December 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:3019-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Dec '16

06 Dec '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3019-1 Rating: important References: #1009026 #1010401 #1010404 #1010410 #1010411 #1010427 #1012964 Cross-References: CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9066 CVE-2016-9079 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for MozillaThunderbird fixes some potential security issues and bugs. The following security flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92, bsc#1012964) - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010411) - CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410) - CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5 (bsc#1010427) The update contains changes in behavior: - Changed recipient address entry: Arrow-keys now copy the pop-up value to the input field. Mouse-hovered pop-up value can no longer be confirmed with tab or enter key. This restores the behavior of Thunderbird 24. - Support changes to character limit in Twitter The following bugs were fixed: - Reply with selected text containing quote resulted in wrong quoting level indication - Email invitation might not be displayed when description contains non-ASCII characters - Attempting to sort messages on the Date field whilst a quick filter is applied got stuck on sort descending - Mail address display at header pane displayed incorrectly if the address contains UTF-8 according to RFC 6532 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1412=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.5.1-17.1 MozillaThunderbird-devel-45.5.1-17.1 MozillaThunderbird-translations-common-45.5.1-17.1 MozillaThunderbird-translations-other-45.5.1-17.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.5.1-17.1 References: https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010411 https://bugzilla.suse.com/1010427 https://bugzilla.suse.com/1012964 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3014-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

SUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3014-1 Rating: important References: #1009026 #1010395 #1010401 #1010402 #1010404 #1010410 #1010422 #1010427 #1010517 #992549 Cross-References: CVE-2016-5285 CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9064 CVE-2016-9066 CVE-2016-9074 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for MozillaFirefox, mozilla-nss fixes security issues and bugs. The following vulnerabilities were fixed in Firefox ESR 45.5 (bsc#1009026): - CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404) - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402) - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410) The following vulnerabilities were fixed in mozilla-nss 3.21.3: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422) - CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517) The following bugs were fixed: - Firefox would fail to go into fullscreen mode with some window managers (bsc#992549) The Mozilla Firefox changelog was amended to document patched dropped in a previous update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1754=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1754=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1754=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2016-1754=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1754=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1754=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1754=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1754=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1754=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-devel-45.5.0esr-88.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-devel-3.21.3-50.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-devel-45.5.0esr-88.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-devel-3.21.3-50.