October 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:2473-1: important: Security update for xen
by opensuse-security＠opensuse.org 07 Oct '16

07 Oct '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2473-1 Rating: important References: #953518 #955104 #959330 #959552 #970135 #971949 #988675 #988676 #990500 #990970 #991934 #992224 #993665 #994421 #994625 #994761 #994772 #994775 #995785 #995789 #995792 Cross-References: CVE-2016-6258 CVE-2016-6259 CVE-2016-6833 CVE-2016-6834 CVE-2016-6835 CVE-2016-6836 CVE-2016-6888 CVE-2016-7092 CVE-2016-7093 CVE-2016-7094 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 11 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785). - CVE-2016-7093: Xen allowed local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation (bsc#995789). - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792). - CVE-2016-6836: Information leakage in vmxnet3_complete_packet (bsc#994761). - CVE-2016-6888: Integer overflow in packet initialisation in VMXNET3 device driver. Aprivileged user inside guest c... (bsc#994772). - CVE-2016-6833: Use after free while writing (bsc#994775). - CVE-2016-6835: Buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 deviceemulation. (bsc#994625). - CVE-2016-6834: An infinite loop during packet fragmentation (bsc#994421). - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675). - CVE-2016-6259: Xen did not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allowed local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check (bsc#988676). These non-security issues were fixed: - bsc#991934: Hypervisor crash in csched_acct - bsc#992224: During boot of Xen Hypervisor, failed to get contiguous memory for DMA - bsc#955104: Virsh reports error "one or more references were leaked after disconnect from hypervisor" when "virsh save" failed due to "no response from client after 6 keepalive messages" - bsc#959552: Migration of HVM guest leads into libvirt segmentation fault - bsc#993665: Migration of xen guests finishes in: One or more references were leaked after disconnect from the hypervisor - bsc#959330: Guest migrations using virsh results in error "Internal error: received hangup / error event on socket" - bsc#990500: VM virsh migration fails with keepalive error: ":virKeepAliveTimerInternal:143 : No response from client" - bsc#953518: Unplug also SCSI disks in qemu-xen-traditional for upstream unplug protocol - bsc#953518: xen_platform: unplug also SCSI disks in qemu-xen - bsc#971949: xl: Support (by ignoring) xl migrate --live. xl migrations are always live - bsc#970135: New virtualization project clock test randomly fails on Xen - bsc#990970: Add PMU support for Intel E7-8867 v4 (fam=6, model=79) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1444=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1444=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1444=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (x86_64): xen-debugsource-4.5.3_10-20.1 xen-devel-4.5.3_10-20.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): xen-4.5.3_10-20.1 xen-debugsource-4.5.3_10-20.1 xen-doc-html-4.5.3_10-20.1 xen-kmp-default-4.5.3_10_k3.12.62_60.62-20.1 xen-kmp-default-debuginfo-4.5.3_10_k3.12.62_60.62-20.1 xen-libs-32bit-4.5.3_10-20.1 xen-libs-4.5.3_10-20.1 xen-libs-debuginfo-32bit-4.5.3_10-20.1 xen-libs-debuginfo-4.5.3_10-20.1 xen-tools-4.5.3_10-20.1 xen-tools-debuginfo-4.5.3_10-20.1 xen-tools-domU-4.5.3_10-20.1 xen-tools-domU-debuginfo-4.5.3_10-20.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): xen-4.5.3_10-20.1 xen-debugsource-4.5.3_10-20.1 xen-kmp-default-4.5.3_10_k3.12.62_60.62-20.1 xen-kmp-default-debuginfo-4.5.3_10_k3.12.62_60.62-20.1 xen-libs-32bit-4.5.3_10-20.1 xen-libs-4.5.3_10-20.1 xen-libs-debuginfo-32bit-4.5.3_10-20.1 xen-libs-debuginfo-4.5.3_10-20.1 References: https://www.suse.com/security/cve/CVE-2016-6258.html https://www.suse.com/security/cve/CVE-2016-6259.html https://www.suse.com/security/cve/CVE-2016-6833.html https://www.suse.com/security/cve/CVE-2016-6834.html https://www.suse.com/security/cve/CVE-2016-6835.html https://www.suse.com/security/cve/CVE-2016-6836.html https://www.suse.com/security/cve/CVE-2016-6888.html https://www.suse.com/security/cve/CVE-2016-7092.html https://www.suse.com/security/cve/CVE-2016-7093.html https://www.suse.com/security/cve/CVE-2016-7094.html https://bugzilla.suse.com/953518 https://bugzilla.suse.com/955104 https://bugzilla.suse.com/959330 https://bugzilla.suse.com/959552 https://bugzilla.suse.com/970135 https://bugzilla.suse.com/971949 https://bugzilla.suse.com/988675 https://bugzilla.suse.com/988676 https://bugzilla.suse.com/990500 https://bugzilla.suse.com/990970 https://bugzilla.suse.com/991934 https://bugzilla.suse.com/992224 https://bugzilla.suse.com/993665 https://bugzilla.suse.com/994421 https://bugzilla.suse.com/994625 https://bugzilla.suse.com/994761 https://bugzilla.suse.com/994772 https://bugzilla.suse.com/994775 https://bugzilla.suse.com/995785 https://bugzilla.suse.com/995789 https://bugzilla.suse.com/995792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2470-1: important: Security update for nodejs4
by opensuse-security＠opensuse.org 06 Oct '16

