November 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:2866-1: important: Security update for php5
by opensuse-security＠opensuse.org 21 Nov '16

21 Nov '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2866-1 Rating: important References: #1008029 Cross-References: CVE-2016-9137 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: * CVE-2016-9137: Fixed a use after free in unserialize() in curl file deserialization [boo#1008029] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1338=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-86.1 apache2-mod_php5-debuginfo-5.6.1-86.1 php5-5.6.1-86.1 php5-bcmath-5.6.1-86.1 php5-bcmath-debuginfo-5.6.1-86.1 php5-bz2-5.6.1-86.1 php5-bz2-debuginfo-5.6.1-86.1 php5-calendar-5.6.1-86.1 php5-calendar-debuginfo-5.6.1-86.1 php5-ctype-5.6.1-86.1 php5-ctype-debuginfo-5.6.1-86.1 php5-curl-5.6.1-86.1 php5-curl-debuginfo-5.6.1-86.1 php5-dba-5.6.1-86.1 php5-dba-debuginfo-5.6.1-86.1 php5-debuginfo-5.6.1-86.1 php5-debugsource-5.6.1-86.1 php5-devel-5.6.1-86.1 php5-dom-5.6.1-86.1 php5-dom-debuginfo-5.6.1-86.1 php5-enchant-5.6.1-86.1 php5-enchant-debuginfo-5.6.1-86.1 php5-exif-5.6.1-86.1 php5-exif-debuginfo-5.6.1-86.1 php5-fastcgi-5.6.1-86.1 php5-fastcgi-debuginfo-5.6.1-86.1 php5-fileinfo-5.6.1-86.1 php5-fileinfo-debuginfo-5.6.1-86.1 php5-firebird-5.6.1-86.1 php5-firebird-debuginfo-5.6.1-86.1 php5-fpm-5.6.1-86.1 php5-fpm-debuginfo-5.6.1-86.1 php5-ftp-5.6.1-86.1 php5-ftp-debuginfo-5.6.1-86.1 php5-gd-5.6.1-86.1 php5-gd-debuginfo-5.6.1-86.1 php5-gettext-5.6.1-86.1 php5-gettext-debuginfo-5.6.1-86.1 php5-gmp-5.6.1-86.1 php5-gmp-debuginfo-5.6.1-86.1 php5-iconv-5.6.1-86.1 php5-iconv-debuginfo-5.6.1-86.1 php5-imap-5.6.1-86.1 php5-imap-debuginfo-5.6.1-86.1 php5-intl-5.6.1-86.1 php5-intl-debuginfo-5.6.1-86.1 php5-json-5.6.1-86.1 php5-json-debuginfo-5.6.1-86.1 php5-ldap-5.6.1-86.1 php5-ldap-debuginfo-5.6.1-86.1 php5-mbstring-5.6.1-86.1 php5-mbstring-debuginfo-5.6.1-86.1 php5-mcrypt-5.6.1-86.1 php5-mcrypt-debuginfo-5.6.1-86.1 php5-mssql-5.6.1-86.1 php5-mssql-debuginfo-5.6.1-86.1 php5-mysql-5.6.1-86.1 php5-mysql-debuginfo-5.6.1-86.1 php5-odbc-5.6.1-86.1 php5-odbc-debuginfo-5.6.1-86.1 php5-opcache-5.6.1-86.1 php5-opcache-debuginfo-5.6.1-86.1 php5-openssl-5.6.1-86.1 php5-openssl-debuginfo-5.6.1-86.1 php5-pcntl-5.6.1-86.1 php5-pcntl-debuginfo-5.6.1-86.1 php5-pdo-5.6.1-86.1 php5-pdo-debuginfo-5.6.1-86.1 php5-pgsql-5.6.1-86.1 php5-pgsql-debuginfo-5.6.1-86.1 php5-phar-5.6.1-86.1 php5-phar-debuginfo-5.6.1-86.1 php5-posix-5.6.1-86.1 php5-posix-debuginfo-5.6.1-86.1 php5-pspell-5.6.1-86.1 php5-pspell-debuginfo-5.6.1-86.1 php5-readline-5.6.1-86.1 php5-readline-debuginfo-5.6.1-86.1 php5-shmop-5.6.1-86.1 php5-shmop-debuginfo-5.6.1-86.1 php5-snmp-5.6.1-86.1 php5-snmp-debuginfo-5.6.1-86.1 php5-soap-5.6.1-86.1 php5-soap-debuginfo-5.6.1-86.1 php5-sockets-5.6.1-86.1 php5-sockets-debuginfo-5.6.1-86.1 php5-sqlite-5.6.1-86.1 php5-sqlite-debuginfo-5.6.1-86.1 php5-suhosin-5.6.1-86.1 php5-suhosin-debuginfo-5.6.1-86.1 php5-sysvmsg-5.6.1-86.1 php5-sysvmsg-debuginfo-5.6.1-86.1 php5-sysvsem-5.6.1-86.1 php5-sysvsem-debuginfo-5.6.1-86.1 php5-sysvshm-5.6.1-86.1 php5-sysvshm-debuginfo-5.6.1-86.1 php5-tidy-5.6.1-86.1 php5-tidy-debuginfo-5.6.1-86.1 php5-tokenizer-5.6.1-86.1 php5-tokenizer-debuginfo-5.6.1-86.1 php5-wddx-5.6.1-86.1 php5-wddx-debuginfo-5.6.1-86.1 php5-xmlreader-5.6.1-86.1 php5-xmlreader-debuginfo-5.6.1-86.1 php5-xmlrpc-5.6.1-86.1 php5-xmlrpc-debuginfo-5.6.1-86.1 php5-xmlwriter-5.6.1-86.1 php5-xmlwriter-debuginfo-5.6.1-86.1 php5-xsl-5.6.1-86.1 php5-xsl-debuginfo-5.6.1-86.1 php5-zip-5.6.1-86.1 php5-zip-debuginfo-5.6.1-86.1 php5-zlib-5.6.1-86.1 php5-zlib-debuginfo-5.6.1-86.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-86.1 References: https://www.suse.com/security/cve/CVE-2016-9137.html https://bugzilla.suse.com/1008029 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2862-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 19 Nov '16

19 Nov '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2862-1 Rating: important References: #1005522 #1005523 #1005524 #1005525 #1005526 #1005527 #1005528 #988651 Cross-References: CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5582 CVE-2016-5597 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: OpenJDK java-1_8_0-openjdk was updated to jdk8u111 (icedtea 3.2.0) to fix the following issues: * Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks (boo#1005522) + S8156794: Extend data sharing + S8157176: Improved classfile parsing + S8157739, CVE-2016-5554: Classloader Consistency Checking (boo#1005523) + S8157749: Improve handling of DNS error replies + S8157753: Audio replay enhancement + S8157759: LCMS Transform Sampling Enhancement + S8157764: Better handling of interpolation plugins + S8158302: Handle contextual glyph substitutions + S8158993, CVE-2016-5568: Service Menu services (boo#1005525) + S8159495: Fix index offsets + S8159503: Amend Annotation Actions + S8159511: Stack map validation + S8159515: Improve indy validation + S8159519, CVE-2016-5573: Reformat JDWP messages (boo#1005526) + S8160090: Better signature handling in pack200 + S8160094: Improve pack200 layout + S8160098: Clean up color profiles + S8160591, CVE-2016-5582: Improve internal array handling (boo#1005527) + S8160838, CVE-2016-5597: Better HTTP service (boo#1005528) + PR3206, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read() + CVE-2016-5556 (boo#1005524) * New features + PR1370: Provide option to build without debugging + PR1375: Provide option to strip and link debugging info after build + PR1537: Handle alternative Kerberos credential cache locations + PR1978: Allow use of system PCSC + PR2445: Support system libsctp + PR3182: Support building without pre-compiled headers + PR3183: Support Fedora/RHEL system crypto policy + PR3221: Use pkgconfig to detect Kerberos CFLAGS and libraries * Import of OpenJDK 8 u102 build 14 + S4515292: ReferenceType.isStatic() returns true for arrays + S4858370: JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command + S6976636: JVM/TI test ex03t001 fails assertion + S7185591: