October 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:2655-1: important: Security update for Linux Kernel Live Patch 12 for SLE 12
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

SUSE Security Update: Security update for Linux Kernel Live Patch 12 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2655-1 Rating: important References: #1004419 #986377 Cross-References: CVE-2016-4997 CVE-2016-5195 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.55-52_42 fixes several issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004419). - CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bsc#986377). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1559=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1559=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_55-52_42-default-3-2.1 kgraft-patch-3_12_55-52_42-xen-3-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_55-52_42-default-3-2.1 kgraft-patch-3_12_55-52_42-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2016-4997.html https://www.suse.com/security/cve/CVE-2016-5195.html https://bugzilla.suse.com/1004419 https://bugzilla.suse.com/986377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2649-1: important: kernel update for Evergreen 11.4
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: kernel update for Evergreen 11.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2649-1 Rating: important References: #1004418 #758540 #816446 #861093 #917648 #928130 #935757 #939826 #942367 #944296 #945825 #946117 #946309 #948562 #949744 #949936 #951440 #952384 #953527 #954404 #955354 #955654 #956708 #956709 #958463 #958886 #958951 #959190 #959399 #961500 #961509 #961512 #963765 #963767 #964201 #966437 #966460 #966662 #966693 #967972 #967973 #967974 #967975 #968010 #968011 #968012 #968013 #968670 #969356 #970504 #970892 #970909 #970911 #970948 #970956 #970958 #970970 #971124 #971125 #971126 #971360 #972510 #973570 #975945 #977847 #978822 Cross-References: CVE-2013-7446 CVE-2015-0272 CVE-2015-1339 CVE-2015-3339 CVE-2015-5307 CVE-2015-6252 CVE-2015-6937 CVE-2015-7509 CVE-2015-7515 CVE-2015-7550 CVE-2015-7566 CVE-2015-7799 CVE-2015-7872 CVE-2015-7990 CVE-2015-8104 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2016-0723 CVE-2016-2069 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2782 CVE-2016-2847 CVE-2016-3134 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-4486 CVE-2016-5195 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 49 vulnerabilities and has 17 fixes is now available. Description: This kernel update fixes the well known "Dirty COW" issue as well as a bunch of other security and non-security related issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-1236=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): kernel-debug-3.0.101-105.1 kernel-debug-base-3.0.101-105.1 kernel-debug-base-debuginfo-3.0.101-105.1 kernel-debug-debuginfo-3.0.101-105.1 kernel-debug-debugsource-3.0.101-105.1 kernel-debug-devel-3.0.101-105.1 kernel-debug-devel-debuginfo-3.0.101-105.1 kernel-debug-hmac-3.0.101-105.1 kernel-default-3.0.101-105.1 kernel-default-base-3.0.101-105.1 kernel-default-base-debuginfo-3.0.101-105.1 kernel-default-debuginfo-3.0.101-105.1 kernel-default-debugsource-3.0.101-105.1 kernel-default-devel-3.0.101-105.1 kernel-default-devel-debuginfo-3.0.101-105.1 kernel-default-hmac-3.0.101-105.1 kernel-desktop-3.0.101-105.1 kernel-desktop-base-3.0.101-105.1 kernel-desktop-base-debuginfo-3.0.101-105.1 kernel-desktop-debuginfo-3.0.101-105.1 kernel-desktop-debugsource-3.0.101-105.1 kernel-desktop-devel-3.0.101-105.1 kernel-desktop-devel-debuginfo-3.0.101-105.1 kernel-desktop-hmac-3.0.101-105.1 kernel-ec2-3.0.101-105.1 kernel-ec2-base-3.0.101-105.1 kernel-ec2-base-debuginfo-3.0.101-105.1 kernel-ec2-debuginfo-3.0.101-105.1 kernel-ec2-debugsource-3.0.101-105.1 kernel-ec2-devel-3.0.101-105.1 kernel-ec2-devel-debuginfo-3.0.101-105.1 kernel-ec2-extra-3.0.101-105.1 kernel-ec2-extra-debuginfo-3.0.101-105.1 kernel-ec2-hmac-3.0.101-105.1 