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libfreebl3-hmac-3.21.3-50.1 libfreebl3-hmac-32bit-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-hmac-3.21.3-50.1 libsoftokn3-hmac-32bit-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-hmac-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-hmac-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-hmac-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-hmac-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libfreebl3-hmac-32bit-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-hmac-32bit-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-hmac-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-hmac-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libfreebl3-hmac-32bit-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-hmac-32bit-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-hmac-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-hmac-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libfreebl3-hmac-32bit-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-hmac-32bit-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-45.5.0esr-88.1 MozillaFirefox-debuginfo-45.5.0esr-88.1 MozillaFirefox-debugsource-45.5.0esr-88.1 MozillaFirefox-translations-45.5.0esr-88.1 libfreebl3-3.21.3-50.1 libfreebl3-32bit-3.21.3-50.1 libfreebl3-debuginfo-3.21.3-50.1 libfreebl3-debuginfo-32bit-3.21.3-50.1 libsoftokn3-3.21.3-50.1 libsoftokn3-32bit-3.21.3-50.1 libsoftokn3-debuginfo-3.21.3-50.1 libsoftokn3-debuginfo-32bit-3.21.3-50.1 mozilla-nss-3.21.3-50.1 mozilla-nss-32bit-3.21.3-50.1 mozilla-nss-certs-3.21.3-50.1 mozilla-nss-certs-32bit-3.21.3-50.1 mozilla-nss-certs-debuginfo-3.21.3-50.1 mozilla-nss-certs-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debuginfo-3.21.3-50.1 mozilla-nss-debuginfo-32bit-3.21.3-50.1 mozilla-nss-debugsource-3.21.3-50.1 mozilla-nss-sysinit-3.21.3-50.1 mozilla-nss-sysinit-32bit-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-3.21.3-50.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.3-50.1 mozilla-nss-tools-3.21.3-50.1 mozilla-nss-tools-debuginfo-3.21.3-50.1 References: https://www.suse.com/security/cve/CVE-2016-5285.html https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-9064.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9074.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010395 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010402 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010422 https://bugzilla.suse.com/1010427 https://bugzilla.suse.com/1010517 https://bugzilla.suse.com/992549 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:3011-1: important: Security update for Mozilla Firefox, Thunderbird and NSS
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for Mozilla Firefox, Thunderbird and NSS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3011-1 Rating: important References: #1009026 #1010401 #1010404 #1010410 #1010411 #1010427 #1012807 #1012964 Cross-References: CVE-2016-5289 CVE-2016-5290 CVE-2016-5291 CVE-2016-5292 CVE-2016-5293 CVE-2016-5294 CVE-2016-5295 CVE-2016-5296 CVE-2016-5297 CVE-2016-5298 CVE-2016-5299 CVE-2016-9061 CVE-2016-9062 CVE-2016-9063 CVE-2016-9064 CVE-2016-9065 CVE-2016-9066 CVE-2016-9067 CVE-2016-9068 CVE-2016-9069 CVE-2016-9070 CVE-2016-9071 CVE-2016-9072 CVE-2016-9073 CVE-2016-9074 CVE-2016-9075 CVE-2016-9076 CVE-2016-9077 CVE-2016-9078 CVE-2016-9079 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2 fixes a number of security issues. The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89): - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bmo#1292443) - CVE-2016-5292: URL parsing causes crash (bmo#1288482) - CVE-2016-5297: Incorrect argument length checking in Javascript (bmo#1303678) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bmo#1303418) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bmo#1299686) - CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922 (CVE-2016-9069)) - CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973) - CVE-2016-9075: WebExtensions can access the mozAddonManager API and use it to gain elevated privileges (bmo#1295324) - CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to cross-origin images, allowing timing attacks on them (bmo#1298552) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bmo#1292159) - CVE-2016-9070: Sidebar bookmark can have reference to chrome window (bmo#1281071) - CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl" (bmo#1289273) - CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on