06 Oct '16

SUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2470-1 Rating: important References: #1001652 #985201 Cross-References: CVE-2016-2178 CVE-2016-2183 CVE-2016-5325 CVE-2016-6304 CVE-2016-6306 CVE-2016-7052 CVE-2016-7099 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues: * Nodejs embedded openssl version update + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178, CVE-2016-6306, CVE-2016-7052) + remove support for dynamic 3rd party engine modules * http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. (CVE-2016-5325, bsc#985201) * tls: properly validate wildcard certificates (CVE-2016-7099, bsc#1001652) * buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1439=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le x86_64): nodejs4-4.6.0-8.1 nodejs4-debuginfo-4.6.0-8.1 nodejs4-debugsource-4.6.0-8.1 nodejs4-devel-4.6.0-8.1 npm4-4.6.0-8.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): nodejs4-docs-4.6.0-8.1 References: https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-5325.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://www.suse.com/security/cve/CVE-2016-7052.html https://www.suse.com/security/cve/CVE-2016-7099.html https://bugzilla.suse.com/1001652 https://bugzilla.suse.com/985201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2469-1: important: Security update for openssl1
by opensuse-security＠opensuse.org 06 Oct '16

06 Oct '16

SUSE Security Update: Security update for openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2469-1 Rating: important References: #979475 #982575 #982745 #983249 #990419 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 5 fixes is now available. Description: This update for openssl1 fixes the following issues: penSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed: * update expired S/MIME certs (bsc#979475) * improve s390x performance (bsc#982745) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openssl1-12777=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): libopenssl1-devel-1.0.1g-0.52.1 libopenssl1_0_0-1.0.1g-0.52.1 openssl1-1.0.1g-0.52.1 openssl1-doc-1.0.1g-0.52.1 - SUSE Linux Enterprise Server 11-SECURITY (ppc64 s390x x86_64): libopenssl1_0_0-32bit-1.0.1g-0.52.1 - SUSE Linux Enterprise Server 11-SECURITY (ia64): libopenssl1_0_0-x86-1.0.1g-0.52.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2180.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/982745 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/990419 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2468-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 06 Oct '16

06 Oct '16

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2468-1 Rating: important References: #979475 #982575 #983249 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * update expired S/MIME certs (bsc#979475) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2016-1441=1 - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-1441=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1441=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): compat-openssl098-debugsource-0.9.8j-102.1 libopenssl0_9_8-0.9.8j-102.1 libopenssl0_9_8-debuginfo-0.9.8j-102.1 - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-102.1 libopenssl0_9_8-0.9.8j-102.1 libopenssl0_9_8-32bit-0.9.8j-102.1 libopenssl0_9_8-debuginfo-0.9.8j-102.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-102.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): compat-openssl098-debugsource-0.9.8j-102.1 libopenssl0_9_8-0.9.8j-102.1 libopenssl0_9_8-32bit-0.9.8j-102.1 libopenssl0_9_8-debuginfo-0.9.8j-102.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-102.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2465-1: important: Security update for python-Jinja2
by opensuse-security＠opensuse.org 06 Oct '16