jcmd-big-script.sh ERROR: could not find app's Java pid. + S8017462: G1: guarantee fails with UseDynamicNumberOfGCThreads + S8034168: ThreadMXBean/Locks.java failed, blocked on wrong object + S8036006: [TESTBUG] sun/tools/native2ascii/NativeErrors.java fails: Process exit code was 0, but error was expected. + S8041781: Need new regression tests for PBE keys + S8041787: Need new regressions tests for buffer handling for PBE algorithms + S8043836: Need new tests for AES cipher + S8044199: Tests for RSA keys and key specifications + S8044772: TempDirTest.java still times out with -Xcomp + S8046339: sun.rmi.transport.DGCAckHandler leaks memory + S8047031: Add SocketPermission tests for legacy socket types + S8048052: Permission tests for setFactory + S8048138: Tests for JAAS callbacks + S8048147: Privilege tests with JAAS Subject.doAs + S8048356: SecureRandom default provider tests + S8048357: PKCS basic tests + S8048360: Test signed jar files + S8048362: Tests for doPrivileged with accomplice + S8048596: Tests for AEAD ciphers + S8048599: Tests for key wrap and unwrap operations + S8048603: Additional tests for MAC algorithms + S8048604: Tests for strong crypto ciphers + S8048607: Test key generation of DES and DESEDE + S8048610: Implement regression test for bug fix of 4686632 in JCE + S8048617: Tests for PKCS12 read operations + S8048618: Tests for PKCS12 write operations. + S8048619: Implement tests for converting PKCS12 keystores + S8048624: Tests for SealedObject + S8048819: Implement reliability test for DH algorithm + S8048820: Implement tests for SecretKeyFactory + S8048830: Implement tests for new functionality provided in JEP 166 + S8049237: Need new tests for X509V3 certificates + S8049321: Support SHA256WithDSA in JSSE + S8049429: Tests for java client server communications with various TLS/SSL combinations. + S8049432: New tests for TLS property jdk.tls.client.protocols + S8049814: Additional SASL client-server tests + S8050281: New permission tests for JEP 140 + S8050370: Need new regressions tests for messageDigest with DigestIOStream + S8050371: More MessageDigest tests + S8050374: More Signature tests + S8050427: LoginContext tests to cover JDK-4703361 + S8050460: JAAS login/logout tests with LoginContext + S8050461: Tests for syntax checking of JAAS configuration file + S8054278: Refactor jps utility tests + S8055530: assert(_exits.control()->is_top() || !_gvn.type(ret_phi)->empty()) failed: return value must be well defined + S8055844: [TESTBUG] test/runtime/NMT/VirtualAllocCommitUncommitRecommit.java fails on Solaris Sparc due to incorrect page size being used + S8059677: Thread.getName() instantiates Strings + S8061464: A typo in CipherTestUtils test + S8062536: [TESTBUG] Conflicting GC combinations in jdk tests + S8065076: java/net/SocketPermission/SocketPermissionTest.java fails intermittently + S8065078: NetworkInterface.getNetworkInterfaces() triggers intermittent test failures + S8066871: java.lang.VerifyError: Bad local variable type - local final String + S8068427: Hashtable deserialization reconstitutes table with wrong capacity + S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java needs to be updated for JDK-8061210 + S8069253: javax/net/ssl/TLS/TestJSSE.java failed on Mac + S8071125: Improve exception messages in URLPermission + S8072081: Supplementary characters are rejected in comments + S8072463: Remove requirement that AKID and SKID have to match when building certificate chain + S8072725: Provide more granular levels for GC verification + S8073400: Some Monospaced logical fonts have a different width + S8073872: Schemagen fails with StackOverflowError if element references containing class + S8074931: Additional tests for CertPath API + S8075286: Additional tests for signature algorithm OIDs and transformation string + S8076486: [TESTBUG] javax/security/auth/Subject/doAs/NestedActions.java fails if extra VM options are given + S8076545: Text size is twice bigger under Windows L&F on Win 8.1 with HiDPI display + S8076995: gc/ergonomics/TestDynamicNumberOfGCThreads.java failed with java.lang.RuntimeException: 'new_active_workers' missing from stdout/stderr + S8079138: Additional negative tests for XML signature processing + S8081512: Remove sun.invoke.anon classes, or move / co-locate them with tests + S8081771: ProcessTool.createJavaProcessBuilder() needs new addTestVmAndJavaOptions argument + S8129419: heapDumper.cpp: assert(length_in_bytes > 0) failed: nothing to copy + S8130150: Implement BigInteger.montgomeryMultiply intrinsic + S8130242: DataFlavorComparator transitivity exception + S8130304: Inference: NodeNotFoundException thrown with deep generic method call chain + S8130425: libjvm crash due to stack overflow in executables with 32k tbss/tdata + S8133023: ParallelGCThreads is not calculated correctly + S8134111: Unmarshaller unmarshalls XML element which doesn't have the expected namespace + S8135259: InetAddress.getAllByName only reports "unknown error" instead of actual cause + S8136506: Include sun.arch.data.model as a property that can be queried by jtreg + S8137068: Tests added in JDK-8048604 fail to compile + S8139040: Fix initializations before ShouldNotReachHere() etc. and enable -Wuninitialized on linux. + S8139581: AWT components are not drawn after removal and addition to a container + S8141243: Unexpected timezone returned after parsing a date + S8141420: Compiler runtime entries don't hold Klass* from being GCed + S8141445: Use of Solaris/SPARC M7 libadimalloc.so can generate unknown signal in hs_err file + S8141551: C2 can not handle returns with inccompatible interface arrays + S8143377: Test PKCS8Test.java fails + S8143647: Javac compiles method reference that allows results in an IllegalAccessError + S8144144: ORB destroy() leaks filedescriptors after unsuccessful connection + S8144593: Suppress not recognized property/feature warning messages from SAXParser + S8144957: Remove PICL warning message + S8145039: JAXB marshaller fails with ClassCastException on classes generated by xjc + S8145228: