October 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:2583-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 21 Oct '16

21 Oct '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2583-1 Rating: important References: #1000287 #1000304 #1000907 #1001462 #1001486 #1004418 #1004462 #1005101 #799133 #881008 #909994 #911687 #922634 #963655 #972460 #978094 #979681 #987703 #991247 #991665 #993890 #993891 #996664 #999600 #999932 Cross-References: CVE-2016-5195 CVE-2016-7039 CVE-2016-7425 CVE-2016-8658 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 21 fixes is now available. Description: The openSUSE Leap 42.1 kernel was updated to 4.1.34, fixing bugs and security issues. The following security bugs were fixed: - CVE-2016-5195: A local privilege escalation using MAP_PRIVATE was fixed, which is reportedly exploited in the wild (bsc#1004418). - CVE-2016-8658: Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel allowed local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket (bnc#1004462). - CVE-2016-7039: The IP stack in the Linux kernel allowed remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666 (bnc#1001486). - CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did not restrict a certain length field, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932). The following non-security bugs were fixed: - 9p: use file_dentry() (bsc#1005101). - af_unix: Do not set err in unix_stream_read_generic unless there was an error (bsc#1005101). - alsa: hda - Fix superfluous HDMI jack repoll (bsc#1005101). - alsa: hda - Turn off loopback mixing as default (bsc#1001462). - apparmor: add missing id bounds check on dfa verification (bsc#1000304). - apparmor: check that xindex is in trans_table bounds (bsc#1000304). - apparmor: do not check for vmalloc_addr if kvzalloc() failed (bsc#1000304). - apparmor: do not expose kernel stack (bsc#1000304). - apparmor: ensure the target profile name is always audited (bsc#1000304). - apparmor: exec should not be returning ENOENT when it denies (bsc#1000304). - apparmor: fix audit full profile hname on successful load (bsc#1000304). - apparmor: fix change_hat not finding hat after policy replacement (bsc#1000287). - apparmor: fix disconnected bind mnts reconnection (bsc#1000304). - apparmor: fix log failures for all profiles in a set (bsc#1000304). - apparmor: fix module parameters can be changed after policy is locked (bsc#1000304). - apparmor: fix oops in profile_unpack() when policy_db is not present (bsc#1000304). - apparmor: fix put() parent ref after updating the active ref (bsc#1000304). - apparmor: fix refcount bug in profile replacement (bsc#1000304). - apparmor: fix refcount race when finding a child profile (bsc#1000304). - apparmor: fix replacement bug that adds new child to old parent (bsc#1000304). - apparmor: fix uninitialized lsm_audit member (bsc#1000304). - apparmor: fix update the mtime of the profile file on replacement (bsc#1000304). - apparmor: internal paths should be treated as disconnected (bsc#1000304). - apparmor: use list_next_entry instead of list_entry_next (bsc#1000304). - arm: orion5x: Fix legacy get_irqnr_and_base (bsc#1005101). - batman-adv: Fix memory leak on tt add with invalid vlan (bsc#1005101). - batman-adv: replace WARN with rate limited output on non-existing VLAN (bsc#1005101). - blacklist.conf: add some commits (bsc#1005101) - blacklist.conf: add unaplicable IB/uverbs commit (bsc#1005101) - blacklist.conf: Blacklist unsupported architectures - blkfront: fix an error path memory leak (luckily none so far). - blktap2: eliminate deadlock potential from shutdown path (bsc#909994). - blktap2: eliminate race from deferred work queue handling (bsc#911687). - btrfs: ensure that file descriptor used with subvol ioctls is a dir (bsc#999600). - cdc-acm: added sanity checking for probe() (bsc#993891). - cgroup: add seq_file forward declaration for struct cftype (bsc#1005101). - do "fold checks into iterate_and_advance()" right (bsc#972460). - drm/i915: Wait up to 3ms for the pcu to ack the cdclk change request on SKL (bsc#1005101). - drm/rockchip: unset pgoff when mmap'ing gems (bsc#1005101). - fold checks into iterate_and_advance() (bsc#972460). - fs/cifs: cifs_get_root shouldn't use path with tree name (bsc#963655, bsc#979681, bsc#1000907). - fs/cifs: Compare prepaths when comparing superblocks (bsc#799133). - fs/cifs: Fix memory leaks in cifs_do_mount() (bsc#799133). - fs/cifs: Fix regression which breaks DFS mounting (bsc#799133). - fs/cifs: Move check for prefix path to within cifs_get_root() (bsc#799133). - hid: multitouch: force retrieving of Win8 signature blob (bsc#1005101). - input: ALPS - add touchstick support for SS5 hardware (bsc#987703). - input: ALPS - allow touchsticks to report pressure (bsc#987703). - input: ALPS - handle 0-pressure 1F events (bsc#987703). - input: ALPS - set DualPoint flag for 74 03 28 devices (bsc#987703). - ipip: Properly mark ipip GRO packets as encapsulated (bsc#1001486). - ipv6: suppress sparse warnings in IP6_ECN_set_ce() (bsc#1005101). - kabi: hide name change of napi_gro_cb::udp_mark (bsc#1001486). - kaweth: fix firmware download (bsc#993890). - kaweth: fix oops upon failed memory allocation (bsc#993890). - kvm: x86: only channel 0 of the i8254 is linked to the HPET (bsc#1005101). - memcg: fix thresholds for 32b architectures (bsc#1005101). - msi-x: fix an error path (luckily none so far). - netback: fix flipping mode (bsc#996664). - netback: fix flipping