e10s (bmo#1276976) - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in expat (bmo#1274777) - CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP (bmo#1285003) - CVE-2016-5289: Memory safety bugs fixed in Firefox 50 - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 The following vulnerabilities were fixed in Mozilla NSS 3.26.1: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bmo#1293334) Mozilla Firefox now requires mozilla-nss 3.26.2. New features in Mozilla Firefox: - Updates to keyboard shortcuts Set a preference to have Ctrl+Tab cycle through tabs in recently used order View a page in Reader Mode by using Ctrl+Alt+R - Added option to Find in page that allows users to limit search to whole words only - Added download protection for a large number of executable file types on Windows, Mac and Linux - Fixed rendering of dashed and dotted borders with rounded corners (border-radius) - Added a built-in Emoji set for operating systems without native Emoji fonts - Blocked versions of libavcodec older than 54.35.1 - additional locale mozilla-nss was updated to 3.26.2, incorporating the following changes: - the selfserv test utility has been enhanced to support ALPN (HTTP/1.1) and 0-RTT - The following CA certificate was added: CN = ISRG Root X1 - NPN is disabled and ALPN is enabled by default - MD5 signature algorithms sent by the server in CertificateRequest messages are now properly ignored Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-50.0.2-131.1 MozillaFirefox-branding-upstream-50.0.2-131.1 MozillaFirefox-buildsymbols-50.0.2-131.1 MozillaFirefox-debuginfo-50.0.2-131.1 MozillaFirefox-debugsource-50.0.2-131.1 MozillaFirefox-devel-50.0.2-131.1 MozillaFirefox-translations-common-50.0.2-131.1 MozillaFirefox-translations-other-50.0.2-131.1 MozillaThunderbird-45.5.1-70.92.1 MozillaThunderbird-buildsymbols-45.5.1-70.92.1 MozillaThunderbird-debuginfo-45.5.1-70.92.1 MozillaThunderbird-debugsource-45.5.1-70.92.1 MozillaThunderbird-devel-45.5.1-70.92.1 MozillaThunderbird-translations-common-45.5.1-70.92.1 MozillaThunderbird-translations-other-45.5.1-70.92.1 libfreebl3-3.26.2-94.1 libfreebl3-debuginfo-3.26.2-94.1 libsoftokn3-3.26.2-94.1 libsoftokn3-debuginfo-3.26.2-94.1 mozilla-nss-3.26.2-94.1 mozilla-nss-certs-3.26.2-94.1 mozilla-nss-certs-debuginfo-3.26.2-94.1 mozilla-nss-debuginfo-3.26.2-94.1 mozilla-nss-debugsource-3.26.2-94.1 mozilla-nss-devel-3.26.2-94.1 mozilla-nss-sysinit-3.26.2-94.1 mozilla-nss-sysinit-debuginfo-3.26.2-94.1 mozilla-nss-tools-3.26.2-94.1 mozilla-nss-tools-debuginfo-3.26.2-94.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.26.2-94.1 libfreebl3-debuginfo-32bit-3.26.2-94.1 libsoftokn3-32bit-3.26.2-94.1 libsoftokn3-debuginfo-32bit-3.26.2-94.1 mozilla-nss-32bit-3.26.2-94.1 mozilla-nss-certs-32bit-3.26.2-94.1 mozilla-nss-certs-debuginfo-32bit-3.26.2-94.1 mozilla-nss-debuginfo-32bit-3.26.2-94.1 mozilla-nss-sysinit-32bit-3.26.2-94.1 mozilla-nss-sysinit-debuginfo-32bit-3.26.2-94.1 References: https://www.suse.com/security/cve/CVE-2016-5289.html https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5292.html https://www.suse.com/security/cve/CVE-2016-5293.html https://www.suse.com/security/cve/CVE-2016-5294.html https://www.suse.com/security/cve/CVE-2016-5295.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-5298.html https://www.suse.com/security/cve/CVE-2016-5299.html https://www.suse.com/security/cve/CVE-2016-9061.html https://www.suse.com/security/cve/CVE-2016-9062.html https://www.suse.com/security/cve/CVE-2016-9063.html https://www.suse.com/security/cve/CVE-2016-9064.html https://www.suse.com/security/cve/CVE-2016-9065.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9067.html https://www.suse.com/security/cve/CVE-2016-9068.html https://www.suse.com/security/cve/CVE-2016-9069.html https://www.suse.com/security/cve/CVE-2016-9070.html https://www.suse.com/security/cve/CVE-2016-9071.html https://www.suse.com/security/cve/CVE-2016-9072.html https://www.suse.com/security/cve/CVE-2016-9073.html https://www.suse.com/security/cve/CVE-2016-9074.html https://www.suse.com/security/cve/CVE-2016-9075.html https://www.suse.com/security/cve/CVE-2016-9076.html https://www.suse.com/security/cve/CVE-2016-9077.html https://www.suse.com/security/cve/CVE-2016-9078.