kernel-source-3.0.101-105.1 kernel-source-vanilla-3.0.101-105.1 kernel-syms-3.0.101-105.1 kernel-trace-3.0.101-105.1 kernel-trace-base-3.0.101-105.1 kernel-trace-base-debuginfo-3.0.101-105.1 kernel-trace-debuginfo-3.0.101-105.1 kernel-trace-debugsource-3.0.101-105.1 kernel-trace-devel-3.0.101-105.1 kernel-trace-devel-debuginfo-3.0.101-105.1 kernel-trace-hmac-3.0.101-105.1 kernel-vanilla-3.0.101-105.1 kernel-vanilla-base-3.0.101-105.1 kernel-vanilla-base-debuginfo-3.0.101-105.1 kernel-vanilla-debuginfo-3.0.101-105.1 kernel-vanilla-debugsource-3.0.101-105.1 kernel-vanilla-devel-3.0.101-105.1 kernel-vanilla-devel-debuginfo-3.0.101-105.1 kernel-vanilla-hmac-3.0.101-105.1 kernel-xen-3.0.101-105.1 kernel-xen-base-3.0.101-105.1 kernel-xen-base-debuginfo-3.0.101-105.1 kernel-xen-debuginfo-3.0.101-105.1 kernel-xen-debugsource-3.0.101-105.1 kernel-xen-devel-3.0.101-105.1 kernel-xen-devel-debuginfo-3.0.101-105.1 kernel-xen-hmac-3.0.101-105.1 preload-1.2-6.83.1 preload-debuginfo-1.2-6.83.1 preload-debugsource-1.2-6.83.1 preload-kmp-default-1.2_3.0.101_105-6.83.1 preload-kmp-default-debuginfo-1.2_3.0.101_105-6.83.1 preload-kmp-desktop-1.2_3.0.101_105-6.83.1 preload-kmp-desktop-debuginfo-1.2_3.0.101_105-6.83.1 - openSUSE Evergreen 11.4 (noarch): kernel-docs-3.0.101-105.2 - openSUSE Evergreen 11.4 (i586): kernel-pae-3.0.101-105.1 kernel-pae-base-3.0.101-105.1 kernel-pae-base-debuginfo-3.0.101-105.1 kernel-pae-debuginfo-3.0.101-105.1 kernel-pae-debugsource-3.0.101-105.1 kernel-pae-devel-3.0.101-105.1 kernel-pae-devel-debuginfo-3.0.101-105.1 kernel-pae-hmac-3.0.101-105.1 kernel-vmi-3.0.101-105.1 kernel-vmi-base-3.0.101-105.1 kernel-vmi-base-debuginfo-3.0.101-105.1 kernel-vmi-debuginfo-3.0.101-105.1 kernel-vmi-debugsource-3.0.101-105.1 kernel-vmi-devel-3.0.101-105.1 kernel-vmi-devel-debuginfo-3.0.101-105.1 kernel-vmi-hmac-3.0.101-105.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2015-0272.html https://www.suse.com/security/cve/CVE-2015-1339.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-5307.html https://www.suse.com/security/cve/CVE-2015-6252.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7509.html https://www.suse.com/security/cve/CVE-2015-7515.html https://www.suse.com/security/cve/CVE-2015-7550.html https://www.suse.com/security/cve/CVE-2015-7566.html https://www.suse.com/security/cve/CVE-2015-7799.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8104.html https://www.suse.com/security/cve/CVE-2015-8215.html https://www.suse.com/security/cve/CVE-2015-8539.html https://www.suse.com/security/cve/CVE-2015-8543.html https://www.suse.com/security/cve/CVE-2015-8569.html https://www.suse.com/security/cve/CVE-2015-8575.html https://www.suse.com/security/cve/CVE-2015-8767.html https://www.suse.com/security/cve/CVE-2015-8785.html https://www.suse.com/security/cve/CVE-2015-8812.html https://www.suse.com/security/cve/CVE-2015-8816.html https://www.suse.com/security/cve/CVE-2016-0723.html https://www.suse.com/security/cve/CVE-2016-2069.html https://www.suse.com/security/cve/CVE-2016-2143.html https://www.suse.com/security/cve/CVE-2016-2184.html https://www.suse.com/security/cve/CVE-2016-2185.html https://www.suse.com/security/cve/CVE-2016-2186.html https://www.suse.com/security/cve/CVE-2016-2188.html https://www.suse.com/security/cve/CVE-2016-2384.html https://www.suse.com/security/cve/CVE-2016-2543.html https://www.suse.com/security/cve/CVE-2016-2544.html https://www.suse.com/security/cve/CVE-2016-2545.html https://www.suse.com/security/cve/CVE-2016-2546.html https://www.suse.com/security/cve/CVE-2016-2547.html https://www.suse.com/security/cve/CVE-2016-2548.html https://www.suse.com/security/cve/CVE-2016-2549.html https://www.suse.com/security/cve/CVE-2016-2782.html https://www.suse.com/security/cve/CVE-2016-2847.html https://www.suse.com/security/cve/CVE-2016-3134.html https://www.suse.com/security/cve/CVE-2016-3137.html https://www.suse.com/security/cve/CVE-2016-3138.html https://www.suse.com/security/cve/CVE-2016-3139.html