06 Oct '16

openSUSE Security Update: Security update for python-Jinja2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2465-1 Rating: important References: #858239 Cross-References: CVE-2014-0012 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Jinja2 fixes the following issues: Update to version 2.8: - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Update to 2.7.3 (boo#858239, CVE-2014-0012) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1159=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-Jinja2-2.8-3.3.1 python-Jinja2-emacs-2.8-3.3.1 python-Jinja2-vim-2.8-3.3.1 References: https://www.suse.com/security/cve/CVE-2014-0012.html https://bugzilla.suse.com/858239 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2464-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 06 Oct '16

06 Oct '16

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2464-1 Rating: important References: #973660 #993453 #993454 Cross-References: CVE-2016-5423 CVE-2016-5424 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed: - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed: - bsc#973660: Added "Requires: timezone" to Service Pack For additional non-security issues please refer to - http://www.postgresql.org/docs/9.4/static/release-9-4-9.html - http://www.postgresql.org/docs/9.4/static/release-9-4-8.html - http://www.postgresql.org/docs/9.4/static/release-9-4-7.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1161=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libecpg6-9.4.9-7.1 libecpg6-debuginfo-9.4.9-7.1 libpq5-9.4.9-7.1 libpq5-debuginfo-9.4.9-7.1 postgresql94-9.4.9-7.1 postgresql94-contrib-9.4.9-7.1 postgresql94-contrib-debuginfo-9.4.9-7.1 postgresql94-debuginfo-9.4.9-7.1 postgresql94-debugsource-9.4.9-7.1 postgresql94-devel-9.4.9-7.1 postgresql94-devel-debuginfo-9.4.9-7.1 postgresql94-libs-debugsource-9.4.9-7.1 postgresql94-plperl-9.4.9-7.1 postgresql94-plperl-debuginfo-9.4.9-7.1 postgresql94-plpython-9.4.9-7.1 postgresql94-plpython-debuginfo-9.4.9-7.1 postgresql94-pltcl-9.4.9-7.1 postgresql94-pltcl-debuginfo-9.4.9-7.1 postgresql94-server-9.4.9-7.1 postgresql94-server-debuginfo-9.4.9-7.1 postgresql94-test-9.4.9-7.1 - openSUSE Leap 42.1 (x86_64): libecpg6-32bit-9.4.9-7.1 libecpg6-debuginfo-32bit-9.4.9-7.1 libpq5-32bit-9.4.9-7.1 libpq5-debuginfo-32bit-9.4.9-7.1 - openSUSE Leap 42.1 (noarch): postgresql94-docs-9.4.9-7.1 References: https://www.suse.com/security/cve/CVE-2016-5423.html https://www.suse.com/security/cve/CVE-2016-5424.html https://bugzilla.suse.com/973660 https://bugzilla.suse.com/993453 https://bugzilla.suse.com/993454 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2461-1: important: Security update for php53
by opensuse-security＠opensuse.org 05 Oct '16