Java Access Bridge, getAccessibleStatesStringFromContext doesn't wrap the call to getAccessibleRole + S8145388: URLConnection.guessContentTypeFromStream returns image/jpg for some JPEG images + S8145974: XMLStreamWriter produces invalid XML for surrogate pairs on OutputStreamWriter + S8146035: Windows - With LCD antialiasing, some glyphs are not rendered correctly + S8146192: Add test for JDK-8049321 + S8146274: Thread spinning on WeakHashMap.getEntry() with concurrent use of nashorn + S8147468: Allow users to bound the size of buffers cached in the per-thread buffer caches + S8147645: get_ctrl_no_update() code is wrong + S8147807: crash in libkcms.so on linux-sparc + S8148379: jdk.nashorn.api.scripting spec. adjustments, clarifications + S8148627: RestrictTestMaxCachedBufferSize.java to 64-bit platforms + S8148820: Missing @since Javadoc tag in Logger.log(Level, Supplier) + S8148926: Call site profiling fails on braces-wrapped anonymous function + S8149017: Delayed provider selection broken in RSA client key exchange + S8149029: Secure validation of XML based digital signature always enabled when checking wrapping attacks + S8149330: Capacity of StringBuilder should not get close to Integer.MAX_VALUE unless necessary + S8149334: JSON.parse(JSON.stringify([])).push(10) creates an array containing two elements + S8149368: [hidpi] JLabel font is twice bigger than JTextArea font on Windows 7,HiDPI, Windows L&F + S8149411: PKCS12KeyStore cannot extract AES Secret Keys + S8149417: Use final restricted flag + S8149450: LdapCtx.processReturnCode() throwing Null Pointer Exception + S8149453: [hidpi] JFileChooser does not scale properly on Windows with HiDPI display and Windows L&F + S8149543: range check CastII nodes should not be split through Phi + S8149743: JVM crash after debugger hotswap with lambdas + S8149744: fix testng.jar delivery in Nashorn build.xml + S8149915: enabling validate-annotations feature for xsd schema with annotation causes NPE + S8150002: Check for the validity of oop before printing it in verify_remembered_set + S8150470: JCK: api/xsl/conf/copy/copy19 test failure + S8150518: G1 GC crashes at G1CollectedHeap::do_collection_pause_at_safepoint(double) + S8150533: Test java/util/logging/LogManagerAppContextDeadlock.java times out intermittently. + S8150704: XALAN: ERROR: 'No more DTM IDs are available' when transforming with lots of temporary result trees + S8150780: Repeated offer and remove on ConcurrentLinkedQueue lead to an OutOfMemoryError + S8151064: com/sun/jdi/RedefineAddPrivateMethod.sh fails intermittently + S8151197: [TEST_BUG] Need to backport fix for test/javax/net/ssl/TLS/TestJSSE.java + S8151352: jdk/test/sample fails with "effective library path is outside the test suite" + S8151431: DateFormatSymbols triggers this.clone() in the constructor + S8151535: TESTBUG: java/lang/invoke/AccessControlTest.java should be modified to run with JTREG 4.1 b13 + S8151731: Add new jtreg keywords to jdk 8 + S8151998: VS2010 ThemeReader.cpp(758) : error C3861: 'round': identifier not found + S8152927: Incorrect GPL header in StubFactoryDynamicBase.java reported + S8153252: SA: Hotspot build on Windows fails if make/closed folder does not exist + S8153531: Improve exception messaging for RSAClientKeyExchange + S8153641: assert(thread_state == _thread_in_native) failed: Assumed thread_in_native while heap dump + S8153673: [BACKOUT] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command + S8154304: NullpointerException at LdapReferralException.getReferralContext + S8154722: Test gc/ergonomics/TestDynamicNumberOfGCThreads.java fails + S8157078: 8u102 L10n resource file updates + S8157838: Personalized Windows Font Size is not taken into account in Java8u102 * Import of OpenJDK 8 u111 build 14 + S6882559: new JEditorPane("text/plain","") fails for null context class loader + S8049171: Additional tests for jarsigner's warnings + S8063086: Math.pow yields different results upon repeated calls + S8140530: Creating a VolatileImage with size 0,0 results in no longer working g2d.drawString + S8142926: OutputAnalyzer's shouldXXX() calls return this + S8147077: IllegalArgumentException thrown by api/java_awt/Component/FlipBufferStrategy/indexTGF_General + S8148127: IllegalArgumentException thrown by JCK test api/java_awt/Component/FlipBufferStrategy/indexTGF_General in opengl pipeline + S8150611: Security problem on sun.misc.resources.Messages* + S8153399: Constrain AppCDS behavior (back port) + S8157653: [Parfait] Uninitialised variable in awt_Font.cpp + S8158734: JEditorPane.createEditorKitForContentType throws NPE after 6882559 + S8158994: Service Menu services + S8159684: (tz) Support tzdata2016f + S8160904: Typo in code from 8079718 fix : enableCustomValueHanlde + S8160934: isnan() is not available on older MSVC compilers + S8161141: correct bugId for JDK-8158994 fix push + S8162411: Service Menu services 2 + S8162419: closed/com/oracle/jfr/runtime/TestVMInfoEvent.sh failing after JDK-8155968 + S8162511: 8u111 L10n resource file updates + S8162792: Remove constraint DSA keySize < 1024 from jdk.jar.disabledAlgorithms in jdk8 + S8164452: 8u111 L10n resource file update - msgdrop 20 + S8165816: jarsigner -verify shows jar unsigned if it was signed with a weak algorithm + S8166381: Back out changes to the java.security file to not disable MD5 * Backports + S8078628, PR3208: Zero build fails with pre-compiled headers disabled + S8141491, PR3159, G592292: Unaligned memory access in Bits.c + S8157306, PR3121: Random infrequent null pointer exceptions in javac (enabled on AArch64 only) + S8162384, PR3122: Performance regression: bimorphic inlining may be bypassed by type speculation * Bug fixes + PR3123: Some object files built without -fPIC on x86 only + PR3126: pax-mark-vm script calls "exit -1" which is invalid in dash + PR3127, G590348: Only apply PaX markings by default on running PaX kernels + PR3199: Invalid nashorn URL + PR3201: Update infinality configure test + PR3218: PR3159 leads to build failure on clean tree * AArch64 port + S8131779, PR3220: AARCH64: add Montgomery multiply intrinsic + S8167200, PR3220: AArch64: Broken stack pointer adjustment in interpreter + S8167421, PR3220: AArch64: in one core system, fatal error: Illegal threadstate encountered + S8167595, PR3220: AArch64: SEGV in stub code cipherBlockChaining_decryptAESCrypt + S8168888, PR3220: Port 8160591: Improve internal array handling to AArch64. * Shenandoah + PR3224: Shenandoah broken when building without pre-compiled headers - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (boo#988651) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1335=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.111-33.1 java-1_8_0-openjdk-accessibility-1.8.0.111-33.1 java-1_8_0-openjdk-debuginfo-1.8.0.111-33.1 java-1_8_0-openjdk-debugsource-1.8.0.111-33.1 java-1_8_0-openjdk-demo-1.8.0.111-33.