https://www.suse.com/security/cve/CVE-2016-3140.html https://www.suse.com/security/cve/CVE-2016-3156.html https://www.suse.com/security/cve/CVE-2016-4486.html https://www.suse.com/security/cve/CVE-2016-5195.html https://bugzilla.suse.com/1004418 https://bugzilla.suse.com/758540 https://bugzilla.suse.com/816446 https://bugzilla.suse.com/861093 https://bugzilla.suse.com/917648 https://bugzilla.suse.com/928130 https://bugzilla.suse.com/935757 https://bugzilla.suse.com/939826 https://bugzilla.suse.com/942367 https://bugzilla.suse.com/944296 https://bugzilla.suse.com/945825 https://bugzilla.suse.com/946117 https://bugzilla.suse.com/946309 https://bugzilla.suse.com/948562 https://bugzilla.suse.com/949744 https://bugzilla.suse.com/949936 https://bugzilla.suse.com/951440 https://bugzilla.suse.com/952384 https://bugzilla.suse.com/953527 https://bugzilla.suse.com/954404 https://bugzilla.suse.com/955354 https://bugzilla.suse.com/955654 https://bugzilla.suse.com/956708 https://bugzilla.suse.com/956709 https://bugzilla.suse.com/958463 https://bugzilla.suse.com/958886 https://bugzilla.suse.com/958951 https://bugzilla.suse.com/959190 https://bugzilla.suse.com/959399 https://bugzilla.suse.com/961500 https://bugzilla.suse.com/961509 https://bugzilla.suse.com/961512 https://bugzilla.suse.com/963765 https://bugzilla.suse.com/963767 https://bugzilla.suse.com/964201 https://bugzilla.suse.com/966437 https://bugzilla.suse.com/966460 https://bugzilla.suse.com/966662 https://bugzilla.suse.com/966693 https://bugzilla.suse.com/967972 https://bugzilla.suse.com/967973 https://bugzilla.suse.com/967974 https://bugzilla.suse.com/967975 https://bugzilla.suse.com/968010 https://bugzilla.suse.com/968011 https://bugzilla.suse.com/968012 https://bugzilla.suse.com/968013 https://bugzilla.suse.com/968670 https://bugzilla.suse.com/969356 https://bugzilla.suse.com/970504 https://bugzilla.suse.com/970892 https://bugzilla.suse.com/970909 https://bugzilla.suse.com/970911 https://bugzilla.suse.com/970948 https://bugzilla.suse.com/970956 https://bugzilla.suse.com/970958 https://bugzilla.suse.com/970970 https://bugzilla.suse.com/971124 https://bugzilla.suse.com/971125 https://bugzilla.suse.com/971126 https://bugzilla.suse.com/971360 https://bugzilla.suse.com/972510 https://bugzilla.suse.com/973570 https://bugzilla.suse.com/975945 https://bugzilla.suse.com/977847 https://bugzilla.suse.com/978822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2648-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2648-1 Rating: important References: #1001951 #1004237 Cross-References: CVE-2013-5653 CVE-2016-7978 CVE-2016-7979 CVE-2016-8602 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: - CVE-2016-8602: Fixes a NULL dereference in .sethalftone5 (boo#1004237). - CVE-2013-5653, CVE-2016-7978, CVE-2016-7979: Fix multiple -dsafer related CVE's (boo#1001951). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ghostscript-9.15-6.1 ghostscript-debuginfo-9.15-6.1 ghostscript-debugsource-9.15-6.1 ghostscript-devel-9.15-6.1 ghostscript-mini-9.15-6.1 ghostscript-mini-debuginfo-9.15-6.1 ghostscript-mini-debugsource-9.15-6.1 ghostscript-mini-devel-9.15-6.1 ghostscript-x11-9.15-6.1 ghostscript-x11-debuginfo-9.15-6.1 References: https://www.suse.com/security/cve/CVE-2013-5653.html https://www.suse.com/security/cve/CVE-2016-7978.html https://www.suse.com/security/cve/CVE-2016-7979.html https://www.suse.com/security/cve/CVE-2016-8602.html https://bugzilla.suse.com/1001951 https://bugzilla.suse.com/1004237 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2646-1: important: Security update for quagga
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2646-1 Rating: important References: #1005258 Cross-References: CVE-2016-1245 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following issue: - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA receive code. (bsc#1005258). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-14.1 quagga-debuginfo-0.99.24.1-14.1 quagga-debugsource-0.99.24.1-14.1 quagga-devel-0.99.24.1-14.1 References: https://www.suse.com/security/cve/CVE-2016-1245.html https://bugzilla.suse.com/1005258 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2642-1: important: Security update for qemu