mode (bsc#996664). - netem: fix a use after free (bsc#1005101). - net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration (bsc#1005101). - netfront: linearize SKBs requiring too many slots (bsc#991247). - netlink: not trim skb for mmaped socket when dump (bsc#1005101). - net_sched: fix pfifo_head_drop behavior vs backlog (bsc#1005101). - net_sched: keep backlog updated with qlen (bsc#1005101). - nfs: use file_dentry() (bsc#1005101). - ovl: fix open in stacked overlay (bsc#1005101). - pci: Prevent out of bounds access in numa_node override (bsc#1005101). - perf/core: Do not leak event in the syscall error path (bsc#1005101). - perf: Fix PERF_EVENT_IOC_PERIOD deadlock (bsc#1005101). - Revive iov_iter_fault_in_multipages_readable() for 4.1.34. - sch_drr: update backlog as well (bsc#1005101). - sch_hfsc: always keep backlog updated (bsc#1005101). - sch_prio: update backlog as well (bsc#1005101). - sch_qfq: keep backlog updated with qlen (bsc#1005101). - sch_red: update backlog as well (bsc#1005101). - sch_sfb: keep backlog updated with qlen (bsc#1005101). - sch_tbf: update backlog as well (bsc#1005101). - tpm: fix: return rc when devm_add_action() fails (bsc#1005101). - tunnels: Do not apply GRO to multiple layers of encapsulation (bsc#1001486). - Update blacklisting documentation to contain path-blacklisting - usb: fix typo in wMaxPacketSize validation (bsc#991665). - usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices (bsc#922634). - x86/LDT: Print the real LDT base address (bsc#1005101). - x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs (bsc#1005101). - xenbus: do not bail early from xenbus_dev_request_and_reply() (luckily none so far). - xenbus: inspect the correct type in xenbus_dev_request_and_reply(). - xen: Fix refcnt regression in xen netback introduced by changes made for bug#881008 (bnc#978094) - xen: Linux 4.1.28. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1212=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.34-33.1 kernel-debug-base-4.1.34-33.1 kernel-debug-base-debuginfo-4.1.34-33.1 kernel-debug-debuginfo-4.1.34-33.1 kernel-debug-debugsource-4.1.34-33.1 kernel-debug-devel-4.1.34-33.1 kernel-debug-devel-debuginfo-4.1.34-33.1 kernel-ec2-4.1.34-33.1 kernel-ec2-base-4.1.34-33.1 kernel-ec2-base-debuginfo-4.1.34-33.1 kernel-ec2-debuginfo-4.1.34-33.1 kernel-ec2-debugsource-4.1.34-33.1 kernel-ec2-devel-4.1.34-33.1 kernel-pv-4.1.34-33.1 kernel-pv-base-4.1.34-33.1 kernel-pv-base-debuginfo-4.1.34-33.1 kernel-pv-debuginfo-4.1.34-33.1 kernel-pv-debugsource-4.1.34-33.1 kernel-pv-devel-4.1.34-33.1 kernel-vanilla-4.1.34-33.1 kernel-vanilla-debuginfo-4.1.34-33.1 kernel-vanilla-debugsource-4.1.34-33.1 kernel-vanilla-devel-4.1.34-33.1 kernel-xen-4.1.34-33.1 kernel-xen-base-4.1.34-33.1 kernel-xen-base-debuginfo-4.1.34-33.1 kernel-xen-debuginfo-4.1.34-33.1 kernel-xen-debugsource-4.1.34-33.1 kernel-xen-devel-4.1.34-33.1 - openSUSE Leap 42.1 (i586 x86_64): hdjmod-debugsource-1.28-26.1 hdjmod-kmp-default-1.28_k4.1.34_33-26.1 hdjmod-kmp-default-debuginfo-1.28_k4.1.34_33-26.1 hdjmod-kmp-pv-1.28_k4.1.34_33-26.1 hdjmod-kmp-pv-debuginfo-1.28_k4.1.34_33-26.1 hdjmod-kmp-xen-1.28_k4.1.34_33-26.1 hdjmod-kmp-xen-debuginfo-1.28_k4.1.34_33-26.1 ipset-6.25.1-7.1 ipset-debuginfo-6.25.1-7.1 ipset-debugsource-6.25.1-7.1 ipset-devel-6.25.1-7.1 ipset-kmp-default-6.25.1_k4.1.34_33-7.1 ipset-kmp-default-debuginfo-6.25.1_k4.1.34_33-7.1 ipset-kmp-pv-6.25.1_k4.1.34_33-7.1 ipset-kmp-pv-debuginfo-6.25.1_k4.1.34_33-7.1 ipset-kmp-xen-6.25.1_k4.1.34_33-7.1 ipset-kmp-xen-debuginfo-6.25.1_k4.1.34_33-7.1 kernel-default-4.1.34-33.1 kernel-default-base-4.1.34-33.1 kernel-default-base-debuginfo-4.1.34-33.1 kernel-default-debuginfo-4.1.34-33.1 kernel-default-debugsource-4.1.34-33.1 kernel-default-devel-4.1.34-33.1 kernel-obs-build-4.1.34-33.1 kernel-obs-build-debugsource-4.1.34-33.1 kernel-obs-qa-4.1.34-33.1 kernel-obs-qa-xen-4.1.34-33.1 kernel-syms-4.1.34-33.1 libipset3-6.25.1-7.1 libipset3-debuginfo-6.25.1-7.1 pcfclock-0.44-268.1 pcfclock-debuginfo-0.44-268.1 pcfclock-debugsource-0.44-268.1 pcfclock-kmp-default-0.44_k4.1.34_33-268.1 pcfclock-kmp-default-debuginfo-0.44_k4.1.34_33-268.1 pcfclock-kmp-pv-0.44_k4.1.34_33-268.1 pcfclock-kmp-pv-debuginfo-0.44_k4.1.34_33-268.1 vhba-kmp-debugsource-20140928-7.1 vhba-kmp-default-20140928_k4.1.34_33-7.1 vhba-kmp-default-debuginfo-20140928_k4.1.34_33-7.1 vhba-kmp-pv-20140928_k4.1.34_33-7.1 vhba-kmp-pv-debuginfo-20140928_k4.1.34_33-7.1 vhba-kmp-xen-20140928_k4.1.34_33-7.1 vhba-kmp-xen-debuginfo-20140928_k4.1.34_33-7.1 - openSUSE Leap 42.1 (x86_64): drbd-8.4.6-10.1 drbd-debugsource-8.4.6-10.1 drbd-kmp-default-8.4.6_k4.1.34_33-10.1 drbd-kmp-default-debuginfo-8.4.6_k4.1.34_33-10.1 drbd-kmp-pv-8.4.6_k4.1.34_33-10.1 drbd-kmp-pv-debuginfo-8.4.6_k4.1.34_33-10.1 drbd-kmp-xen-8.4.6_k4.1.34_33-10.1 drbd-kmp-xen-debuginfo-8.4.6_k4.1.34_33-10.1 lttng-modules-2.7.0-4.1 lttng-modules-debugsource-2.7.0-4.1 lttng-modules-kmp-default-2.7.0_k4.1.34_33-4.1 lttng-modules-kmp-default-debuginfo-2.7.0_k4.1.34_33-4.1 lttng-modules-kmp-pv-2.7.0_k4.1.34_33-4.1 lttng-modules-kmp-pv-debuginfo-2.7.0_k4.1.34_33-4.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.34-33.1 kernel-docs-4.1.34-33.3 kernel-docs-html-4.1.34-33.3 kernel-docs-pdf-4.1.34-33.3 kernel-macros-4.1.34-33.1 kernel-source-4.1.34-33.1 kernel-source-vanilla-4.1.34-33.1 - openSUSE Leap 42.1 (i586): hdjmod-kmp-pae-1.28_k4.1.34_33-26.1 hdjmod-kmp-pae-debuginfo-1.28_k4.1.34_33-26.1 ipset-kmp-pae-6.25.1_k4.1.34_33-7.1 ipset-kmp-pae-debuginfo-6.25.1_k4.1.34_33-7.1 pcfclock-kmp-pae-0.44_k4.1.34_33-268.1 pcfclock-kmp-pae-debuginfo-0.44_k4.1.34_33-268.1 vhba-kmp-pae-20140928_k4.1.34_33-7.1 vhba-kmp-pae-debuginfo-20140928_k4.1.34_33-7.