January 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:0120-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0120-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openssh-2016011302-12326=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-openssh-2016011302-12326=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssh-2016011302-12326=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssh-6.6p1-16.1 openssh-askpass-gnome-6.6p1-16.4 openssh-fips-6.6p1-16.1 openssh-helpers-6.6p1-16.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): openssh-6.6p1-16.1 openssh-askpass-gnome-6.6p1-16.4 openssh-helpers-6.6p1-16.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.6p1-16.4 openssh-debuginfo-6.6p1-16.1 openssh-debugsource-6.6p1-16.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0119-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0119-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssh-2016011301-12325=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.2p2-0.24.3 openssh-debuginfo-6.2p2-0.24.1 openssh-debugsource-6.2p2-0.24.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0118-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0118-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-85=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-85=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-85=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-85=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0117-1: critical: Security update for openssh-openssl1
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0117-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh-openssl1 fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openssh-openssl1-12327=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openssh-openssl1-6.6p1-10.1 openssh-openssl1-helpers-6.6p1-10.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0113-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 13 Jan '16

13 Jan '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0113-1 Rating: important References: #955131 #960286 #960402 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This version update for java-1_6_0-ibm to version 6.0.16.15 fixes the following issues: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 For more information please visit: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_Nove mber_2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_Nov ember_2015> Security Issues: * CVE-2015-4734 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4734> * CVE-2015-4803 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4803> * CVE-2015-4805 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4805> * CVE-2015-4806 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4806> * CVE-2015-4810 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4810> * CVE-2015-4835 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4835> * CVE-2015-4840 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4840> * CVE-2015-4842 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4842> * CVE-2015-4843 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4843> * CVE-2015-4844 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4844> * CVE-2015-4860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4860> * CVE-2015-4871 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4871> * CVE-2015-4872 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4872> * CVE-2015-4882 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4882> * CVE-2015-4883 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4883> * CVE-2015-4893 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4893> * CVE-2015-4902 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4902> * CVE-2015-4903 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4903> * CVE-2015-4911 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4911> * CVE-2015-5006 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5006> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-devel-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-fonts-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.15-0.16.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-5006.html https://bugzilla.suse.com/955131 https://bugzilla.suse.com/960286 https://bugzilla.suse.com/960402 https://download.suse.com/patch/finder/?keywords=750c96f801a1b590f58f15adc3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0089-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 12 Jan '16

12 Jan '16

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0089-1 Rating: important References: #960383 #960384 #960385 Cross-References: CVE-2015-8661 CVE-2015-8662 CVE-2015-8663 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to ffmpeg 2.8.4 fixes the following issues: * CVE-2015-8661: Denial of service via crafted .mov file [boo#960385] * CVE-2015-8662: Denial of service via crafted JPEG 2000 data [boo#960384] * CVE-2015-8663: Denial of service via crafted H.264 data [boo#960383] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-26=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffmpeg-2.8.4-9.1 ffmpeg-debuginfo-2.8.4-9.1 ffmpeg-debugsource-2.8.4-9.1 ffmpeg-devel-2.8.4-9.1 libavcodec-devel-2.8.4-9.1 libavcodec56-2.8.4-9.1 libavcodec56-debuginfo-2.8.4-9.1 libavdevice-devel-2.8.4-9.1 libavdevice56-2.8.4-9.1 libavdevice56-debuginfo-2.8.4-9.1 libavfilter-devel-2.8.4-9.1 libavfilter5-2.8.4-9.1 libavfilter5-debuginfo-2.8.4-9.1 libavformat-devel-2.8.4-9.1 libavformat56-2.8.4-9.1 libavformat56-debuginfo-2.8.4-9.1 libavresample-devel-2.8.4-9.1 libavresample2-2.8.4-9.1 libavresample2-debuginfo-2.8.4-9.1 libavutil-devel-2.8.4-9.1 libavutil54-2.8.4-9.1 libavutil54-debuginfo-2.8.4-9.1 libpostproc-devel-2.8.4-9.1 libpostproc53-2.8.4-9.1 libpostproc53-debuginfo-2.8.4-9.1 libswresample-devel-2.8.4-9.1 libswresample1-2.8.4-9.1 libswresample1-debuginfo-2.8.4-9.1 libswscale-devel-2.8.4-9.1 libswscale3-2.8.4-9.1 libswscale3-debuginfo-2.8.4-9.1 - openSUSE Leap 42.1 (x86_64): libavcodec56-32bit-2.8.4-9.1 libavcodec56-debuginfo-32bit-2.8.4-9.1 libavdevice56-32bit-2.8.4-9.1 libavdevice56-debuginfo-32bit-2.8.4-9.1 libavfilter5-32bit-2.8.4-9.1 libavfilter5-debuginfo-32bit-2.8.4-9.1 libavformat56-32bit-2.8.4-9.1 libavformat56-debuginfo-32bit-2.8.4-9.1 libavresample2-32bit-2.8.4-9.1 libavresample2-debuginfo-32bit-2.8.4-9.1 libavutil54-32bit-2.8.4-9.1 libavutil54-debuginfo-32bit-2.8.4-9.1 libpostproc53-32bit-2.8.4-9.1 libpostproc53-debuginfo-32bit-2.8.4-9.1 libswresample1-32bit-2.8.4-9.1 libswresample1-debuginfo-32bit-2.8.4-9.1 libswscale3-32bit-2.8.4-9.1 libswscale3-debuginfo-32bit-2.8.4-9.1 References: https://www.suse.com/security/cve/CVE-2015-8661.html https://www.suse.com/security/cve/CVE-2015-8662.html https://www.suse.com/security/cve/CVE-2015-8663.html https://bugzilla.suse.com/960383 https://bugzilla.suse.com/960384 https://bugzilla.suse.com/960385 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0036-1: important: Security update for grub2
by opensuse-security＠opensuse.org 06 Jan '16