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010411 https://bugzilla.suse.com/1010427 https://bugzilla.suse.com/1012807 https://bugzilla.suse.com/1012964 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3010-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3010-1 Rating: important References: #1009280 Cross-References: CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5597 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_6_0-ibm fixes the following issues: - Version update to 6.0-16.35 (bsc#1009280) fixing the following CVE's: CVE-2016-5568, CVE-2016-5556, CVE-2016-5573, CVE-2016-5597, CVE-2016-5554, CVE-2016-5542 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2016-1752=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.35-43.2 java-1_6_0-ibm-fonts-1.6.0_sr16.35-43.2 java-1_6_0-ibm-jdbc-1.6.0_sr16.35-43.2 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.35-43.2 References: https://www.suse.com/security/cve/CVE-2016-5542.html https://www.suse.com/security/cve/CVE-2016-5554.html https://www.suse.com/security/cve/CVE-2016-5556.html https://www.suse.com/security/cve/CVE-2016-5568.html https://www.suse.com/security/cve/CVE-2016-5573.html https://www.suse.com/security/cve/CVE-2016-5597.html https://bugzilla.suse.com/1009280 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2994-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2994-1 Rating: important References: #1012807 #1012964 Cross-References: CVE-2016-9078 CVE-2016-9079 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: MozillaFirefox is updated to version 50.0.2 which fixes the following issues: * Firefox crashed with 3rd party Chinese IME when using IME text (fixed in version 50.0.1) * Redirection from an HTTP connection to a data: URL could inherit wrong origin after an HTTP redirect (fixed in version 50.0.1, bmo#1317641, MFSA 2016-91, boo#1012807, CVE-2016-9078) * Maliciously crafted SVG animations could cause remote code execution (fixed in version 50.0.2, bmo#1321066, MFSA 2016-92, boo##1012964, CVE-2016-9079) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1392=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1392=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1392=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-50.0.2-42.2 MozillaFirefox-branding-upstream-50.0.2-42.2 MozillaFirefox-buildsymbols-50.0.2-42.2 MozillaFirefox-debuginfo-50.0.2-42.2 MozillaFirefox-debugsource-50.0.2-42.2 MozillaFirefox-devel-50.0.2-42.2 MozillaFirefox-translations-common-50.0.2-42.2 MozillaFirefox-translations-other-50.0.2-42.2 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-50.0.2-42.1 MozillaFirefox-branding-upstream-50.0.2-42.1 MozillaFirefox-buildsymbols-50.0.2-42.1 MozillaFirefox-debuginfo-50.0.2-42.1 MozillaFirefox-debugsource-50.0.2-42.1 MozillaFirefox-devel-50.0.2-42.1 MozillaFirefox-translations-common-50.0.2-42.1 MozillaFirefox-translations-other-50.0.2-42.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-50.0.2-91.1 MozillaFirefox-branding-upstream-50.0.2-91.1 MozillaFirefox-buildsymbols-50.0.2-91.1 MozillaFirefox-debuginfo-50.0.2-91.1 MozillaFirefox-debugsource-50.0.2-91.1 MozillaFirefox-devel-50.0.2-91.1 MozillaFirefox-translations-common-50.0.2-91.1 MozillaFirefox-translations-other-50.0.2-91.1 References: https://www.suse.com/security/cve/CVE-2016-9078.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1012807 https://bugzilla.suse.com/1012964 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2993-1: important: Security update for vim
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2993-1 Rating: important References: #1010685 #988903 Cross-References: CVE-2016-1248 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for vim fixes the following security issues: - Fixed CVE-2016-1248 an arbitrary command execution vulnerability (bsc#1010685) This update for vim fixes the following issues: - Fix build with Python 3.5. (bsc#988903) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1390=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gvim-7.4.326-8.2 gvim-debuginfo-7.4.326-8.2 vim-7.4.326-8.2 vim-debuginfo-7.4.326-8.2 vim-debugsource-7.4.326-8.2 - openSUSE Leap 42.2 (noarch): vim-data-7.4.326-8.2 References: https://www.suse.com/security/cve/CVE-2016-1248.html https://bugzilla.suse.com/1010685 https://bugzilla.suse.com/988903 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2992-1: important: Security update for vim