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.34-33.1 kernel-pae-base-4.1.34-33.1 kernel-pae-base-debuginfo-4.1.34-33.1 kernel-pae-debuginfo-4.1.34-33.1 kernel-pae-debugsource-4.1.34-33.1 kernel-pae-devel-4.1.34-33.1 References: https://www.suse.com/security/cve/CVE-2016-5195.html https://www.suse.com/security/cve/CVE-2016-7039.html https://www.suse.com/security/cve/CVE-2016-7425.html https://www.suse.com/security/cve/CVE-2016-8658.html https://bugzilla.suse.com/1000287 https://bugzilla.suse.com/1000304 https://bugzilla.suse.com/1000907 https://bugzilla.suse.com/1001462 https://bugzilla.suse.com/1001486 https://bugzilla.suse.com/1004418 https://bugzilla.suse.com/1004462 https://bugzilla.suse.com/1005101 https://bugzilla.suse.com/799133 https://bugzilla.suse.com/881008 https://bugzilla.suse.com/909994 https://bugzilla.suse.com/911687 https://bugzilla.suse.com/922634 https://bugzilla.suse.com/963655 https://bugzilla.suse.com/972460 https://bugzilla.suse.com/978094 https://bugzilla.suse.com/979681 https://bugzilla.suse.com/987703 https://bugzilla.suse.com/991247 https://bugzilla.suse.com/991665 https://bugzilla.suse.com/993890 https://bugzilla.suse.com/993891 https://bugzilla.suse.com/996664 https://bugzilla.suse.com/999600 https://bugzilla.suse.com/999932 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2574-1: important: Security update for ghostscript-library
by opensuse-security＠opensuse.org 20 Oct '16

20 Oct '16

openSUSE Security Update: Security update for ghostscript-library ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2574-1 Rating: important References: #1001951 Cross-References: CVE-2013-5653 CVE-2016-7978 CVE-2016-7979 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ghostscript-library fixes the following issues: - Multiple security vulnerabilities have been discovered where ghostscript's "-dsafer" flag did not provide sufficient protection against unintended access to the file system. Thus, a machine that would process a specially crafted Postscript file would potentially leak sensitive information to an attacker. (CVE-2013-5653, bsc#1001951) - An incorrect reference count was found in .setdevice. This issue lead to a use-after-free scenario, which could have been exploited for denial-of-service or, possibly, arbitrary code execution attacks. (CVE-2016-7978, bsc#1001951) - Insufficient validation of the type of input in .initialize_dsc_parser used to allow remote code execution. (CVE-2016-7979, bsc#1001951) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1207=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ghostscript-9.15-8.1 ghostscript-debuginfo-9.15-8.1 ghostscript-debugsource-9.15-8.1 ghostscript-devel-9.15-8.1 ghostscript-mini-9.15-8.1 ghostscript-mini-debuginfo-9.15-8.1 ghostscript-mini-debugsource-9.15-8.1 ghostscript-mini-devel-9.15-8.1 ghostscript-x11-9.15-8.1 ghostscript-x11-debuginfo-9.15-8.1 References: https://www.suse.com/security/cve/CVE-2013-5653.html https://www.suse.com/security/cve/CVE-2016-7978.html https://www.suse.com/security/cve/CVE-2016-7979.html https://bugzilla.suse.com/1001951 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2569-1: important: Security update for quagga
by opensuse-security＠opensuse.org 19 Oct '16

19 Oct '16

SUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2569-1 Rating: important References: #1005258 Cross-References: CVE-2016-1245 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following issues: - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA receive code (bsc#1005258). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-quagga-12800=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-quagga-12800=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-quagga-12800=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): quagga-devel-0.99.15-0.29.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): quagga-0.99.15-0.29.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): quagga-0.99.15-0.29.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): quagga-debuginfo-0.99.15-0.29.1 quagga-debugsource-0.99.15-0.29.1 References: https://www.suse.com/security/cve/CVE-2016-1245.html https://bugzilla.suse.com/1005258 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2540-1: important: Security update for php5
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2540-1 Rating: important References: #999679 #999680 #999682 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1193=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-62.1 apache2-mod_php5-debuginfo-5.5.14-62.1 php5-5.5.14-62.1 php5-bcmath-5.5.14-62.1 php5-bcmath-debuginfo-5.5.14-62.1 php5-bz2-5.5.14-62.1 php5-bz2-debuginfo-5.5.14-62.1 php5-calendar-5.5.14-62.1 php5-calendar-debuginfo-5.5.14-62.1 php5-ctype-5.5.14-62.1 php5-ctype-debuginfo-5.5.14-62.1 php5-curl-5.5.14-62.1 php5-curl-debuginfo-5.5.14-62.1 php5-dba-5.5.14-62.1 php5-dba-debuginfo-5.5.14-62.1 php5-debuginfo-5.5.14-62.1 php5-debugsource-5.5.14-62.1 php5-devel-5.5.14-62.1 php5-dom-5.5.14-62.1 php5-dom-debuginfo-5.5.14-62.1 php5-enchant-5.5.14-62.1 php5-enchant-debuginfo-5.5.14-62.1 php5-exif-5.5.14-62.1 php5-exif-debuginfo-5.5.14-62.1 php5-fastcgi-5.5.14-62.1 php5-fastcgi-debuginfo-5.5.14-62.1 php5-fileinfo-5.5.14-62.1 