05 Oct '16

SUSE Security Update: Security update for php53 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2461-1 Rating: important References: #999679 #999680 #999682 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php53 fixes the following issues: * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-php53-12776=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-php53-12776=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): apache2-mod_php53-5.3.17-58.1 php53-5.3.17-58.1 php53-bcmath-5.3.17-58.1 php53-bz2-5.3.17-58.1 php53-calendar-5.3.17-58.1 php53-ctype-5.3.17-58.1 php53-curl-5.3.17-58.1 php53-dba-5.3.17-58.1 php53-dom-5.3.17-58.1 php53-exif-5.3.17-58.1 php53-fastcgi-5.3.17-58.1 php53-fileinfo-5.3.17-58.1 php53-ftp-5.3.17-58.1 php53-gd-5.3.17-58.1 php53-gettext-5.3.17-58.1 php53-gmp-5.3.17-58.1 php53-iconv-5.3.17-58.1 php53-intl-5.3.17-58.1 php53-json-5.3.17-58.1 php53-ldap-5.3.17-58.1 php53-mbstring-5.3.17-58.1 php53-mcrypt-5.3.17-58.1 php53-mysql-5.3.17-58.1 php53-odbc-5.3.17-58.1 php53-openssl-5.3.17-58.1 php53-pcntl-5.3.17-58.1 php53-pdo-5.3.17-58.1 php53-pear-5.3.17-58.1 php53-pgsql-5.3.17-58.1 php53-pspell-5.3.17-58.1 php53-shmop-5.3.17-58.1 php53-snmp-5.3.17-58.1 php53-soap-5.3.17-58.1 php53-suhosin-5.3.17-58.1 php53-sysvmsg-5.3.17-58.1 php53-sysvsem-5.3.17-58.1 php53-sysvshm-5.3.17-58.1 php53-tokenizer-5.3.17-58.1 php53-wddx-5.3.17-58.1 php53-xmlreader-5.3.17-58.1 php53-xmlrpc-5.3.17-58.1 php53-xmlwriter-5.3.17-58.1 php53-xsl-5.3.17-58.1 php53-zip-5.3.17-58.1 php53-zlib-5.3.17-58.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): php53-debuginfo-5.3.17-58.1 php53-debugsource-5.3.17-58.1 References: https://www.suse.com/security/cve/CVE-2016-7411.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999682 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2460-1: important: Security update for php7
by opensuse-security＠opensuse.org 05 Oct '16