06 Jan '16

openSUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0036-1 Rating: important References: #774666 #917427 #946148 #952539 #954126 #954519 #955493 #955609 #956631 Cross-References: CVE-2015-8370 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: - Fix buffer overflows when reading username and password. (bsc#956631, CVE-2015-8370) - Check MS-DOS header to find PE file header. (bsc#954126) - Use dirname for copying Xen kernel and initrd to esp. (bsc#955493) - Fix reading password by grub2-mkpasswd-pbdk2 without controlling tty. (bsc#954519) - Add luks, gcry_rijndael and gcry_sha1 to signed EFI image to support LUKS partition in default setup. (bsc#917427, bsc#955609) - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-10=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): grub2-2.02~beta2-76.1 grub2-branding-upstream-2.02~beta2-76.1 grub2-debuginfo-2.02~beta2-76.1 grub2-i386-pc-2.02~beta2-76.1 - openSUSE Leap 42.1 (x86_64): grub2-x86_64-efi-2.02~beta2-76.1 grub2-x86_64-xen-2.02~beta2-76.1 - openSUSE Leap 42.1 (noarch): grub2-snapper-plugin-2.02~beta2-76.1 - openSUSE Leap 42.1 (i586): grub2-i386-efi-2.02~beta2-76.1 References: https://www.suse.com/security/cve/CVE-2015-8370.html https://bugzilla.suse.com/774666 https://bugzilla.suse.com/917427 https://bugzilla.suse.com/946148 https://bugzilla.suse.com/952539 https://bugzilla.suse.com/954126 https://bugzilla.suse.com/954519 https://bugzilla.suse.com/955493 https://bugzilla.suse.com/955609 https://bugzilla.suse.com/956631 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0032-1: important: Security update for samba
by opensuse-security＠opensuse.org 05 Jan '16