php5-fileinfo-debuginfo-5.5.14-62.1 php5-firebird-5.5.14-62.1 php5-firebird-debuginfo-5.5.14-62.1 php5-fpm-5.5.14-62.1 php5-fpm-debuginfo-5.5.14-62.1 php5-ftp-5.5.14-62.1 php5-ftp-debuginfo-5.5.14-62.1 php5-gd-5.5.14-62.1 php5-gd-debuginfo-5.5.14-62.1 php5-gettext-5.5.14-62.1 php5-gettext-debuginfo-5.5.14-62.1 php5-gmp-5.5.14-62.1 php5-gmp-debuginfo-5.5.14-62.1 php5-iconv-5.5.14-62.1 php5-iconv-debuginfo-5.5.14-62.1 php5-imap-5.5.14-62.1 php5-imap-debuginfo-5.5.14-62.1 php5-intl-5.5.14-62.1 php5-intl-debuginfo-5.5.14-62.1 php5-json-5.5.14-62.1 php5-json-debuginfo-5.5.14-62.1 php5-ldap-5.5.14-62.1 php5-ldap-debuginfo-5.5.14-62.1 php5-mbstring-5.5.14-62.1 php5-mbstring-debuginfo-5.5.14-62.1 php5-mcrypt-5.5.14-62.1 php5-mcrypt-debuginfo-5.5.14-62.1 php5-mssql-5.5.14-62.1 php5-mssql-debuginfo-5.5.14-62.1 php5-mysql-5.5.14-62.1 php5-mysql-debuginfo-5.5.14-62.1 php5-odbc-5.5.14-62.1 php5-odbc-debuginfo-5.5.14-62.1 php5-opcache-5.5.14-62.1 php5-opcache-debuginfo-5.5.14-62.1 php5-openssl-5.5.14-62.1 php5-openssl-debuginfo-5.5.14-62.1 php5-pcntl-5.5.14-62.1 php5-pcntl-debuginfo-5.5.14-62.1 php5-pdo-5.5.14-62.1 php5-pdo-debuginfo-5.5.14-62.1 php5-pgsql-5.5.14-62.1 php5-pgsql-debuginfo-5.5.14-62.1 php5-phar-5.5.14-62.1 php5-phar-debuginfo-5.5.14-62.1 php5-posix-5.5.14-62.1 php5-posix-debuginfo-5.5.14-62.1 php5-pspell-5.5.14-62.1 php5-pspell-debuginfo-5.5.14-62.1 php5-readline-5.5.14-62.1 php5-readline-debuginfo-5.5.14-62.1 php5-shmop-5.5.14-62.1 php5-shmop-debuginfo-5.5.14-62.1 php5-snmp-5.5.14-62.1 php5-snmp-debuginfo-5.5.14-62.1 php5-soap-5.5.14-62.1 php5-soap-debuginfo-5.5.14-62.1 php5-sockets-5.5.14-62.1 php5-sockets-debuginfo-5.5.14-62.1 php5-sqlite-5.5.14-62.1 php5-sqlite-debuginfo-5.5.14-62.1 php5-suhosin-5.5.14-62.1 php5-suhosin-debuginfo-5.5.14-62.1 php5-sysvmsg-5.5.14-62.1 php5-sysvmsg-debuginfo-5.5.14-62.1 php5-sysvsem-5.5.14-62.1 php5-sysvsem-debuginfo-5.5.14-62.1 php5-sysvshm-5.5.14-62.1 php5-sysvshm-debuginfo-5.5.14-62.1 php5-tidy-5.5.14-62.1 php5-tidy-debuginfo-5.5.14-62.1 php5-tokenizer-5.5.14-62.1 php5-tokenizer-debuginfo-5.5.14-62.1 php5-wddx-5.5.14-62.1 php5-wddx-debuginfo-5.5.14-62.1 php5-xmlreader-5.5.14-62.1 php5-xmlreader-debuginfo-5.5.14-62.1 php5-xmlrpc-5.5.14-62.1 php5-xmlrpc-debuginfo-5.5.14-62.1 php5-xmlwriter-5.5.14-62.1 php5-xmlwriter-debuginfo-5.5.14-62.1 php5-xsl-5.5.14-62.1 php5-xsl-debuginfo-5.5.14-62.1 php5-zip-5.5.14-62.1 php5-zip-debuginfo-5.5.14-62.1 php5-zlib-5.5.14-62.1 php5-zlib-debuginfo-5.5.14-62.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-62.1 References: https://www.suse.com/security/cve/CVE-2016-7411.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999682 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2539-1: important: Security update for systemd
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2539-1 Rating: important References: #1000435 #1001765 #954374 #970293 #982210 #982211 #982251 #987173 #987857 #990074 #996269 Cross-References: CVE-2016-7796 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: This update for systemd fixes the following security issue: - CVE-2016-7796: A zero-length message received over systemd's notification socket could make manager_dispatch_notify_fd() return an error and, as a side effect, disable the notification handler completely. As the notification socket is world-writable, this could have allowed a local user to perform a denial-of-service attack against systemd. (bsc#1001765) Additionally, the following non-security fixes are included: - Fix HMAC calculation when appending a data object to journal. (bsc#1000435) - Never accept file descriptors from file systems with mandatory locking enabled. (bsc#954374) - Do not warn about missing install info with "preset". (bsc#970293) - Save /run/systemd/users/UID before starting user@.service. (bsc#996269) - Make sure that /var/lib/systemd/sysv-convert/database is always initialized. (bsc#982211) - Remove daylight saving time handling and tzfile parser. (bsc#990074) - Make sure directory watch is started before cryptsetup. (bsc#987173) - Introduce sd_pid_notify() and sd_pid_notifyf() APIs. (bsc#987857) - Set KillMode=mixed for our daemons that fork worker processes. - Add nosuid and nodev options to tmp.mount. - Don't start console-getty.service when /dev/console is missing. (bsc#982251) - Correct segmentation fault in udev/path_id due to missing NULL check. (bsc#982210) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1194=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgudev-1_0-0-210-98.1 libgudev-1_0-0-debuginfo-210-98.1 libgudev-1_0-devel-210-98.1 libudev-devel-210-98.1 libudev-mini-devel-210-98.1 libudev-mini1-210-98.1 libudev-mini1-debuginfo-210-98.1 libudev1-210-98.1 libudev1-debuginfo-210-98.1 nss-myhostname-210-98.1 nss-myhostname-debuginfo-210-98.1 systemd-210-98.1 systemd-debuginfo-210-98.1 systemd-debugsource-210-98.1 systemd-devel-210-98.1 systemd-journal-gateway-210-98.1 systemd-journal-gateway-debuginfo-210-98.1 systemd-logger-210-98.1 systemd-mini-210-98.1 systemd-mini-debuginfo-210-98.1 systemd-mini-debugsource-210-98.1 systemd-mini-devel-210-98.1 systemd-mini-sysvinit-210-98.1 systemd-sysvinit-210-98.1 typelib-1_0-GUdev-1_0-210-98.1 udev-210-98.1 udev-debuginfo-210-98.1 udev-mini-210-98.1 udev-mini-debuginfo-210-98.1 - openSUSE Leap 42.1 (noarch): systemd-bash-completion-210-98.1 - openSUSE Leap 42.1 (x86_64): libgudev-1_0-0-32bit-210-98.1 libgudev-1_0-0-debuginfo-32bit-210-98.1 libudev1-32bit-210-98.1 