05 Oct '16

SUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2460-1 Rating: important References: #1001950 #987580 #988032 #991422 #991424 #991426 #991427 #991428 #991429 #991430 #991434 #991437 #995512 #997206 #997207 #997208 #997210 #997211 #997220 #997225 #997230 #997247 #997248 #997257 #999313 #999679 #999680 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-4473 CVE-2016-5399 CVE-2016-6128 CVE-2016-6161 CVE-2016-6207 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-7133 CVE-2016-7134 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that solves 29 vulnerabilities and has two fixes is now available. Description: This update for php7 fixes the following security issues: * CVE-2016-6128: Invalid color index not properly handled [bsc#987580] * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] * CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422] * CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] * CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] * CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] * CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] * CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] * CVE-2016-5399: Improper error handling in bzread() [bsc#991430] * CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] * CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file() * CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization * CVE-2016-7125: PHP Session Data Injection Vulnerability * CVE-2016-7126: select_colors write out-of-bounds * CVE-2016-7127: imagegammacorrect allowed arbitrary write access * CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF * CVE-2016-7129: wddx_deserialize allowed illegal memory access * CVE-2016-7131: wddx_deserialize null dereference with invalid xml * CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element * CVE-2016-7133: memory allocator fails to realloc small block to large one * CVE-2016-7134: Heap overflow in the function curl_escape * CVE-2016-7130: wddx_deserialize null dereference * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7418: Null pointer dereference in php_wddx_push_element * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1434=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1434=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): php7-debuginfo-7.0.7-15.1 php7-debugsource-7.0.7-15.1 php7-devel-7.0.7-15.1 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php7-7.0.7-15.1 apache2-mod_php7-debuginfo-7.0.7-15.1 php7-7.0.7-15.1 php7-bcmath-7.0.7-15.1 php7-bcmath-debuginfo-7.0.7-15.1 php7-bz2-7.0.7-15.1 php7-bz2-debuginfo-7.0.7-15.1 php7-calendar-7.0.7-15.1 php7-calendar-debuginfo-7.0.7-15.1 php7-ctype-7.0.7-15.1 php7-ctype-debuginfo-7.0.7-15.1 php7-curl-7.0.7-15.1 php7-curl-debuginfo-7.0.7-15.1 php7-dba-7.0.7-15.1 php7-dba-debuginfo-7.0.7-15.1 php7-debuginfo-7.0.7-15.1 php7-debugsource-7.0.7-15.1 php7-dom-7.0.7-15.1 php7-dom-debuginfo-7.0.7-15.1 php7-enchant-7.0.7-15.1 php7-enchant-debuginfo-7.0.7-15.1 php7-exif-7.0.7-15.1 php7-exif-debuginfo-7.0.7-15.1 php7-fastcgi-7.0.7-15.1 php7-fastcgi-debuginfo-7.0.7-15.1 php7-fileinfo-7.0.7-15.1 php7-fileinfo-debuginfo-7.0.7-15.1 php7-fpm-7.0.7-15.1 php7-fpm-debuginfo-7.0.7-15.1 php7-ftp-7.0.7-15.1 php7-ftp-debuginfo-7.0.7-15.1 php7-gd-7.0.7-15.1 php7-gd-debuginfo-7.0.7-15.1 php7-gettext-7.0.7-15.1 php7-gettext-debuginfo-7.0.7-15.1 php7-gmp-7.0.7-15.1 php7-gmp-debuginfo-7.0.7-15.1 php7-iconv-7.0.7-15.1 php7-iconv-debuginfo-7.0.7-15.1 php7-imap-7.0.7-15.1 php7-imap-debuginfo-7.0.7-15.1 php7-intl-7.0.7-15.1 php7-intl-debuginfo-7.0.7-15.1 php7-json-7.0.7-15.1 php7-json-debuginfo-7.0.7-15.1 php7-ldap-7.0.7-15.1 php7-ldap-debuginfo-7.0.7-15.1 php7-mbstring-7.0.7-15.1 php7-mbstring-debuginfo-7.0.7-15.1 php7-mcrypt-7.0.7-15.1 