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2642-1 Rating: important References: #1000048 #967012 #967013 #982017 #982018 #982019 #982222 #982223 #982285 #982959 #983961 #983982 #991080 #991466 #994760 #994771 #994774 #996441 #997858 #997859 Cross-References: CVE-2016-2391 CVE-2016-2392 CVE-2016-4453 CVE-2016-4454 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 CVE-2016-5126 CVE-2016-5238 CVE-2016-5337 CVE-2016-5338 CVE-2016-5403 CVE-2016-6490 CVE-2016-6833 CVE-2016-6836 CVE-2016-6888 CVE-2016-7116 CVE-2016-7155 CVE-2016-7156 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has one errata is now available. Description: qemu was updated to fix 19 security issues. These security issues were fixed: - CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU did not properly validate USB configuration descriptor objects, which allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet (bsc#967012) - CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers (bsc#967013) - CVE-2016-5106: The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982018) - CVE-2016-5105: The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, used an uninitialized variable, which allowed local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982017) - CVE-2016-5107: The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors (bsc#982019) - CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982285) - CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982222) - CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982223) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983982) - CVE-2016-5337: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983961) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982959) - CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (bsc#991080) - CVE-2016-6490: Infinite loop in the virtio framework. A privileged user inside the guest could have used this flaw to crash the Qemu instance on the host resulting in DoS (bsc#991466) - CVE-2016-6888: Integer overflow in packet initialisation in VMXNET3 device driver. A privileged user inside guest could have used this flaw to crash the Qemu instance resulting in DoS (bsc#994771) - CVE-2016-6833: Use-after-free issue in the VMWARE VMXNET3 NIC device support. A privileged user inside guest could have used this issue to crash the Qemu instance resulting in DoS (bsc#994774) - CVE-2016-7116: Host directory sharing via Plan 9 File System(9pfs) was vulnerable to a directory/path traversal issue. A privileged user inside guest could have used this flaw to access undue files on the host (bsc#996441) - CVE-2016-6836: VMWARE VMXNET3 NIC device support was leaging information leakage. A privileged user inside guest could have used this to leak host memory bytes to a guest (bsc#994760) - CVE-2016-7155: In the VMWARE PVSCSI paravirtual SCSI bus a OOB access and/or infinite loop issue could have allowed a privileged user inside guest to crash the Qemu process resulting in DoS (bsc#997858) - CVE-2016-7156: In the VMWARE PVSCSI paravirtual SCSI bus a infinite loop issue could have allowed a privileged user inside guest to crash the Qemu process resulting in DoS (bsc#997859) This non-security issue was fixed: - bsc#1000048: Fix migration failure where target host is a soon to be released SLES 12 SP2. Qemu's spice code gets an assertion. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): qemu-2.3.1-19.3 qemu-arm-2.3.1-19.3 qemu-arm-debuginfo-2.3.1-19.3 qemu-block-curl-2.3.1-19.3 qemu-block-curl-debuginfo-2.3.1-19.3 qemu-debugsource-2.3.1-19.3 qemu-extra-2.3.1-19.3 qemu-extra-debuginfo-2.3.1-19.3 qemu-guest-agent-2.3.1-19.3 qemu-guest-agent-debuginfo-2.3.1-19.3 qemu-kvm-2.3.1-19.3 qemu-lang-2.3.1-19.3 qemu-linux-user-2.3.1-19.1 qemu-linux-user-debuginfo-2.3.1-19.1 qemu-linux-user-debugsource-2.3.1-19.1 qemu-ppc-2.3.1-19.3 qemu-ppc-debuginfo-2.3.1-19.3 qemu-s390-2.3.1-19.3 qemu-s390-debuginfo-2.3.1-19.3 qemu-tools-2.3.1-19.3 qemu-tools-debuginfo-2.3.1-19.3 qemu-x86-2.3.1-19.3 qemu-x86-debuginfo-2.3.1-19.3 - openSUSE Leap 42.1 (noarch): qemu-ipxe-1.0.0-19.3 qemu-seabios-1.8.1-19.3 qemu-sgabios-8-19.3 qemu-vgabios-1.8.1-19.3 - openSUSE Leap 42.1 (x86_64): qemu-block-rbd-2.3.1-19.3 qemu-block-rbd-debuginfo-2.3.1-19.3 qemu-testsuite-2.3.1-19.6 References: https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2392.html https://www.suse.com/security/cve/CVE-2016-4453.html https://www.suse.com/security/cve/CVE-2016-4454.html https://www.suse.com/security/cve/CVE-2016-5105.html https://www.suse.com/security/cve/CVE-2016-5106.html https://www.suse.com/security/cve/CVE-2016-5107.html https://www.suse.com/security/cve/CVE-2016-5126.html https://www.suse.com/security/cve/CVE-2016-5238.html https://www.suse.com/security/cve/CVE-2016-5337.html https://www.suse.com/security/cve/CVE-2016-5338.html https://www.suse.com/security/cve/CVE-2016-5403.html https://www.suse.com/security/cve/CVE-2016-6490.html https://www.suse.com/security/cve/CVE-2016-6833.html https://www.suse.com/security/cve/CVE-2016-6836.html https://www.suse.com/security/cve/CVE-2016-6888.html https://www.suse.com/security/cve/CVE-2016-7116.html https://www.suse.com/security/cve/CVE-2016-7155.html https://www.suse.com/security/cve/CVE-2016-7156.html https://bugzilla.suse.com/1000048 https://bugzilla.suse.com/967012 https://bugzilla.suse.com/967013 https://bugzilla.suse.com/982017 https://bugzilla.suse.com/982018 https://bugzilla.suse.com/982019 https://bugzilla.suse.com/982222 https://bugzilla.suse.com/982223 https://bugzilla.suse.com/982285 https://bugzilla.suse.com/982959 https://bugzilla.suse.com/983961 https://bugzilla.suse.com/983982 https://bugzilla.suse.com/991080 https://bugzilla.suse.com/991466 https://bugzilla.suse.com/994760 https://bugzilla.suse.com/994771 https://bugzilla.suse.com/994774 https://bugzilla.suse.com/996441 https://bugzilla.suse.com/997858 https://bugzilla.suse.com/997859 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2639-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2639-1 Rating: important References: #1006475 #1006476 Cross-References: CVE-2016-5287 CVE-2016-5288 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Mozilla Firefox was updated to 49.0.2 to fix two security issues a some bugs. The following vulnerabilities were fixed: * CVE-2016-5287: Crash in nsTArray_base (bsc#1006475) * CVE-2016-5288: Web content can read cache entries (bsc#1006476) The following changes and fixes are included: * Asynchronous rendering of the Flash plugins is now enabled by default * Change D3D9 default fallback preference to prevent graphical artifacts * Network issue prevents some users from seeing the Firefox UI on startup * Web compatibility issue with file uploads * Web compatibility issue with Array.prototype.values * Diagnostic information on timing for tab switching * Fix a Canvas filters graphics issue affecting HTML5 apps Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 5723=1 - openSUSE 13.2: zypper in -t patch 5723=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): MozillaFirefox-49.0.2-36.1 MozillaFirefox-branding-upstream-49.0.2-36.1 MozillaFirefox-buildsymbols-49.0.2-36.1 MozillaFirefox-debuginfo-49.0.2-36.1 MozillaFirefox-debugsource-49.0.2-36.1 MozillaFirefox-devel-49.0.2-36.1 MozillaFirefox-translations-common-49.0.2-36.1 MozillaFirefox-translations-other-49.0.2-36.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-49.0.2-84.1 MozillaFirefox-branding-upstream-49.0.2-84.1 MozillaFirefox-buildsymbols-49.0.2-84.1 MozillaFirefox-devel-49.0.2-84.1 MozillaFirefox-translations-common-49.0.2-84.1 MozillaFirefox-translations-other-49.0.2-84.1 - openSUSE 13.2 (x86_64): MozillaFirefox-debuginfo-49.0.2-84.1 MozillaFirefox-debugsource-49.0.2-84.1 References: https://www.suse.com/security/cve/CVE-2016-5287.html https://www.suse.com/security/cve/CVE-2016-5288.html https://bugzilla.suse.com/1006475 https://bugzilla.suse.com/1006476 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2638-1: important: Security update for Linux Kernel Live Patch 4 for SLE 12 SP1