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.111-33.1 java-1_8_0-openjdk-devel-1.8.0.111-33.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.111-33.1 java-1_8_0-openjdk-headless-1.8.0.111-33.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.111-33.1 java-1_8_0-openjdk-src-1.8.0.111-33.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.111-33.1 References: https://www.suse.com/security/cve/CVE-2016-5542.html https://www.suse.com/security/cve/CVE-2016-5554.html https://www.suse.com/security/cve/CVE-2016-5556.html https://www.suse.com/security/cve/CVE-2016-5568.html https://www.suse.com/security/cve/CVE-2016-5573.html https://www.suse.com/security/cve/CVE-2016-5582.html https://www.suse.com/security/cve/CVE-2016-5597.html https://bugzilla.suse.com/1005522 https://bugzilla.suse.com/1005523 https://bugzilla.suse.com/1005524 https://bugzilla.suse.com/1005525 https://bugzilla.suse.com/1005526 https://bugzilla.suse.com/1005527 https://bugzilla.suse.com/1005528 https://bugzilla.suse.com/988651 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2861-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 18 Nov '16

18 Nov '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2861-1 Rating: important References: #1009026 #1010395 #1010399 #1010401 #1010402 #1010404 #1010405 #1010406 #1010408 #1010409 #1010410 #1010420 #1010421 #1010422 #1010423 #1010424 #1010425 #1010426 #1010427 Cross-References: CVE-2016-5289 CVE-2016-5290 CVE-2016-5291 CVE-2016-5292 CVE-2016-5296 CVE-2016-5297 CVE-2016-9063 CVE-2016-9064 CVE-2016-9066 CVE-2016-9067 CVE-2016-9068 CVE-2016-9069 CVE-2016-9070 CVE-2016-9071 CVE-2016-9073 CVE-2016-9074 CVE-2016-9075 CVE-2016-9076 CVE-2016-9077 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update to Mozilla Firefox 50.0 fixes a number of security issues. The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89): - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bmo#1292443) - CVE-2016-5292: URL parsing causes crash (bmo#1288482) - CVE-2016-5297: Incorrect argument length checking in Javascript (bmo#1303678) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bmo#1303418) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bmo#1299686) - CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922 (CVE-2016-9069)) - CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973) - CVE-2016-9075: WebExtensions can access the mozAddonManager API and use it to gain elevated privileges (bmo#1295324) - CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to cross-origin images, allowing timing attacks on them (bmo#1298552) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bmo#1292159) - CVE-2016-9070: Sidebar bookmark can have reference to chrome window (bmo#1281071) - CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl" (bmo#1289273) - CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on e10s (bmo#1276976) - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in expat (bmo#1274777) - CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP (bmo#1285003) - CVE-2016-5289: Memory safety bugs fixed in Firefox 50 - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 The following vulnerabilities were fixed in Mozilla NSS 3.26.1: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bmo#1293334) Mozilla Firefox now requires mozilla-nss 3.26.2. New features in Mozilla Firefox: - Updates to keyboard shortcuts Set a preference to have Ctrl+Tab cycle through tabs in recently used order View a page in Reader Mode by using Ctrl+Alt+R - Added option to Find in page that allows users to limit search to whole words only - Added download protection for a large number of executable file types on Windows, Mac and Linux - Fixed rendering of dashed and dotted borders with rounded corners (border-radius) - Added a built-in Emoji set for operating systems without native Emoji fonts - Blocked versions of libavcodec older than 54.35.1 - additional locale mozilla-nss was updated to 3.26.2, incorporating the following changes: - the selfserv test utility has been enhanced to support ALPN (HTTP/1.1) and 0-RTT - The following CA certificate was added: CN = ISRG Root X1 - NPN is disabled and ALPN is enabled by default - MD5 signature algorithms sent by the server in CertificateRequest messages are now properly ignored Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1334=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1334=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1334=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-50.0-39.2 MozillaFirefox-branding-upstream-50.0-39.2 MozillaFirefox-buildsymbols-50.0-39.2 MozillaFirefox-debuginfo-50.0-39.2 MozillaFirefox-debugsource-50.0-39.2 MozillaFirefox-devel-50.0-39.2 MozillaFirefox-translations-common-50.0-39.2 MozillaFirefox-translations-other-50.0-39.2 libfreebl3-3.26.2-32.1 libfreebl3-debuginfo-3.26.2-32.1 libsoftokn3-3.26.2-32.1 libsoftokn3-debuginfo-3.26.2-32.1 mozilla-nss-3.26.2-32.1 mozilla-nss-certs-3.26.2-32.1 mozilla-nss-certs-debuginfo-3.26.2-32.1 mozilla-nss-debuginfo-3.26.2-32.1 mozilla-nss-debugsource-3.26.2-32.1 mozilla-nss-devel-3.26.2-32.1 mozilla-nss-sysinit-3.26.2-32.1 mozilla-nss-sysinit-debuginfo-3.26.2-32.1 mozilla-nss-tools-3.26.2-32.1 mozilla-nss-tools-debuginfo-3.26.2-32.1 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.26.2-32.1 libfreebl3-debuginfo-32bit-3.26.2-32.1 libsoftokn3-32bit-3.26.2-32.1 libsoftokn3-debuginfo-32bit-3.26.2-32.1 mozilla-nss-32bit-3.26.2-32.1 mozilla-nss-certs-32bit-3.26.2-32.1 mozilla-nss-certs-debuginfo-32bit-3.26.2-32.1 mozilla-nss-debuginfo-32bit-3.26.2-32.1 mozilla-nss-sysinit-32bit-3.26.2-32.1 mozilla-nss-sysinit-debuginfo-32bit-3.26.2-32.