php7-mcrypt-debuginfo-7.0.7-15.1 php7-mysql-7.0.7-15.1 php7-mysql-debuginfo-7.0.7-15.1 php7-odbc-7.0.7-15.1 php7-odbc-debuginfo-7.0.7-15.1 php7-opcache-7.0.7-15.1 php7-opcache-debuginfo-7.0.7-15.1 php7-openssl-7.0.7-15.1 php7-openssl-debuginfo-7.0.7-15.1 php7-pcntl-7.0.7-15.1 php7-pcntl-debuginfo-7.0.7-15.1 php7-pdo-7.0.7-15.1 php7-pdo-debuginfo-7.0.7-15.1 php7-pgsql-7.0.7-15.1 php7-pgsql-debuginfo-7.0.7-15.1 php7-phar-7.0.7-15.1 php7-phar-debuginfo-7.0.7-15.1 php7-posix-7.0.7-15.1 php7-posix-debuginfo-7.0.7-15.1 php7-pspell-7.0.7-15.1 php7-pspell-debuginfo-7.0.7-15.1 php7-shmop-7.0.7-15.1 php7-shmop-debuginfo-7.0.7-15.1 php7-snmp-7.0.7-15.1 php7-snmp-debuginfo-7.0.7-15.1 php7-soap-7.0.7-15.1 php7-soap-debuginfo-7.0.7-15.1 php7-sockets-7.0.7-15.1 php7-sockets-debuginfo-7.0.7-15.1 php7-sqlite-7.0.7-15.1 php7-sqlite-debuginfo-7.0.7-15.1 php7-sysvmsg-7.0.7-15.1 php7-sysvmsg-debuginfo-7.0.7-15.1 php7-sysvsem-7.0.7-15.1 php7-sysvsem-debuginfo-7.0.7-15.1 php7-sysvshm-7.0.7-15.1 php7-sysvshm-debuginfo-7.0.7-15.1 php7-tokenizer-7.0.7-15.1 php7-tokenizer-debuginfo-7.0.7-15.1 php7-wddx-7.0.7-15.1 php7-wddx-debuginfo-7.0.7-15.1 php7-xmlreader-7.0.7-15.1 php7-xmlreader-debuginfo-7.0.7-15.1 php7-xmlrpc-7.0.7-15.1 php7-xmlrpc-debuginfo-7.0.7-15.1 php7-xmlwriter-7.0.7-15.1 php7-xmlwriter-debuginfo-7.0.7-15.1 php7-xsl-7.0.7-15.1 php7-xsl-debuginfo-7.0.7-15.1 php7-zip-7.0.7-15.1 php7-zip-debuginfo-7.0.7-15.1 php7-zlib-7.0.7-15.1 php7-zlib-debuginfo-7.0.7-15.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php7-pear-7.0.7-15.1 php7-pear-Archive_Tar-7.0.7-15.1 References: https://www.suse.com/security/cve/CVE-2016-4473.html https://www.suse.com/security/cve/CVE-2016-5399.html https://www.suse.com/security/cve/CVE-2016-6128.html https://www.suse.com/security/cve/CVE-2016-6161.html https://www.suse.com/security/cve/CVE-2016-6207.html https://www.suse.com/security/cve/CVE-2016-6289.html https://www.suse.com/security/cve/CVE-2016-6290.html https://www.suse.com/security/cve/CVE-2016-6291.html https://www.suse.com/security/cve/CVE-2016-6292.html https://www.suse.com/security/cve/CVE-2016-6295.html https://www.suse.com/security/cve/CVE-2016-6296.html https://www.suse.com/security/cve/CVE-2016-6297.html https://www.suse.com/security/cve/CVE-2016-7124.html https://www.suse.com/security/cve/CVE-2016-7125.html https://www.suse.com/security/cve/CVE-2016-7126.html https://www.suse.com/security/cve/CVE-2016-7127.html https://www.suse.com/security/cve/CVE-2016-7128.html https://www.suse.com/security/cve/CVE-2016-7129.html https://www.suse.com/security/cve/CVE-2016-7130.html https://www.suse.com/security/cve/CVE-2016-7131.html https://www.suse.com/security/cve/CVE-2016-7132.html https://www.suse.com/security/cve/CVE-2016-7133.html https://www.suse.com/security/cve/CVE-2016-7134.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/1001950 https://bugzilla.suse.com/987580 https://bugzilla.suse.com/988032 https://bugzilla.suse.com/991422 https://bugzilla.suse.com/991424 https://bugzilla.suse.com/991426 https://bugzilla.suse.com/991427 https://bugzilla.suse.com/991428 https://bugzilla.suse.com/991429 https://bugzilla.suse.com/991430 https://bugzilla.suse.com/991434 https://bugzilla.suse.com/991437 https://bugzilla.suse.com/995512 https://bugzilla.suse.com/997206 https://bugzilla.suse.com/997207 https://bugzilla.suse.com/997208 https://bugzilla.suse.com/997210 https://bugzilla.suse.com/997211 https://bugzilla.suse.com/997220 https://bugzilla.suse.com/997225 https://bugzilla.suse.com/997230 https://bugzilla.suse.com/997247 https://bugzilla.suse.com/997248 https://bugzilla.suse.com/997257 https://bugzilla.suse.com/999313 https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2459-1: important: Security update for php53
by opensuse-security＠opensuse.org 05 Oct '16