libudev1-debuginfo-32bit-210-98.1 nss-myhostname-32bit-210-98.1 nss-myhostname-debuginfo-32bit-210-98.1 systemd-32bit-210-98.1 systemd-debuginfo-32bit-210-98.1 References: https://www.suse.com/security/cve/CVE-2016-7796.html https://bugzilla.suse.com/1000435 https://bugzilla.suse.com/1001765 https://bugzilla.suse.com/954374 https://bugzilla.suse.com/970293 https://bugzilla.suse.com/982210 https://bugzilla.suse.com/982211 https://bugzilla.suse.com/982251 https://bugzilla.suse.com/987173 https://bugzilla.suse.com/987857 https://bugzilla.suse.com/990074 https://bugzilla.suse.com/996269 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2537-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2537-1 Rating: important References: #979475 #982575 #983249 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * update expired S/MIME certs (bsc#979475) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-15.1 libopenssl0_9_8-0.9.8j-15.1 libopenssl0_9_8-debuginfo-0.9.8j-15.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-15.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-15.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2533-1: important: Security update for xen
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2533-1 Rating: important References: #953339 #953362 #953518 #954872 #955399 #957986 #958848 #961600 #963161 #964427 #970135 #971949 #973188 #973631 #974038 #975130 #975138 #975907 #976058 #976111 #978164 #978295 #978413 #979035 #979620 #979670 #980716 #980724 #981264 #981276 #982024 #982025 #982026 #982224 #982225 #982286 #982695 #982960 #983973 #983984 #984981 #985503 #986586 #988675 #990843 #990923 #990970 #991934 #992224 #994421 #994625 #994761 #994772 #994775 #995785 #995789 #995792 #997731 Cross-References: CVE-2014-3615 CVE-2014-3672 CVE-2016-3158 CVE-2016-3159 CVE-2016-3710 CVE-2016-3712 CVE-2016-3960 CVE-2016-4001 CVE-2016-4002 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441 CVE-2016-4453 CVE-2016-4454 CVE-2016-4480 CVE-2016-4952 CVE-2016-4962 CVE-2016-4963 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 CVE-2016-5126 CVE-2016-5238 CVE-2016-5337 CVE-2016-5338 CVE-2016-5403 CVE-2016-6258 CVE-2016-6351 CVE-2016-6833 CVE-2016-6834 CVE-2016-6835 CVE-2016-6836 CVE-2016-6888 CVE-2016-7092 CVE-2016-7093 CVE-2016-7094 CVE-2016-7154 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 38 vulnerabilities and has 20 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264). - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188). - CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188). - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue (bsc#978164) - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038). - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130). - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138). - CVE-2016-4020: The patch_instruction function did not initialize the imm32 variable, which allowed local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR) (bsc#975907) - CVE-2016-4037: The ehci_advance_state function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list (bsc#976111) - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716) - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724) - CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225) - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224) - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295). - CVE-2016-4952: Out-of-bounds access issue in pvsci_ring_init_msg/data routines (bsc#981276) - CVE-2016-4962: The libxl device-handling allowed local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore (bsc#979620) - CVE-2016-4963: The libxl device-handling allowed local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore (bsc#979670) - CVE-2016-5105: Stack information leakage while reading configuration (bsc#982024) - CVE-2016-5106: Out-of-bounds write while setting controller properties (bsc#982025) - CVE-2016-5107: Out-of-bounds read in megasas_lookup_frame() function (bsc#982026) - CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982286) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960) - CVE-2016-5337: The megasas_ctrl_get_info function allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983973) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984) - CVE-2016-5403: virtio: unbounded memory allocation on host via guest leading to DoS (XSA-184) (bsc#990923) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843). - CVE-2016-6833: A use-after-free issue in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994775). - CVE-2016-6834: A infinite loop during packet fragmentation in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994421). - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC device support, causing an OOB read access (bsc#994625). - CVE-2016-6836: VMWARE VMXNET3 NIC device allowed privileged user inside the guest to leak information. It occured while processing transmit(tx) queue, when it reaches the end of packet (bsc#994761). - CVE-2016-6888: A integer overflow int the VMWARE VMXNET3 NIC device support, during the initialisation of new packets in the device, could have allowed a privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994772). - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-7093: Xen allowed local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation (bsc#995789) - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7154: Use-after-free vulnerability in the FIFO event