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-50.0-39.1 MozillaFirefox-branding-upstream-50.0-39.1 MozillaFirefox-buildsymbols-50.0-39.1 MozillaFirefox-debuginfo-50.0-39.1 MozillaFirefox-debugsource-50.0-39.1 MozillaFirefox-devel-50.0-39.1 MozillaFirefox-translations-common-50.0-39.1 MozillaFirefox-translations-other-50.0-39.1 libfreebl3-3.26.2-32.1 libfreebl3-debuginfo-3.26.2-32.1 libsoftokn3-3.26.2-32.1 libsoftokn3-debuginfo-3.26.2-32.1 mozilla-nss-3.26.2-32.1 mozilla-nss-certs-3.26.2-32.1 mozilla-nss-certs-debuginfo-3.26.2-32.1 mozilla-nss-debuginfo-3.26.2-32.1 mozilla-nss-debugsource-3.26.2-32.1 mozilla-nss-devel-3.26.2-32.1 mozilla-nss-sysinit-3.26.2-32.1 mozilla-nss-sysinit-debuginfo-3.26.2-32.1 mozilla-nss-tools-3.26.2-32.1 mozilla-nss-tools-debuginfo-3.26.2-32.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.26.2-32.1 libfreebl3-debuginfo-32bit-3.26.2-32.1 libsoftokn3-32bit-3.26.2-32.1 libsoftokn3-debuginfo-32bit-3.26.2-32.1 mozilla-nss-32bit-3.26.2-32.1 mozilla-nss-certs-32bit-3.26.2-32.1 mozilla-nss-certs-debuginfo-32bit-3.26.2-32.1 mozilla-nss-debuginfo-32bit-3.26.2-32.1 mozilla-nss-sysinit-32bit-3.26.2-32.1 mozilla-nss-sysinit-debuginfo-32bit-3.26.2-32.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-50.0-88.1 MozillaFirefox-branding-upstream-50.0-88.1 MozillaFirefox-buildsymbols-50.0-88.1 MozillaFirefox-debuginfo-50.0-88.1 MozillaFirefox-debugsource-50.0-88.1 MozillaFirefox-devel-50.0-88.1 MozillaFirefox-translations-common-50.0-88.1 MozillaFirefox-translations-other-50.0-88.1 libfreebl3-3.26.2-49.1 libfreebl3-debuginfo-3.26.2-49.1 libsoftokn3-3.26.2-49.1 libsoftokn3-debuginfo-3.26.2-49.1 mozilla-nss-3.26.2-49.1 mozilla-nss-certs-3.26.2-49.1 mozilla-nss-certs-debuginfo-3.26.2-49.1 mozilla-nss-debuginfo-3.26.2-49.1 mozilla-nss-debugsource-3.26.2-49.1 mozilla-nss-devel-3.26.2-49.1 mozilla-nss-sysinit-3.26.2-49.1 mozilla-nss-sysinit-debuginfo-3.26.2-49.1 mozilla-nss-tools-3.26.2-49.1 mozilla-nss-tools-debuginfo-3.26.2-49.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.26.2-49.1 libfreebl3-debuginfo-32bit-3.26.2-49.1 libsoftokn3-32bit-3.26.2-49.1 libsoftokn3-debuginfo-32bit-3.26.2-49.1 mozilla-nss-32bit-3.26.2-49.1 mozilla-nss-certs-32bit-3.26.2-49.1 mozilla-nss-certs-debuginfo-32bit-3.26.2-49.1 mozilla-nss-debuginfo-32bit-3.26.2-49.1 mozilla-nss-sysinit-32bit-3.26.2-49.1 mozilla-nss-sysinit-debuginfo-32bit-3.26.2-49.1 References: https://www.suse.com/security/cve/CVE-2016-5289.html https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5292.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-9063.html https://www.suse.com/security/cve/CVE-2016-9064.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9067.html https://www.suse.com/security/cve/CVE-2016-9068.html https://www.suse.com/security/cve/CVE-2016-9069.html https://www.suse.com/security/cve/CVE-2016-9070.html https://www.suse.com/security/cve/CVE-2016-9071.html https://www.suse.com/security/cve/CVE-2016-9073.html https://www.suse.com/security/cve/CVE-2016-9074.html https://www.suse.com/security/cve/CVE-2016-9075.html https://www.suse.com/security/cve/CVE-2016-9076.html https://www.suse.com/security/cve/CVE-2016-9077.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010395 https://bugzilla.suse.com/1010399 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010402 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010405 https://bugzilla.suse.com/1010406 https://bugzilla.suse.com/1010408 https://bugzilla.suse.com/1010409 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010420 https://bugzilla.suse.com/1010421 https://bugzilla.suse.com/1010422 https://bugzilla.suse.com/1010423 https://bugzilla.suse.com/1010424 https://bugzilla.suse.com/1010425 https://bugzilla.suse.com/1010426 https://bugzilla.suse.com/1010427 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2837-1: important: Security update for php5
by opensuse-security＠opensuse.org 17 Nov '16

17 Nov '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2837-1 Rating: important References: #1001900 #1004924 #1005274 Cross-References: CVE-2016-6911 CVE-2016-7568 CVE-2016-8670 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900) - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1308=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php5-5.5.14-65.1 apache2-mod_php5-debuginfo-5.5.14-65.1 php5-5.5.14-65.1 php5-bcmath-5.5.14-65.1 php5-bcmath-debuginfo-5.5.14-65.1 php5-bz2-5.5.14-65.1 php5-bz2-debuginfo-5.5.14-65.1 php5-calendar-5.5.14-65.1 php5-calendar-debuginfo-5.5.14-65.1 php5-ctype-5.5.14-65.1 php5-ctype-debuginfo-5.5.14-65.1 php5-curl-5.5.14-65.1 php5-curl-debuginfo-5.5.14-65.1 php5-dba-5.5.14-65.1 php5-dba-debuginfo-5.5.14-65.1 php5-debuginfo-5.5.14-65.1 php5-debugsource-5.5.14-65.1 php5-devel-5.5.14-65.1 php5-dom-5.5.14-65.1 php5-dom-debuginfo-5.5.14-65.1 php5-enchant-5.5.14-65.1 php5-enchant-debuginfo-5.5.14-65.1 php5-exif-5.5.14-65.1 php5-exif-debuginfo-5.5.14-65.1 php5-fastcgi-5.5.14-65.1 php5-fastcgi-debuginfo-5.5.14-65.1 php5-fileinfo-5.5.14-65.1 php5-fileinfo-debuginfo-5.5.14-65.1 php5-firebird-5.5.14-65.1 php5-firebird-debuginfo-5.5.14-65.1 php5-fpm-5.5.14-65.1 php5-fpm-debuginfo-5.5.14-65.1 php5-ftp-5.5.14-65.1 php5-ftp-debuginfo-5.5.14-65.1 php5-gd-5.5.14-65.1 php5-gd-debuginfo-5.5.14-65.1 php5-gettext-5.5.14-65.1 php5-gettext-debuginfo-5.5.14-65.1 php5-gmp-5.5.14-65.1 php5-gmp-debuginfo-5.5.14-65.1 php5-iconv-5.5.14-65.1 php5-iconv-debuginfo-5.5.14-65.1 php5-imap-5.5.14-65.1 php5-imap-debuginfo-5.5.14-65.1 php5-intl-5.5.14-65.1 php5-intl-debuginfo-5.5.14-65.1 php5-json-5.5.14-65.1 php5-json-debuginfo-5.5.14-65.1 php5-ldap-5.5.14-65.1 php5-ldap-debuginfo-5.5.14-65.1 