05 Jan '16

SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0032-1 Rating: important References: #295284 #773464 #901813 #912457 #913304 #934299 #948244 #949022 #958582 #958583 #958584 #958586 Cross-References: CVE-2015-5252 CVE-2015-5296 CVE-2015-5299 CVE-2015-5330 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 8 fixes is now available. Description: This update for Samba fixes the following security issues: - CVE-2015-5330: Remote read memory exploit in LDB (bnc#958586). - CVE-2015-5252: Insufficient symlink verification (file access outside the share) (bnc#958582). - CVE-2015-5296: No man in the middle protection when forcing smb encryption on the client side (bnc#958584). - CVE-2015-5299: Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2) (bnc#958583). Non-security issues fixed: - Prevent null pointer access in samlogon fallback when security credentials are null (bnc#949022). - Address unrecoverable winbind failure: "key length too large" (bnc#934299). - Take resource group sids into account when caching netsamlogon data (bnc#912457). - Use domain name if search by domain SID fails to send SIDHistory lookups to correct idmap backend (bnc#773464). - Remove deprecated base_rid example from idmap_rid manpage (bnc#913304). - Purge printer name cache on spoolss SetPrinter change (bnc#901813). - Fix lookup of groups with "Local Domain" scope from Active Directory (bnc#948244). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-samba-12297=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-samba-12297=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): ldapsmb-1.34b-45.2 libldb1-3.6.3-45.2 libsmbclient0-3.6.3-45.2 libtalloc2-3.6.3-45.2 libtdb1-3.6.3-45.2 libtevent0-3.6.3-45.2 libwbclient0-3.6.3-45.2 samba-3.6.3-45.2 samba-client-3.6.3-45.2 samba-krb-printing-3.6.3-45.2 samba-winbind-3.6.3-45.2 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libsmbclient0-32bit-3.6.3-45.2 libtalloc2-32bit-3.6.3-45.2 libtdb1-32bit-3.6.3-45.2 libtevent0-32bit-3.6.3-45.2 libwbclient0-32bit-3.6.3-45.2 samba-32bit-3.6.3-45.2 samba-client-32bit-3.6.3-45.2 samba-winbind-32bit-3.6.3-45.2 - SUSE Linux Enterprise Server 11-SP2-LTSS (noarch): samba-doc-3.6.3-45.2 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): samba-debuginfo-3.6.3-45.2 samba-debugsource-3.6.3-45.2 - SUSE Linux Enterprise Debuginfo 11-SP2 (s390x x86_64): samba-debuginfo-32bit-3.6.3-45.2 References: https://www.suse.com/security/cve/CVE-2015-5252.html https://www.suse.com/security/cve/CVE-2015-5296.html https://www.suse.com/security/cve/CVE-2015-5299.html https://www.suse.com/security/cve/CVE-2015-5330.html https://bugzilla.suse.com/295284 https://bugzilla.suse.com/773464 https://bugzilla.suse.com/901813 https://bugzilla.suse.com/912457 https://bugzilla.suse.com/913304 https://bugzilla.suse.com/934299 https://bugzilla.suse.com/948244 https://bugzilla.suse.com/949022 https://bugzilla.suse.com/958582 https://bugzilla.suse.com/958583 https://bugzilla.suse.com/958584 https://bugzilla.suse.com/958586 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0020-1: important: Security update for kvm
by opensuse-security＠opensuse.org 05 Jan '16

05 Jan '16

SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0020-1 Rating: important References: #947164 #950590 #953187 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for kvm fixes the following issues: Security issues fixed: - CVE-2015-7512: The receive packet size is now checked in the emulated pcnet driver, eliminating buffer overflow and potential security issue by malicious guest systems. (bsc#957162) - CVE-2015-8345: A infinite loop in processing command block list was fixed that could be exploit by malicious guest systems (bsc#956829). Bugs fixed: - Fix cases of wrong clock values in kvmclock timekeeping (bsc#947164 and bsc#953187) - Enforce pxe rom sizes to ensure migration compatibility. (bsc#950590) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-kvm-12294=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-kvm-12294=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3 (i586 s390x x86_64): kvm-1.4.2-37.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): kvm-1.4.2-37.1 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/947164 https://bugzilla.suse.com/950590 https://bugzilla.suse.com/953187 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0010-1: important: Security update for kvm
by opensuse-security＠opensuse.org 04 Jan '16

04 Jan '16

SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0010-1 Rating: important References: #947164 #950590 #953187 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for kvm fixes the following issues: Security issues fixed: - CVE-2015-7512: The receive packet size is now checked in the emulated pcnet driver, eliminating buffer overflow and potential security issue by malicious guest systems. (bsc#957162) - CVE-2015-8345: A infinite loop in processing command block list was fixed that could be exploit by malicious guest systems (bsc#956829). Other bugs fixed: - To assist users past the migration incompatibility discussed in bsc#950590 (restore migration compatibility with SLE11 SP3 and SLE12, at the unfortunate expense to prior SLE11 SP4 kvm release compatability when a virtio-net device is used), print a message which references the support document TID 7017048. See https://www.suse.com/support/kb/doc.php?id=7017048 - Fix cases of wrong clock values in kvmclock timekeeping (bsc#947164 and bsc#953187) - Enforce pxe rom sizes to ensure migration compatibility. (bsc#950590) - Fix kvm live migration fails between sles11 sp3 and sp4 (bsc#950590) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-kvm-12293=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-kvm-12293=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 s390x x86_64): kvm-1.4.2-35.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): kvm-1.4.2-35.1 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/947164 https://bugzilla.suse.com/950590 https://bugzilla.suse.com/953187 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0