channel code in Xen allowed local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number (bsc#997731). These non-security issues were fixed: - bsc#991934: Hypervisor crash in csched_acct - bsc#992224: During boot of Xen Hypervisor, failed to get contiguous memory for DMA - bsc#970135: New virtualization project clock test randomly fails on Xen - bsc#971949: xl: Support (by ignoring) xl migrate --live. xl migrations are always live - bsc#990970: Add PMU support for Intel E7-8867 v4 (fam=6, model=79) - bsc#985503: vif-route broken - bsc#978413: PV guest upgrade from sles11sp4 to sles12sp2 alpha3 failed on sles11sp4 xen host. - bsc#986586: Out of memory (oom) during boot on "modprobe xenblk" (non xen kernel) - bsc#953339, bsc#953362, bsc#953518, bsc#984981: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream - bsc#958848: HVM guest crash at /usr/src/packages/BUILD/ xen-4.4.2-testing/obj/default/balloon/balloon.c:407 - bsc#982695: xen-4.5.2 qemu fails to boot HVM guest from xvda - bsc#954872: script block-dmmd not working as expected - bsc#961600: : poor performance when Xen HVM domU configured with max memory > current memory - bsc#979035: Restore xm migrate fixes for bsc#955399/ bsc#955399 - bsc#963161: Windows VM getting stuck during load while a VF is assigned to it - bsc#976058: Xen error running simple HVM guest (Post Alpha 2 xen+qemu) - bsc#957986: Indirect descriptors are not compatible with Amazon block backend - bsc#973631: AWS EC2 kdump issue - bsc#964427: Discarding device blocks failed with input/output error Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1476=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1476=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): xen-4.4.4_04-22.22.2 xen-debugsource-4.4.4_04-22.22.2 xen-doc-html-4.4.4_04-22.22.2 xen-kmp-default-4.4.4_04_k3.12.60_52.54-22.22.2 xen-kmp-default-debuginfo-4.4.4_04_k3.12.60_52.54-22.22.2 xen-libs-32bit-4.4.4_04-22.22.2 xen-libs-4.4.4_04-22.22.2 xen-libs-debuginfo-32bit-4.4.4_04-22.22.2 xen-libs-debuginfo-4.4.4_04-22.22.2 xen-tools-4.4.4_04-22.22.2 xen-tools-debuginfo-4.4.4_04-22.22.2 xen-tools-domU-4.4.4_04-22.22.2 xen-tools-domU-debuginfo-4.4.4_04-22.22.2 - SUSE Linux Enterprise Server 12-LTSS (x86_64): xen-4.4.4_04-22.22.2 xen-debugsource-4.4.4_04-22.22.2 xen-doc-html-4.4.4_04-22.22.2 xen-kmp-default-4.4.4_04_k3.12.60_52.54-22.22.2 xen-kmp-default-debuginfo-4.4.4_04_k3.12.60_52.54-22.22.2 xen-libs-32bit-4.4.4_04-22.22.2 xen-libs-4.4.4_04-22.22.2 xen-libs-debuginfo-32bit-4.4.4_04-22.22.2 xen-libs-debuginfo-4.4.4_04-22.22.2 xen-tools-4.4.4_04-22.22.2 xen-tools-debuginfo-4.4.4_04-22.22.2 xen-tools-domU-4.4.4_04-22.22.2 xen-tools-domU-debuginfo-4.4.4_04-22.22.2 References: https://www.suse.com/security/cve/CVE-2014-3615.html https://www.suse.com/security/cve/CVE-2014-3672.html https://www.suse.com/security/cve/CVE-2016-3158.html https://www.suse.com/security/cve/CVE-2016-3159.html https://www.suse.com/security/cve/CVE-2016-3710.html https://www.suse.com/security/cve/CVE-2016-3712.html https://www.suse.com/security/cve/CVE-2016-3960.html https://www.suse.com/security/cve/CVE-2016-4001.html https://www.suse.com/security/cve/CVE-2016-4002.html https://www.suse.com/security/cve/CVE-2016-4020.html https://www.suse.com/security/cve/CVE-2016-4037.html https://www.suse.com/security/cve/CVE-2016-4439.html https://www.suse.com/security/cve/CVE-2016-4441.html https://www.suse.com/security/cve/CVE-2016-4453.html https://www.suse.com/security/cve/CVE-2016-4454.html https://www.suse.com/security/cve/CVE-2016-4480.html https://www.suse.com/security/cve/CVE-2016-4952.html https://www.suse.com/security/cve/CVE-2016-4962.html https://www.suse.com/security/cve/CVE-2016-4963.html https://www.suse.com/security/cve/CVE-2016-5105.html https://www.suse.com/security/cve/CVE-2016-5106.html https://www.suse.com/security/cve/CVE-2016-5107.html https://www.suse.com/security/cve/CVE-2016-5126.html https://www.suse.com/security/cve/CVE-2016-5238.html https://www.suse.com/security/cve/CVE-2016-5337.html https://www.suse.com/security/cve/CVE-2016-5338.html https://www.suse.com/security/cve/CVE-2016-5403.html https://www.suse.com/security/cve/CVE-2016-6258.html https://www.suse.com/security/cve/CVE-2016-6351.html https://www.suse.com/security/cve/CVE-2016-6833.html https://www.suse.com/security/cve/CVE-2016-6834.html https://www.suse.com/security/cve/CVE-2016-6835.html https://www.suse.com/security/cve/CVE-2016-6836.html https://www.suse.com/security/cve/CVE-2016-6888.html https://www.suse.com/security/cve/CVE-2016-7092.html https://www.suse.com/security/cve/CVE-2016-7093.html https://www.suse.com/security/cve/CVE-2016-7094.html https://www.suse.com/security/cve/CVE-2016-7154.html https://bugzilla.suse.com/953339 https://bugzilla.suse.com/953362 https://bugzilla.suse.com/953518 https://bugzilla.suse.com/954872 https://bugzilla.suse.com/955399 https://bugzilla.suse.com/957986 https://bugzilla.suse.com/958848 https://bugzilla.suse.com/961600 https://bugzilla.suse.com/963161 https://bugzilla.suse.com/964427 https://bugzilla.suse.com/970135 https://bugzilla.suse.com/971949 https://bugzilla.suse.com/973188 https://bugzilla.suse.com/973631 https://bugzilla.suse.com/974038 https://bugzilla.suse.com/975130 https://bugzilla.suse.com/975138 https://bugzilla.suse.com/975907 https://bugzilla.suse.com/976058 https://bugzilla.suse.com/976111 https://bugzilla.suse.com/978164 https://bugzilla.suse.com/978295 https://bugzilla.suse.com/978413 