource-2.8.5-12.1 ffmpeg-devel-2.8.5-12.1 libavcodec-devel-2.8.5-12.1 libavcodec56-2.8.5-12.1 libavcodec56-debuginfo-2.8.5-12.1 libavdevice-devel-2.8.5-12.1 libavdevice56-2.8.5-12.1 libavdevice56-debuginfo-2.8.5-12.1 libavfilter-devel-2.8.5-12.1 libavfilter5-2.8.5-12.1 libavfilter5-debuginfo-2.8.5-12.1 libavformat-devel-2.8.5-12.1 libavformat56-2.8.5-12.1 libavformat56-debuginfo-2.8.5-12.1 libavresample-devel-2.8.5-12.1 libavresample2-2.8.5-12.1 libavresample2-debuginfo-2.8.5-12.1 libavutil-devel-2.8.5-12.1 libavutil54-2.8.5-12.1 libavutil54-debuginfo-2.8.5-12.1 libpostproc-devel-2.8.5-12.1 libpostproc53-2.8.5-12.1 libpostproc53-debuginfo-2.8.5-12.1 libswresample-devel-2.8.5-12.1 libswresample1-2.8.5-12.1 libswresample1-debuginfo-2.8.5-12.1 libswscale-devel-2.8.5-12.1 libswscale3-2.8.5-12.1 libswscale3-debuginfo-2.8.5-12.1 - openSUSE Leap 42.1 (x86_64): libavcodec56-32bit-2.8.5-12.1 libavcodec56-debuginfo-32bit-2.8.5-12.1 libavdevice56-32bit-2.8.5-12.1 libavdevice56-debuginfo-32bit-2.8.5-12.1 libavfilter5-32bit-2.8.5-12.1 libavfilter5-debuginfo-32bit-2.8.5-12.1 libavformat56-32bit-2.8.5-12.1 libavformat56-debuginfo-32bit-2.8.5-12.1 libavresample2-32bit-2.8.5-12.1 libavresample2-debuginfo-32bit-2.8.5-12.1 libavutil54-32bit-2.8.5-12.1 libavutil54-debuginfo-32bit-2.8.5-12.1 libpostproc53-32bit-2.8.5-12.1 libpostproc53-debuginfo-32bit-2.8.5-12.1 libswresample1-32bit-2.8.5-12.1 libswresample1-debuginfo-32bit-2.8.5-12.1 libswscale3-32bit-2.8.5-12.1 libswscale3-debuginfo-32bit-2.8.5-12.1 References: https://www.suse.com/security/cve/CVE-2016-1897.html https://www.suse.com/security/cve/CVE-2016-1898.html https://bugzilla.suse.com/961937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0227-1: important: Security update for bind
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0227-1 Rating: important References: #939567 #944066 #958861 #962189 Cross-References: CVE-2015-5477 CVE-2015-5722 CVE-2015-8000 CVE-2015-8704 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: This update for bind fixes the following issues: * CVE-2015-8000: Remote denial of service by mis-parsing incoming responses. (bsc#958861) * CVE-2015-5722: DoS against servers performing validation on DNSSEC-signed records. (bsc#944066) * CVE-2015-5477: DoS against authoritative and recursive servers. * CVE-2015-8704: Specific APL data could trigger a crash. (bsc#962189) Security Issues: * CVE-2015-8000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000> * CVE-2015-5722 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5722> * CVE-2015-5477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477> * CVE-2015-8704 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 9.6ESVR11P1]: bind-9.6ESVR11P1-0.18.1 bind-chrootenv-9.6ESVR11P1-0.18.1 bind-devel-9.6ESVR11P1-0.18.1 bind-doc-9.6ESVR11P1-0.18.1 bind-libs-9.6ESVR11P1-0.18.1 bind-utils-9.6ESVR11P1-0.18.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 9.6ESVR11P1]: bind-libs-32bit-9.6ESVR11P1-0.18.1 References: https://www.suse.com/security/cve/CVE-2015-5477.html https://www.suse.com/security/cve/CVE-2015-5722.html https://www.suse.com/security/cve/CVE-2015-8000.html https://www.suse.com/security/cve/CVE-2015-8704.html https://bugzilla.suse.com/939567 https://bugzilla.suse.com/944066 https://bugzilla.suse.com/958861 https://bugzilla.suse.com/962189 https://download.suse.com/patch/finder/?keywords=6c9cd85bd7aa9140126fe2cf19… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0226-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0226-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-92=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): compat-libldap-2_3-0-2.3.37-8.9.1 compat-libldap-2_3-0-debuginfo-2.3.37-8.9.1 libldap-2_4-2-2.4.39-8.9.1 libldap-2_4-2-debuginfo-2.4.39-8.9.1 openldap2-2.4.39-8.9.1 openldap2-back-meta-2.4.39-8.9.1 openldap2-back-meta-debuginfo-2.4.39-8.9.1 openldap2-back-perl-2.4.39-8.9.1 openldap2-back-perl-debuginfo-2.4.39-8.9.1 openldap2-back-sql-2.4.39-8.9.1 openldap2-back-sql-debuginfo-2.4.39-8.9.1 openldap2-client-2.4.39-8.9.1 openldap2-client-debuginfo-2.4.39-8.9.1 openldap2-client-debugsource-2.4.39-8.9.1 openldap2-debuginfo-2.4.39-8.9.1 openldap2-debugsource-2.4.39-8.9.1 openldap2-devel-2.4.39-8.9.1 openldap2-devel-static-2.4.39-8.9.1 - openSUSE 13.2 (x86_64): libldap-2_4-2-32bit-2.4.39-8.9.1 libldap-2_4-2-debuginfo-32bit-2.4.39-8.9.1 openldap2-devel-32bit-2.4.39-8.9.1 - openSUSE 13.2 (noarch): openldap2-doc-2.4.39-8.9.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0224-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

SUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0224-1 Rating: important References: #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment This update adds the following functionality: - fate#319300: SHA2 password hashing module that can be loaded on-demand. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-139=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-139=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-139=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-139=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-139=1 - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-139=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-139=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-139=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): openldap2-back-perl-2.4.41-18.13.4 openldap2-back-perl-debuginfo-2.4.41-18.13.4 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 openldap2-debuginfo-2.4.41-18.13.4 openldap2-debugsource-2.4.41-18.13.4 openldap2-devel-2.4.41-18.13.1 openldap2-devel-static-2.4.41-18.13.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): openldap2-back-perl-2.4.41-18.13.4 openldap2-back-perl-debuginfo-2.4.41-18.13.4 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 openldap2-debuginfo-2.4.41-18.13.4 openldap2-debugsource-2.4.41-18.13.4 openldap2-devel-2.4.41-18.13.1 openldap2-devel-static-2.4.41-18.13.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): compat-libldap-2_3-0-2.3.37-18.13.4 compat-libldap-2_3-0-debuginfo-2.3.37-18.13.4 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libldap-2_4-2-2.4.41-18.13.1 libldap-2_4-2-debuginfo-2.4.41-18.13.1 openldap2-2.4.41-18.13.4 openldap2-back-meta-2.4.41-18.13.4 openldap2-back-meta-debuginfo-2.4.41-18.13.4 openldap2-client-2.4.41-18.13.1 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 openldap2-debuginfo-2.4.41-18.13.4 openldap2-debugsource-2.4.41-18.13.4 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libldap-2_4-2-32bit-2.4.41-18.13.1 libldap-2_4-2-debuginfo-32bit-2.4.41-18.13.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libldap-2_4-2-2.4.41-18.13.1 libldap-2_4-2-debuginfo-2.4.41-18.13.1 openldap2-2.4.41-18.13.4 openldap2-back-meta-2.4.41-18.13.4 openldap2-back-meta-debuginfo-2.4.41-18.13.4 openldap2-client-2.4.41-18.13.1 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 openldap2-debuginfo-2.4.41-18.13.4 openldap2-debugsource-2.4.41-18.13.4 - SUSE Linux Enterprise Server 12 (s390x x86_64): libldap-2_4-2-32bit-2.4.41-18.13.1 libldap-2_4-2-debuginfo-32bit-2.4.41-18.13.1 - SUSE Linux Enterprise Module for Legacy Software 12 (ppc64le s390x x86_64): compat-libldap-2_3-0-2.3.37-18.13.4 compat-libldap-2_3-0-debuginfo-2.3.37-18.13.4 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libldap-2_4-2-2.4.41-18.13.1 libldap-2_4-2-32bit-2.4.41-18.13.1 libldap-2_4-2-debuginfo-2.4.41-18.13.1 libldap-2_4-2-debuginfo-32bit-2.4.41-18.13.1 openldap2-client-2.4.41-18.13.1 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libldap-2_4-2-2.4.41-18.13.1 libldap-2_4-2-32bit-2.4.41-18.13.1 libldap-2_4-2-debuginfo-2.4.41-18.13.1 libldap-2_4-2-debuginfo-32bit-2.4.41-18.13.1 openldap2-client-2.4.41-18.13.1 openldap2-client-debuginfo-2.4.41-18.13.1 openldap2-client-debugsource-2.4.41-18.13.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0214-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0214-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to 1.0.8 - Add workaround for https://bugs.php.net/bug.php?id=70757 (#1490582) - Fix HTML sanitizer to skip  in output (#1490583) - Fix charset encoding of message/rfc822 part bodies (#1490606) - Fix handling of message/rfc822 attachments on replies and forwards (#1490607) - Fix PDF support detection in Firefox > 19 (#1490610) - Fix path traversal vulnerability (CWE-22) in setting a skin (#1490620) [CVE-2015-8770] [bnc#962067] - Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#1490619) - Fix .htaccess rewrite rules to not block .well-known URIs (#1490615) - Updated apache2 config Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-84=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): roundcubemail-1.0.8-2.27.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0