php5-mbstring-5.5.14-65.1 php5-mbstring-debuginfo-5.5.14-65.1 php5-mcrypt-5.5.14-65.1 php5-mcrypt-debuginfo-5.5.14-65.1 php5-mssql-5.5.14-65.1 php5-mssql-debuginfo-5.5.14-65.1 php5-mysql-5.5.14-65.1 php5-mysql-debuginfo-5.5.14-65.1 php5-odbc-5.5.14-65.1 php5-odbc-debuginfo-5.5.14-65.1 php5-opcache-5.5.14-65.1 php5-opcache-debuginfo-5.5.14-65.1 php5-openssl-5.5.14-65.1 php5-openssl-debuginfo-5.5.14-65.1 php5-pcntl-5.5.14-65.1 php5-pcntl-debuginfo-5.5.14-65.1 php5-pdo-5.5.14-65.1 php5-pdo-debuginfo-5.5.14-65.1 php5-pgsql-5.5.14-65.1 php5-pgsql-debuginfo-5.5.14-65.1 php5-phar-5.5.14-65.1 php5-phar-debuginfo-5.5.14-65.1 php5-posix-5.5.14-65.1 php5-posix-debuginfo-5.5.14-65.1 php5-pspell-5.5.14-65.1 php5-pspell-debuginfo-5.5.14-65.1 php5-readline-5.5.14-65.1 php5-readline-debuginfo-5.5.14-65.1 php5-shmop-5.5.14-65.1 php5-shmop-debuginfo-5.5.14-65.1 php5-snmp-5.5.14-65.1 php5-snmp-debuginfo-5.5.14-65.1 php5-soap-5.5.14-65.1 php5-soap-debuginfo-5.5.14-65.1 php5-sockets-5.5.14-65.1 php5-sockets-debuginfo-5.5.14-65.1 php5-sqlite-5.5.14-65.1 php5-sqlite-debuginfo-5.5.14-65.1 php5-suhosin-5.5.14-65.1 php5-suhosin-debuginfo-5.5.14-65.1 php5-sysvmsg-5.5.14-65.1 php5-sysvmsg-debuginfo-5.5.14-65.1 php5-sysvsem-5.5.14-65.1 php5-sysvsem-debuginfo-5.5.14-65.1 php5-sysvshm-5.5.14-65.1 php5-sysvshm-debuginfo-5.5.14-65.1 php5-tidy-5.5.14-65.1 php5-tidy-debuginfo-5.5.14-65.1 php5-tokenizer-5.5.14-65.1 php5-tokenizer-debuginfo-5.5.14-65.1 php5-wddx-5.5.14-65.1 php5-wddx-debuginfo-5.5.14-65.1 php5-xmlreader-5.5.14-65.1 php5-xmlreader-debuginfo-5.5.14-65.1 php5-xmlrpc-5.5.14-65.1 php5-xmlrpc-debuginfo-5.5.14-65.1 php5-xmlwriter-5.5.14-65.1 php5-xmlwriter-debuginfo-5.5.14-65.1 php5-xsl-5.5.14-65.1 php5-xsl-debuginfo-5.5.14-65.1 php5-zip-5.5.14-65.1 php5-zip-debuginfo-5.5.14-65.1 php5-zlib-5.5.14-65.1 php5-zlib-debuginfo-5.5.14-65.1 - openSUSE Leap 42.2 (noarch): php5-pear-5.5.14-65.1 References: https://www.suse.com/security/cve/CVE-2016-6911.html https://www.suse.com/security/cve/CVE-2016-7568.html https://www.suse.com/security/cve/CVE-2016-8670.html https://bugzilla.suse.com/1001900 https://bugzilla.suse.com/1004924 https://bugzilla.suse.com/1005274 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2831-1: important: Security update for php5
by opensuse-security＠opensuse.org 17 Nov '16

17 Nov '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2831-1 Rating: important References: #1001900 #1004924 #1005274 Cross-References: CVE-2016-6911 CVE-2016-7568 CVE-2016-8670 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900) - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1321=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-65.2 apache2-mod_php5-debuginfo-5.5.14-65.2 php5-5.5.14-65.2 php5-bcmath-5.5.14-65.2 php5-bcmath-debuginfo-5.5.14-65.2 php5-bz2-5.5.14-65.2 php5-bz2-debuginfo-5.5.14-65.2 php5-calendar-5.5.14-65.2 php5-calendar-debuginfo-5.5.14-65.2 php5-ctype-5.5.14-65.2 php5-ctype-debuginfo-5.5.14-65.2 php5-curl-5.5.14-65.2 php5-curl-debuginfo-5.5.14-65.2 php5-dba-5.5.14-65.2 php5-dba-debuginfo-5.5.14-65.2 php5-debuginfo-5.5.14-65.2 php5-debugsource-5.5.14-65.2 php5-devel-5.5.14-65.2 php5-dom-5.5.14-65.2 php5-dom-debuginfo-5.5.14-65.2 php5-enchant-5.5.14-65.2 php5-enchant-debuginfo-5.5.14-65.2 php5-exif-5.5.14-65.2 php5-exif-debuginfo-5.5.14-65.2 php5-fastcgi-5.5.14-65.2 php5-fastcgi-debuginfo-5.5.14-65.2 php5-fileinfo-5.5.14-65.2 php5-fileinfo-debuginfo-5.5.14-65.2 php5-firebird-5.5.14-65.2 php5-firebird-debuginfo-5.5.14-65.2 php5-fpm-5.5.14-65.2 php5-fpm-debuginfo-5.5.14-65.2 php5-ftp-5.5.14-65.2 php5-ftp-debuginfo-5.5.14-65.2 php5-gd-5.5.14-65.2 php5-gd-debuginfo-5.5.14-65.2 php5-gettext-5.5.14-65.2 php5-gettext-debuginfo-5.5.14-65.2 php5-gmp-5.5.14-65.2 php5-gmp-debuginfo-5.5.14-65.2 php5-iconv-5.5.14-65.2 php5-iconv-debuginfo-5.5.14-65.2 php5-imap-5.5.14-65.2 php5-imap-debuginfo-5.5.14-65.2 php5-intl-5.5.14-65.2 php5-intl-debuginfo-5.5.14-65.2 php5-json-5.5.14-65.2 php5-json-debuginfo-5.5.14-65.2 php5-ldap-5.5.14-65.2 php5-ldap-debuginfo-5.5.14-65.2 php5-mbstring-5.5.14-65.2 php5-mbstring-debuginfo-5.5.14-65.2 php5-mcrypt-5.5.14-65.2 php5-mcrypt-debuginfo-5.5.14-65.2 php5-mssql-5.5.14-65.2 php5-mssql-debuginfo-5.5.14-65.2 php5-mysql-5.5.14-65.2 php5-mysql-debuginfo-5.5.14-65.2 php5-odbc-5.5.14-65.2 php5-odbc-debuginfo-5.5.14-65.2 php5-opcache-5.5.14-65.2 php5-opcache-debuginfo-5.5.14-65.2 php5-openssl-5.5.14-65.2 php5-openssl-debuginfo-5.5.14-65.2 php5-pcntl-5.5.14-65.2 php5-pcntl-debuginfo-5.5.14-65.2 php5-pdo-5.5.14-65.2 php5-pdo-debuginfo-5.5.14-65.2 php5-pgsql-5.5.14-65.2 php5-pgsql-debuginfo-5.5.14-65.2 php5-phar-5.5.14-65.2 php5-phar-debuginfo-5.5.14-65.2 php5-posix-5.5.14-65.2 php5-posix-debuginfo-5.5.14-65.2 php5-pspell-5.5.14-65.2 php5-pspell-debuginfo-5.5.14-65.2 php5-readline-5.5.14-65.2 php5-readline-debuginfo-5.5.14-65.2 php5-shmop-5.5.14-65.2 php5-shmop-debuginfo-5.5.14-65.2 php5-snmp-5.5.14-65.2 php5-snmp-debuginfo-5.5.14-65.2 php5-soap-5.5.14-65.2 php5-soap-debuginfo-5.5.14-65.2 php5-sockets-5.5.14-65.2 php5-sockets-debuginfo-5.5.14-65.2 php5-sqlite-5.5.14-65.2 php5-sqlite-debuginfo-5.5.14-65.2 php5-suhosin-5.5.14-65.2 php5-suhosin-debuginfo-5.5.14-65.2 php5-sysvmsg-5.5.14-65.2 php5-sysvmsg-debuginfo-5.5.14-65.2 php5-sysvsem-5.5.14-65.2 php5-sysvsem-debuginfo-5.5.14-65.2 php5-sysvshm-5.5.14-65.2 php5-sysvshm-debuginfo-5.5.14-65.2 php5-tidy-5.5.14-65.2 php5-tidy-debuginfo-5.5.14-65.2 php5-tokenizer-5.5.14-65.2 php5-tokenizer-debuginfo-5.5.14-65.2 php5-wddx-5.5.14-65.2 php5-wddx-debuginfo-5.5.14-65.2 php5-xmlreader-5.5.14-65.2 php5-xmlreader-debuginfo-5.5.14-65.2 php5-xmlrpc-5.5.14-65.2 php5-xmlrpc-debuginfo-5.5.14-65.2 php5-xmlwriter-5.5.14-65.2 php5-xmlwriter-debuginfo-5.5.14-65.2 php5-xsl-5.5.14-65.2 php5-xsl-debuginfo-5.5.14-65.2 php5-zip-5.5.14-65.2 php5-zip-debuginfo-5.5.14-65.2 php5-zlib-5.5.14-65.2 php5-zlib-debuginfo-5.5.14-65.2 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-65.2 References: https://www.suse.com/security/cve/CVE-2016-6911.html https://www.suse.com/security/cve/CVE-2016-7568.html https://www.suse.com/security/cve/CVE-2016-8670.html https://bugzilla.suse.com/1001900 https://bugzilla.suse.com/1004924 https://bugzilla.suse.com/1005274 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2793-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 15 Nov '16