https://bugzilla.suse.com/979035 https://bugzilla.suse.com/979620 https://bugzilla.suse.com/979670 https://bugzilla.suse.com/980716 https://bugzilla.suse.com/980724 https://bugzilla.suse.com/981264 https://bugzilla.suse.com/981276 https://bugzilla.suse.com/982024 https://bugzilla.suse.com/982025 https://bugzilla.suse.com/982026 https://bugzilla.suse.com/982224 https://bugzilla.suse.com/982225 https://bugzilla.suse.com/982286 https://bugzilla.suse.com/982695 https://bugzilla.suse.com/982960 https://bugzilla.suse.com/983973 https://bugzilla.suse.com/983984 https://bugzilla.suse.com/984981 https://bugzilla.suse.com/985503 https://bugzilla.suse.com/986586 https://bugzilla.suse.com/988675 https://bugzilla.suse.com/990843 https://bugzilla.suse.com/990923 https://bugzilla.suse.com/990970 https://bugzilla.suse.com/991934 https://bugzilla.suse.com/992224 https://bugzilla.suse.com/994421 https://bugzilla.suse.com/994625 https://bugzilla.suse.com/994761 https://bugzilla.suse.com/994772 https://bugzilla.suse.com/994775 https://bugzilla.suse.com/995785 https://bugzilla.suse.com/995789 https://bugzilla.suse.com/995792 https://bugzilla.suse.com/997731 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2528-1: important: Security update for xen
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2528-1 Rating: important References: #973188 #974038 #975130 #975138 #978164 #978295 #980716 #980724 #981264 #982960 #983984 #988675 #995785 #995792 Cross-References: CVE-2014-3615 CVE-2014-3672 CVE-2016-3158 CVE-2016-3159 CVE-2016-3710 CVE-2016-3960 CVE-2016-4001 CVE-2016-4002 CVE-2016-4439 CVE-2016-4441 CVE-2016-4480 CVE-2016-5238 CVE-2016-5338 CVE-2016-6258 CVE-2016-7092 CVE-2016-7094 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960) - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264) - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724) - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716) - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue (bsc#978164) - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295) - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038) - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188) - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130) - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-xen-12786=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): xen-devel-4.1.6_08-29.1 xen-kmp-default-4.1.6_08_3.0.101_0.7.40-29.1 xen-kmp-trace-4.1.6_08_3.0.101_0.7.40-29.1 xen-libs-4.1.6_08-29.1 xen-tools-domU-4.1.6_08-29.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (x86_64): xen-4.1.6_08-29.1 xen-doc-html-4.1.6_08-29.1 xen-doc-pdf-4.1.6_08-29.1 xen-libs-32bit-4.1.6_08-29.1 xen-tools-4.1.6_08-29.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): xen-kmp-pae-4.1.6_08_3.0.101_0.7.40-29.1 References: https://www.suse.com/security/cve/CVE-2014-3615.html https://www.suse.com/security/cve/CVE-2014-3672.html https://www.suse.com/security/cve/CVE-2016-3158.html https://www.suse.com/security/cve/CVE-2016-3159.html https://www.suse.com/security/cve/CVE-2016-3710.html https://www.suse.com/security/cve/CVE-2016-3960.html https://www.suse.com/security/cve/CVE-2016-4001.html https://www.suse.com/security/cve/CVE-2016-4002.html https://www.suse.com/security/cve/CVE-2016-4439.html https://www.suse.com/security/cve/CVE-2016-4441.html https://www.suse.com/security/cve/CVE-2016-4480.html https://www.suse.com/security/cve/CVE-2016-5238.html https://www.suse.com/security/cve/CVE-2016-5338.html https://www.suse.com/security/cve/CVE-2016-6258.html https://www.suse.com/security/cve/CVE-2016-7092.html https://www.suse.com/security/cve/CVE-2016-7094.html https://bugzilla.suse.com/973188 https://bugzilla.suse.com/974038 https://bugzilla.suse.com/975130 https://bugzilla.suse.com/975138 https://bugzilla.suse.com/978164 https://bugzilla.suse.com/978295 https://bugzilla.suse.com/980716 https://bugzilla.suse.com/980724 https://bugzilla.suse.com/981264 https://bugzilla.suse.com/982960 https://bugzilla.suse.com/983984 https://bugzilla.suse.com/988675 https://bugzilla.suse.com/995785 https://bugzilla.suse.com/995792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2522-1: important: Security update for systemd
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2522-1 Rating: important References: #1000435 #1001765 #954374 #970293 #982211 #996269 Cross-References: CVE-2016-7796 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2016-7796: A zero-length message received over systemd's notification socket could make manager_dispatch_notify_fd() return an error and, as a side effect, disable the notification handler completely. As the notification socket is world-writable, this could have allowed a local user to perform a denial-of-service attack against systemd. (bsc#1001765) Additionally, the following non-security fixes are included: - Fix HMAC calculation when appending a data object to journal. (bsc#1000435) - Never accept file descriptors from file systems with mandatory locking enabled. (bsc#954374) - Do not warn about missing install info with "preset". (bsc#970293) - Save /run/systemd/users/UID before starting user@.service. (bsc#996269) - Make sure that /var/lib/systemd/sysv-convert/database is always initialized. (bsc#982211) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1184=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgudev-1_0-0-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-0-debuginfo-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-devel-210.1475218254.1e76ce0-25.48.1 