05 Oct '16

SUSE Security Update: Security update for php53 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2459-1 Rating: important References: #997206 #997207 #997208 #997210 #997211 #997220 #997225 #997230 #997257 #999679 #999680 #999682 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for php53 fixes the following security issues: * CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization * CVE-2016-7125: PHP Session Data Injection Vulnerability * CVE-2016-7126: select_colors write out-of-bounds * CVE-2016-7127: imagegammacorrect allowed arbitrary write access * CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF * CVE-2016-7129: wddx_deserialize allows illegal memory access * CVE-2016-7130: wddx_deserialize null dereference * CVE-2016-7131: wddx_deserialize null dereference with invalid xml * CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-php53-12775=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-php53-12775=1 - SUSE Manager 2.1: zypper in -t patch sleman21-php53-12775=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-12775=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-php53-12775=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-php53-12775=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-php53-12775=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-php53-12775=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-php53-12775=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Manager Proxy 2.1 (x86_64): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Manager 2.1 (s390x x86_64): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-84.1 php53-imap-5.3.17-84.1 php53-posix-5.3.17-84.1 php53-readline-5.3.17-84.1 php53-sockets-5.3.17-84.1 php53-sqlite-5.3.17-84.1 php53-tidy-5.3.17-84.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): apache2-mod_php53-5.3.17-84.1 php53-5.3.17-84.1 php53-bcmath-5.3.17-84.1 php53-bz2-5.3.17-84.1 php53-calendar-5.3.17-84.1 php53-ctype-5.3.17-84.1 php53-curl-5.3.17-84.1 php53-dba-5.3.17-84.1 php53-dom-5.3.17-84.1 php53-exif-5.3.17-84.1 php53-fastcgi-5.3.17-84.1 php53-fileinfo-5.3.17-84.1 php53-ftp-5.3.17-84.1 php53-gd-5.3.17-84.1 php53-gettext-5.3.17-84.1 php53-gmp-5.3.17-84.1 php53-iconv-5.3.17-84.1 php53-intl-5.3.17-84.1 php53-json-5.3.17-84.1 php53-ldap-5.3.17-84.1 php53-mbstring-5.3.17-84.1 php53-mcrypt-5.3.17-84.1 php53-mysql-5.3.17-84.1 php53-odbc-5.3.17-84.1 php53-openssl-5.3.17-84.1 php53-pcntl-5.3.17-84.1 php53-pdo-5.3.17-84.1 php53-pear-5.3.17-84.1 php53-pgsql-5.3.17-84.1 php53-pspell-5.3.17-84.1 php53-shmop-5.3.17-84.1 php53-snmp-5.3.17-84.1 php53-soap-5.3.17-84.1 php53-suhosin-5.3.17-84.1 php53-sysvmsg-5.3.17-84.1 php53-sysvsem-5.3.17-84.1 php53-sysvshm-5.3.17-84.1 php53-tokenizer-5.3.17-84.1 php53-wddx-5.3.17-84.1 php53-xmlreader-5.3.17-84.1 php53-xmlrpc-5.3.17-84.1 php53-xmlwriter-5.3.17-84.1 php53-xsl-5.3.17-84.1 php53-zip-5.3.17-84.1 php53-zlib-5.3.17-84.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-debuginfo-5.3.17-84.1 php53-debugsource-5.3.17-84.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): php53-debuginfo-5.3.17-84.1 php53-debugsource-5.3.17-84.1 References: https://www.suse.com/security/cve/CVE-2016-7124.html https://www.suse.com/security/cve/CVE-2016-7125.html https://www.suse.com/security/cve/CVE-2016-7126.html https://www.suse.com/security/cve/CVE-2016-7127.html https://www.suse.com/security/cve/CVE-2016-7128.html https://www.suse.com/security/cve/CVE-2016-7129.html https://www.suse.com/security/cve/CVE-2016-7130.html https://www.suse.com/security/cve/CVE-2016-7131.html https://www.suse.com/security/cve/CVE-2016-7132.html https://www.suse.com/security/cve/CVE-2016-7411.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/997206 https://bugzilla.suse.com/997207 https://bugzilla.suse.com/997208 https://bugzilla.suse.com/997210 https://bugzilla.suse.com/997211 https://bugzilla.suse.com/997220 https://bugzilla.suse.com/997225 https://bugzilla.suse.com/997230 https://bugzilla.suse.com/997257 https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999682 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2458-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 Oct '16

05 Oct '16

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2458-1 Rating: important References: #979475 #982575 #983249 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: SUSE Studio Onsite 1.3 SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * Update expired S/MIME certs (bsc#979475) * Fix crash in print_notice (bsc#998190) * Resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-openssl-12774=1 - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-openssl-12774=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-openssl-12774=1 - SUSE Manager 2.1: zypper in -t patch sleman21-openssl-12774=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-openssl-12774=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openssl-12774=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-openssl-12774=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-openssl-12774=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-openssl-12774=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssl-12774=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssl-12774=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-openssl-12774=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): libopenssl-devel-0.9.8j-0.102.2 - SUSE OpenStack Cloud 5 (x86_64): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Manager Proxy 2.1 (x86_64): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Manager 2.1 (s390x x86_64): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.102.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libopenssl-devel-32bit-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP4 (ia64): libopenssl0_9_8-x86-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.102.2 libopenssl0_9_8-hmac-32bit-0.9.8j-0.102.2 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): libopenssl-devel-0.9.8j-0.102.2 libopenssl0_9_8-0.9.8j-0.102.2 libopenssl0_9_8-hmac-0.9.8j-0.102.2 openssl-0.9.8j-0.102.2 openssl-doc-0.9.8j-0.102.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssl-debuginfo-0.9.8j-0.102.2 openssl-debugsource-0.9.8j-0.102.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): openssl-debuginfo-0.9.8j-0.102.2 openssl-debugsource-0.9.8j-0.102.2 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): openssl-debuginfo-0.9.8j-0.102.2 openssl-debugsource-0.9.8j-0.102.2 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0