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2992-1 Rating: important References: #1010685 Cross-References: CVE-2016-1248 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vim fixes the following security issues: - Fixed CVE-2016-1248 an arbitrary command execution vulnerability (bsc#1010685) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1391=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1391=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gvim-7.4.326-8.1 gvim-debuginfo-7.4.326-8.1 vim-7.4.326-8.1 vim-debuginfo-7.4.326-8.1 vim-debugsource-7.4.326-8.1 - openSUSE Leap 42.1 (noarch): vim-data-7.4.326-8.1 - openSUSE 13.2 (i586 x86_64): gvim-7.4.461.hg.6253-3.1 gvim-debuginfo-7.4.461.hg.6253-3.1 vim-7.4.461.hg.6253-3.1 vim-debuginfo-7.4.461.hg.6253-3.1 vim-debugsource-7.4.461.hg.6253-3.1 - openSUSE 13.2 (noarch): vim-data-7.4.461.hg.6253-3.1 References: https://www.suse.com/security/cve/CVE-2016-1248.html https://bugzilla.suse.com/1010685 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2991-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2991-1 Rating: important References: #1012964 Cross-References: CVE-2016-9079 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Mozilla Thunderbird 45.5.1 and fixes one vulnerability. In Mozilla Thunderbird, this vulnerability may be exploited when used in a browser-like context. - CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92, bsc#1012964, bmo#1321066) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1393=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1393=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1393=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-45.5.1-28.2 MozillaThunderbird-buildsymbols-45.5.1-28.2 MozillaThunderbird-debuginfo-45.5.1-28.2 MozillaThunderbird-debugsource-45.5.1-28.2 MozillaThunderbird-devel-45.5.1-28.2 MozillaThunderbird-translations-common-45.5.1-28.2 MozillaThunderbird-translations-other-45.5.1-28.2 - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.5.1-28.2 MozillaThunderbird-buildsymbols-45.5.1-28.2 MozillaThunderbird-debuginfo-45.5.1-28.2 MozillaThunderbird-debugsource-45.5.1-28.2 MozillaThunderbird-devel-45.5.1-28.2 MozillaThunderbird-translations-common-45.5.1-28.2 MozillaThunderbird-translations-other-45.5.1-28.2 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-45.5.1-55.1 MozillaThunderbird-buildsymbols-45.5.1-55.1 MozillaThunderbird-debuginfo-45.5.1-55.1 MozillaThunderbird-debugsource-45.5.1-55.1 MozillaThunderbird-devel-45.5.1-55.1 MozillaThunderbird-translations-common-45.5.1-55.1 MozillaThunderbird-translations-other-45.5.1-55.1 References: https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1012964 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2988-1: important: Security update for qemu
by opensuse-security＠opensuse.org 02 Dec '16

02 Dec '16

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2988-1 Rating: important References: #1000345 #1001151 #1002116 #1002550 #1002557 #1003878 #1003893 #1003894 #1004702 #1004707 #1006536 #1006538 #1007391 #1007450 #1007454 #1007493 #1007494 #1007495 #996524 #998516 #999661 Cross-References: CVE-2016-7161 CVE-2016-7170 CVE-2016-7421 CVE-2016-7466 CVE-2016-7908 CVE-2016-7909 CVE-2016-8576 CVE-2016-8577 CVE-2016-8578 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific (bsc#1002116) - Address various security/stability issues * Fix OOB access in xlnx.xpx-ethernetlite emulation (CVE-2016-7161 bsc#1001151) * Fix OOB access in VMware SVGA emulation (CVE-2016-7170 bsc#998516) * Fix DOS in USB xHCI emulation (CVE-2016-7466 bsc#1000345) * Fix DOS in Vmware pv scsi interface (CVE-2016-7421 bsc#999661) * Fix DOS in ColdFire Fast Ethernet Controller emulation (CVE-2016-7908 bsc#1002550) * Fix DOS in USB xHCI emulation (CVE-2016-8576 bsc#1003878) * Fix DOS in virtio-9pfs (CVE-2016-8578 bsc#1003894) * Fix DOS in virtio-9pfs (CVE-2016-9105 bsc#1007494) * Fix DOS in virtio-9pfs (CVE-2016-8577 bsc#1003893) * Plug data leak in virtio-9pfs interface (CVE-2016-9103 bsc#1007454) * Fix DOS in