libudev-devel-210.1475218254.1e76ce0-25.48.1 libudev-mini-devel-210.1475218254.1e76ce0-25.48.1 libudev-mini1-210.1475218254.1e76ce0-25.48.1 libudev-mini1-debuginfo-210.1475218254.1e76ce0-25.48.1 libudev1-210.1475218254.1e76ce0-25.48.1 libudev1-debuginfo-210.1475218254.1e76ce0-25.48.1 nss-myhostname-210.1475218254.1e76ce0-25.48.1 nss-myhostname-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-210.1475218254.1e76ce0-25.48.1 systemd-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-debugsource-210.1475218254.1e76ce0-25.48.1 systemd-devel-210.1475218254.1e76ce0-25.48.1 systemd-journal-gateway-210.1475218254.1e76ce0-25.48.1 systemd-journal-gateway-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-logger-210.1475218254.1e76ce0-25.48.1 systemd-mini-210.1475218254.1e76ce0-25.48.1 systemd-mini-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-mini-debugsource-210.1475218254.1e76ce0-25.48.1 systemd-mini-devel-210.1475218254.1e76ce0-25.48.1 systemd-mini-sysvinit-210.1475218254.1e76ce0-25.48.1 systemd-sysvinit-210.1475218254.1e76ce0-25.48.1 typelib-1_0-GUdev-1_0-210.1475218254.1e76ce0-25.48.1 udev-210.1475218254.1e76ce0-25.48.1 udev-debuginfo-210.1475218254.1e76ce0-25.48.1 udev-mini-210.1475218254.1e76ce0-25.48.1 udev-mini-debuginfo-210.1475218254.1e76ce0-25.48.1 - openSUSE 13.2 (noarch): systemd-bash-completion-210.1475218254.1e76ce0-25.48.1 - openSUSE 13.2 (x86_64): libgudev-1_0-0-32bit-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-0-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 libudev1-32bit-210.1475218254.1e76ce0-25.48.1 libudev1-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 nss-myhostname-32bit-210.1475218254.1e76ce0-25.48.1 nss-myhostname-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 systemd-32bit-210.1475218254.1e76ce0-25.48.1 systemd-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 References: https://www.suse.com/security/cve/CVE-2016-7796.html https://bugzilla.suse.com/1000435 https://bugzilla.suse.com/1001765 https://bugzilla.suse.com/954374 https://bugzilla.suse.com/970293 https://bugzilla.suse.com/982211 https://bugzilla.suse.com/996269 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2513-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Oct '16

12 Oct '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2513-1 Rating: important References: #999701 Cross-References: CVE-2016-5250 CVE-2016-5257 CVE-2016-5261 CVE-2016-5270 CVE-2016-5272 CVE-2016-5274 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5280 CVE-2016-5281 CVE-2016-5284 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: MozillaFirefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701): The following security issue were fixed: * MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString * MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin * MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList * MFSA 2016-86/CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState * MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick * MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame * MFSA 2016-86/CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap * MFSA 2016-86/CVE-2016-5281: use-after-free in DOMSVGLength * MFSA 2016-86/CVE-2016-5284: Add-on update site certificate pin expiration * MFSA 2016-86/CVE-2016-5250: Resource Timing API is storing resources sent by the previous page * MFSA 2016-86/CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel * MFSA 2016-86/CVE-2016-5257: Various memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-MozillaFirefox-12784=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-MozillaFirefox-12784=1 - SUSE Manager 2.1: zypper in -t patch sleman21-MozillaFirefox-12784=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-12784=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-12784=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-12784=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-MozillaFirefox-12784=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-12784=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-12784=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Manager Proxy 2.1 (x86_64): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Manager 2.1 (s390x x86_64): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-45.4.0esr-53.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): MozillaFirefox-45.4.0esr-53.1 MozillaFirefox-translations-45.4.0esr-53.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-45.4.0esr-53.1 MozillaFirefox-debugsource-45.4.0esr-53.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-45.4.0esr-53.1 MozillaFirefox-debugsource-45.4.0esr-53.1 References: https://www.suse.com/security/cve/CVE-2016-5250.html https://www.suse.com/security/cve/CVE-2016-5257.html https://www.suse.com/security/cve/CVE-2016-5261.html https://www.suse.com/security/cve/CVE-2016-5270.html https://www.suse.com/security/cve/CVE-2016-5272.html https://www.suse.com/security/cve/CVE-2016-5274.html https://www.suse.com/security/cve/CVE-2016-5276.html https://www.suse.com/security/cve/CVE-2016-5277.html https://www.suse.com/security/cve/CVE-2016-5278.html https://www.suse.com/security/cve/CVE-2016-5280.html https://www.suse.com/security/cve/CVE-2016-5281.html https://www.suse.com/security/cve/CVE-2016-5284.html https://bugzilla.suse.com/999701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0