15 Nov '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2793-1 Rating: important References: #1009892 #1009893 #1009894 #1009895 Cross-References: CVE-2016-5199 CVE-2016-5200 CVE-2016-5201 CVE-2016-5202 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to Chromium 54.0.2840.100 fixes the following vulnerabilities: - CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892) - CVE-2016-5200: out of bounds memory access in v8 (boo#1009893) - CVE-2016-5201: info leak in extensions (boo#1009894) - CVE-2016-5202: various fixes from internal audits (boo#1009895) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1292=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1292=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1292=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-54.0.2840.100-91.1 chromedriver-debuginfo-54.0.2840.100-91.1 chromium-54.0.2840.100-91.1 chromium-debuginfo-54.0.2840.100-91.1 chromium-debugsource-54.0.2840.100-91.1 chromium-ffmpegsumo-54.0.2840.100-91.1 chromium-ffmpegsumo-debuginfo-54.0.2840.100-91.1 - openSUSE Leap 42.1 (x86_64): chromedriver-54.0.2840.100-91.1 chromedriver-debuginfo-54.0.2840.100-91.1 chromium-54.0.2840.100-91.1 chromium-debuginfo-54.0.2840.100-91.1 chromium-debugsource-54.0.2840.100-91.1 chromium-ffmpegsumo-54.0.2840.100-91.1 chromium-ffmpegsumo-debuginfo-54.0.2840.100-91.1 - openSUSE 13.2 (i586 x86_64): chromedriver-54.0.2840.100-140.1 chromedriver-debuginfo-54.0.2840.100-140.1 chromium-54.0.2840.100-140.1 chromium-debuginfo-54.0.2840.100-140.1 chromium-debugsource-54.0.2840.100-140.1 chromium-ffmpegsumo-54.0.2840.100-140.1 chromium-ffmpegsumo-debuginfo-54.0.2840.100-140.1 References: https://www.suse.com/security/cve/CVE-2016-5199.html https://www.suse.com/security/cve/CVE-2016-5200.html https://www.suse.com/security/cve/CVE-2016-5201.html https://www.suse.com/security/cve/CVE-2016-5202.html https://bugzilla.suse.com/1009892 https://bugzilla.suse.com/1009893 https://bugzilla.suse.com/1009894 https://bugzilla.suse.com/1009895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2792-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 15 Nov '16

15 Nov '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2792-1 Rating: important References: #1009892 #1009893 #1009894 #1009895 Cross-References: CVE-2016-5199 CVE-2016-5200 CVE-2016-5201 CVE-2016-5202 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to Chromium 54.0.2840.100 fixes the following vulnerabilities: - CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892) - CVE-2016-5200: out of bounds memory access in v8 (boo#1009893) - CVE-2016-5201: info leak in extensions (boo#1009894) - CVE-2016-5202: various fixes from internal audits (boo#1009895) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1292=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-54.0.2840.100-118.1 chromedriver-debuginfo-54.0.2840.100-118.1 chromium-54.0.2840.100-118.1 chromium-debuginfo-54.0.2840.100-118.1 chromium-debugsource-54.0.2840.100-118.1 chromium-ffmpegsumo-54.0.2840.100-118.1 chromium-ffmpegsumo-debuginfo-54.0.2840.100-118.1 References: https://www.suse.com/security/cve/CVE-2016-5199.html https://www.suse.com/security/cve/CVE-2016-5200.html https://www.suse.com/security/cve/CVE-2016-5201.html https://www.suse.com/security/cve/CVE-2016-5202.html https://bugzilla.suse.com/1009892 https://bugzilla.suse.com/1009893 https://bugzilla.suse.com/1009894 https://bugzilla.suse.com/1009895 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2788-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 12 Nov '16

12 Nov '16

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2788-1 Rating: important References: #1005555 #1005557 #1005558 #1005560 #1005561 #1005562 #1005563 #1005566 #1005567 #1005569 #1005570 #1005581 #1005582 #1005583 #1005586 #971456 #977614 #983938 #986251 #989911 #989913 #989914 #989915 #989919 #989921 #989922 #989925 #989926 #990890 #998309 #999666 Cross-References: CVE-2016-2105 CVE-2016-3459 CVE-2016-3477 CVE-2016-3486 CVE-2016-3492 CVE-2016-3501 CVE-2016-3521 CVE-2016-3614 CVE-2016-3615 CVE-2016-5439 CVE-2016-5440 CVE-2016-5507 CVE-2016-5584 CVE-2016-5609 CVE-2016-5612 CVE-2016-5616 CVE-2016-5617 CVE-2016-5626 CVE-2016-5627 CVE-2016-5629 CVE-2016-5630 CVE-2016-6304 CVE-2016-6662 CVE-2016-7440 CVE-2016-8283 CVE-2016-8284 CVE-2016-8288 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 27 vulnerabilities and has four fixes is now available. Description: mysql-community-server was updated to 5.6.34 to fix the following issues: * Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html * fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 * fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append "--ignore-db-dir=lost+found" to the mysqld options in "mysql-systemd-helper" script if "lost+found" directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql(a)default.service [boo#971456] - replace all occurrences of the string "@sysconfdir@" with "/etc" in mysql-community-server-5.6.3-logrotate.patch as it wasn't expanded properly [boo#990890] - remove '%define _rundir' as 13.1 is out of support scope - run 'usermod -g mysql mysql' only if mysql user is not in mysql group. Run 'usermod -s /bin/false/ mysql' only if mysql user doesn't have '/bin/false' shell set. - re-enable mysql profiling Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1289=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.34-19.2 libmysql56client18-debuginfo-5.6.34-19.2 libmysql56client_r18-5.6.34-19.2 mysql-community-server-5.6.34-19.2 mysql-community-server-bench-5.6.34-19.2 mysql-community-server-bench-debuginfo-5.6.34-19.2 mysql-community-server-client-5.6.34-19.2 mysql-community-server-client-debuginfo-5.6.34-19.2 mysql-community-server-debuginfo-5.6.34-19.2 mysql-community-server-debugsource-5.6.34-19.2 