virtio-9pfs interface (CVE-2016-9102 bsc#1007450) * Fix DOS in virtio-9pfs (CVE-2016-9106 bsc#1007495) * Fix DOS in 16550A UART emulation (CVE-2016-8669 bsc#1004707) * Fix DOS in PC-Net II emulation (CVE-2016-7909 bsc#1002557) * Fix DOS in PRO100 emulation (CVE-2016-9101 bsc#1007391) * Fix DOS in RTL8139 emulation (CVE-2016-8910 bsc#1006538) * Fix DOS in Intel HDA controller emulation (CVE-2016-8909 bsc#1006536) * Fix DOS in virtio-9pfs (CVE-2016-9104 bsc#1007493) * Fix DOS in JAZZ RC4030 emulation (CVE-2016-8667 bsc#1004702) - Fix case of disk corruption with migration due to improper internal state tracking (bsc#996524) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1748=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1748=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): qemu-2.3.1-24.6 qemu-block-curl-2.3.1-24.6 qemu-block-curl-debuginfo-2.3.1-24.6 qemu-debugsource-2.3.1-24.6 qemu-guest-agent-2.3.1-24.6 qemu-guest-agent-debuginfo-2.3.1-24.6 qemu-lang-2.3.1-24.6 qemu-tools-2.3.1-24.6 qemu-tools-debuginfo-2.3.1-24.6 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): qemu-kvm-2.3.1-24.6 - SUSE Linux Enterprise Server 12-SP1 (ppc64le): qemu-ppc-2.3.1-24.6 qemu-ppc-debuginfo-2.3.1-24.6 - SUSE Linux Enterprise Server 12-SP1 (x86_64): qemu-block-rbd-2.3.1-24.6 qemu-block-rbd-debuginfo-2.3.1-24.6 qemu-x86-2.3.1-24.6 - SUSE Linux Enterprise Server 12-SP1 (noarch): qemu-ipxe-1.0.0-24.6 qemu-seabios-1.8.1-24.6 qemu-sgabios-8-24.6 qemu-vgabios-1.8.1-24.6 - SUSE Linux Enterprise Server 12-SP1 (s390x): qemu-s390-2.3.1-24.6 qemu-s390-debuginfo-2.3.1-24.6 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): qemu-ipxe-1.0.0-24.6 qemu-seabios-1.8.1-24.6 qemu-sgabios-8-24.6 qemu-vgabios-1.8.1-24.6 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): qemu-2.3.1-24.6 qemu-block-curl-2.3.1-24.6 qemu-block-curl-debuginfo-2.3.1-24.6 qemu-debugsource-2.3.1-24.6 qemu-kvm-2.3.1-24.6 qemu-tools-2.3.1-24.6 qemu-tools-debuginfo-2.3.1-24.6 qemu-x86-2.3.1-24.6 References: https://www.suse.com/security/cve/CVE-2016-7161.html https://www.suse.com/security/cve/CVE-2016-7170.html https://www.suse.com/security/cve/CVE-2016-7421.html https://www.suse.com/security/cve/CVE-2016-7466.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8577.html https://www.suse.com/security/cve/CVE-2016-8578.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9102.html https://www.suse.com/security/cve/CVE-2016-9103.html https://www.suse.com/security/cve/CVE-2016-9104.html https://www.suse.com/security/cve/CVE-2016-9105.html https://www.suse.com/security/cve/CVE-2016-9106.html https://bugzilla.suse.com/1000345 https://bugzilla.suse.com/1001151 https://bugzilla.suse.com/1002116 https://bugzilla.suse.com/1002550 https://bugzilla.suse.com/1002557 https://bugzilla.suse.com/1003878 https://bugzilla.suse.com/1003893 https://bugzilla.suse.com/1003894 https://bugzilla.suse.com/1004702 https://bugzilla.suse.com/1004707 https://bugzilla.suse.com/1006536 https://bugzilla.suse.com/1006538 https://bugzilla.suse.com/1007391 https://bugzilla.suse.com/1007450 https://bugzilla.suse.com/1007454 https://bugzilla.suse.com/1007493 https://bugzilla.suse.com/1007494 https://bugzilla.suse.com/1007495 https://bugzilla.suse.com/996524 https://bugzilla.suse.com/998516 https://bugzilla.suse.com/999661 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2985-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 02 Dec '16

02 Dec '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2985-1 Rating: important References: #1005522 #1005523 #1005524 #1005525 #1005526 #1005527 #1005528 #988651 Cross-References: CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5582 CVE-2016-5597 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: OpenJDK Java was updated to jdk8u111 (icedtea 3.2.0) to fix the following issues: * Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks (bsc#1005522) + S8156794: Extend data sharing + S8157176: Improved classfile parsing + S8157739, CVE-2016-5554: Classloader Consistency Checking (bsc#1005523) + S8157749: Improve handling of DNS error replies + S8157753: Audio replay enhancement + S8157759: LCMS Transform Sampling Enhancement + S8157764: Better handling of interpolation plugins + S8158302: Handle contextual glyph