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

SUSE Security Update: Security update for Linux Kernel Live Patch 4 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2638-1 Rating: important References: #1001487 #1004419 Cross-References: CVE-2016-5195 CVE-2016-8666 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.57-60_35 fixes several issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004419). - CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (bsc#1001487). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1551=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_57-60_35-default-4-2.1 kgraft-patch-3_12_57-60_35-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-8666.html https://bugzilla.suse.com/1001487 https://bugzilla.suse.com/1004419 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2637-1: important: Security update for Linux Kernel Live Patch 6 for SLE 12 SP1
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

SUSE Security Update: Security update for Linux Kernel Live Patch 6 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2637-1 Rating: important References: #1001487 #1004419 Cross-References: CVE-2016-5195 CVE-2016-8666 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.59-60_45 fixes several issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004419). - CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (bsc#1001487). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1552=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_59-60_45-default-4-2.1 kgraft-patch-3_12_59-60_45-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-8666.html https://bugzilla.suse.com/1001487 https://bugzilla.suse.com/1004419 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2636-1: important: Security update for Linux Kernel Live Patch 9 for SLE 12
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

SUSE Security Update: Security update for Linux Kernel Live Patch 9 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2636-1 Rating: important References: #1004419 #986377 Cross-References: CVE-2016-4997 CVE-2016-5195 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.51-52_31 fixes several issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004419). - CVE-2016-4997: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bsc#986377). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1553=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1553=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_51-52_31-default-6-5.1 kgraft-patch-3_12_51-52_31-xen-6-5.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_51-52_31-default-6-5.1 kgraft-patch-3_12_51-52_31-xen-6-5.1 References: https://www.suse.com/security/cve/CVE-2016-4997.html https://www.suse.com/security/cve/CVE-2016-5195.html https://bugzilla.suse.com/1004419 https://bugzilla.suse.com/986377 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2635-1: important: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

SUSE Security Update: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2635-1 Rating: important References: #1001487 #1004419 Cross-References: CVE-2016-5195 CVE-2016-8666 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.59-60_41 fixes several issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004419). - CVE-2016-8666: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (bsc#1001487). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1549=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_59-60_41-default-4-2.1 kgraft-patch-3_12_59-60_41-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-8666.html https://bugzilla.suse.com/1001487 https://bugzilla.suse.com/1004419 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0