mysql-community-server-errormessages-5.6.34-19.2 mysql-community-server-test-5.6.34-19.2 mysql-community-server-test-debuginfo-5.6.34-19.2 mysql-community-server-tools-5.6.34-19.2 mysql-community-server-tools-debuginfo-5.6.34-19.2 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.34-19.2 libmysql56client18-debuginfo-32bit-5.6.34-19.2 libmysql56client_r18-32bit-5.6.34-19.2 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-3459.html https://www.suse.com/security/cve/CVE-2016-3477.html https://www.suse.com/security/cve/CVE-2016-3486.html https://www.suse.com/security/cve/CVE-2016-3492.html https://www.suse.com/security/cve/CVE-2016-3501.html https://www.suse.com/security/cve/CVE-2016-3521.html https://www.suse.com/security/cve/CVE-2016-3614.html https://www.suse.com/security/cve/CVE-2016-3615.html https://www.suse.com/security/cve/CVE-2016-5439.html https://www.suse.com/security/cve/CVE-2016-5440.html https://www.suse.com/security/cve/CVE-2016-5507.html https://www.suse.com/security/cve/CVE-2016-5584.html https://www.suse.com/security/cve/CVE-2016-5609.html https://www.suse.com/security/cve/CVE-2016-5612.html https://www.suse.com/security/cve/CVE-2016-5616.html https://www.suse.com/security/cve/CVE-2016-5617.html https://www.suse.com/security/cve/CVE-2016-5626.html https://www.suse.com/security/cve/CVE-2016-5627.html https://www.suse.com/security/cve/CVE-2016-5629.html https://www.suse.com/security/cve/CVE-2016-5630.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6662.html https://www.suse.com/security/cve/CVE-2016-7440.html https://www.suse.com/security/cve/CVE-2016-8283.html https://www.suse.com/security/cve/CVE-2016-8284.html https://www.suse.com/security/cve/CVE-2016-8288.html https://bugzilla.suse.com/1005555 https://bugzilla.suse.com/1005557 https://bugzilla.suse.com/1005558 https://bugzilla.suse.com/1005560 https://bugzilla.suse.com/1005561 https://bugzilla.suse.com/1005562 https://bugzilla.suse.com/1005563 https://bugzilla.suse.com/1005566 https://bugzilla.suse.com/1005567 https://bugzilla.suse.com/1005569 https://bugzilla.suse.com/1005570 https://bugzilla.suse.com/1005581 https://bugzilla.suse.com/1005582 https://bugzilla.suse.com/1005583 https://bugzilla.suse.com/1005586 https://bugzilla.suse.com/971456 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/983938 https://bugzilla.suse.com/986251 https://bugzilla.suse.com/989911 https://bugzilla.suse.com/989913 https://bugzilla.suse.com/989914 https://bugzilla.suse.com/989915 https://bugzilla.suse.com/989919 https://bugzilla.suse.com/989921 https://bugzilla.suse.com/989922 https://bugzilla.suse.com/989925 https://bugzilla.suse.com/989926 https://bugzilla.suse.com/990890 https://bugzilla.suse.com/998309 https://bugzilla.suse.com/999666 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2782-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 12 Nov '16

12 Nov '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2782-1 Rating: important References: #1009217 Cross-References: CVE-2016-7857 CVE-2016-7858 CVE-2016-7859 CVE-2016-7860 CVE-2016-7861 CVE-2016-7862 CVE-2016-7863 CVE-2016-7864 CVE-2016-7865 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.644 fixes the following security issues: - type confusion vulnerabilities that could lead to code execution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865) - use-after-free vulnerabilities that could lead to code execution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-1286=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.644-180.1 flash-player-gnome-11.2.202.644-180.1 flash-player-kde4-11.2.202.644-180.1 References: https://www.suse.com/security/cve/CVE-2016-7857.html https://www.suse.com/security/cve/CVE-2016-7858.html https://www.suse.com/security/cve/CVE-2016-7859.html https://www.suse.com/security/cve/CVE-2016-7860.html https://www.suse.com/security/cve/CVE-2016-7861.html https://www.suse.com/security/cve/CVE-2016-7862.html https://www.suse.com/security/cve/CVE-2016-7863.html https://www.suse.com/security/cve/CVE-2016-7864.html https://www.suse.com/security/cve/CVE-2016-7865.html https://bugzilla.suse.com/1009217 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2780-1: important: Security update for mysql
by opensuse-security＠opensuse.org 12 Nov '16

12 Nov '16

SUSE Security Update: Security update for mysql ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2780-1 Rating: important References: #1005558 #1005580 #1005581 Cross-References: CVE-2016-5584 CVE-2016-6662 CVE-2016-7440 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This mysql version update to 5.5.53 fixes the following issues: - CVE-2016-6662: Unspecified vulnerability in subcomponent Logging (bsc#1005580) - CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581) - CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558) Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-mysql-12847=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-mysql-12847=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-mysql-12847=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.53-0.30.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ia64): libmysql55client_r18-x86-5.5.53-0.30.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libmysql55client18-5.5.53-0.30.1 libmysql55client_r18-5.5.53-0.30.1 mysql-5.5.53-0.30.1 mysql-client-5.5.53-0.30.1 mysql-tools-5.5.53-0.30.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libmysql55client18-32bit-5.5.53-0.30.1 libmysql55client_r18-32bit-5.5.53-0.30.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libmysql55client18-x86-5.5.53-0.30.1 libmysql55client_r18-x86-5.5.53-0.30.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): mysql-debuginfo-5.5.53-0.30.1 mysql-debugsource-5.5.53-0.30.1 References: https://www.suse.com/security/cve/CVE-2016-5584.html https://www.suse.com/security/cve/CVE-2016-6662.html https://www.suse.com/security/cve/CVE-2016-7440.html https://bugzilla.suse.com/1005558 https://bugzilla.suse.com/1005580 https://bugzilla.suse.com/1005581 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0