substitutions + S8158993, CVE-2016-5568: Service Menu services (bsc#1005525) + S8159495: Fix index offsets + S8159503: Amend Annotation Actions + S8159511: Stack map validation + S8159515: Improve indy validation + S8159519, CVE-2016-5573: Reformat JDWP messages (bsc#1005526) + S8160090: Better signature handling in pack200 + S8160094: Improve pack200 layout + S8160098: Clean up color profiles + S8160591, CVE-2016-5582: Improve internal array handling (bsc#1005527) + S8160838, CVE-2016-5597: Better HTTP service (bsc#1005528) + PR3206, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read() + CVE-2016-5556 (bsc#1005524) * New features + PR1370: Provide option to build without debugging + PR1375: Provide option to strip and link debugging info after build + PR1537: Handle alternative Kerberos credential cache locations + PR1978: Allow use of system PCSC + PR2445: Support system libsctp + PR3182: Support building without pre-compiled headers + PR3183: Support Fedora/RHEL system crypto policy + PR3221: Use pkgconfig to detect Kerberos CFLAGS and libraries * Import of OpenJDK 8 u102 build 14 + S4515292: ReferenceType.isStatic() returns true for arrays + S4858370: JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command + S6976636: JVM/TI test ex03t001 fails assertion + S7185591: jcmd-big-script.sh ERROR: could not find app's Java pid. + S8017462: G1: guarantee fails with UseDynamicNumberOfGCThreads + S8034168: ThreadMXBean/Locks.java failed, blocked on wrong object + S8036006: [TESTBUG] sun/tools/native2ascii/NativeErrors.java fails: Process exit code was 0, but error was expected. + S8041781: Need new regression tests for PBE keys + S8041787: Need new regressions tests for buffer handling for PBE algorithms + S8043836: Need new tests for AES cipher + S8044199: Tests for RSA keys and key specifications + S8044772: TempDirTest.java still times out with -Xcomp + S8046339: sun.rmi.transport.DGCAckHandler leaks memory + S8047031: Add SocketPermission tests for legacy socket types + S8048052: Permission tests for setFactory + S8048138: Tests for JAAS callbacks + S8048147: Privilege tests with JAAS Subject.doAs + S8048356: SecureRandom default provider tests + S8048357: PKCS basic tests + S8048360: Test signed jar files + S8048362: Tests for doPrivileged with accomplice + S8048596: Tests for AEAD ciphers + S8048599: Tests for key wrap and unwrap operations + S8048603: Additional tests for MAC algorithms + S8048604: Tests for strong crypto ciphers + S8048607: Test key generation of DES and DESEDE + S8048610: Implement regression test for bug fix of 4686632 in JCE + S8048617: Tests for PKCS12 read operations + S8048618: Tests for PKCS12 write operations. + S8048619: Implement tests for converting PKCS12 keystores + S8048624: Tests for SealedObject + S8048819: Implement reliability test for DH algorithm + S8048820: Implement tests for SecretKeyFactory + S8048830: Implement tests for new functionality provided in JEP 166 + S8049237: Need new tests for X509V3 certificates + S8049321: Support SHA256WithDSA in JSSE + S8049429: Tests for java client server communications with various TLS/SSL combinations. + S8049432: New tests for TLS property jdk.tls.client.protocols + S8049814: Additional SASL client-server tests + S8050281: New permission tests for JEP 140 + S8050370: Need new regressions tests for messageDigest with DigestIOStream + S8050371: More MessageDigest tests + S8050374: More Signature tests + S8050427: LoginContext tests to cover JDK-4703361 + S8050460: JAAS login/logout tests with LoginContext + S8050461: Tests for syntax checking of JAAS configuration file + S8054278: Refactor jps utility tests + S8055530: assert(_exits.control()->is_top() || !_gvn.type(ret_phi)->empty()) failed: return value must be well defined + S8055844: [TESTBUG] test/runtime/NMT/VirtualAllocCommitUncommitRecommit.java fails on Solaris Sparc due to incorrect page size being used + S8059677: Thread.getName() instantiates Strings + S8061464: A typo in CipherTestUtils test + S8062536: [TESTBUG] Conflicting GC combinations in jdk tests + S8065076: java/net/SocketPermission/SocketPermissionTest.java fails intermittently + S8065078: NetworkInterface.getNetworkInterfaces() triggers intermittent test failures + S8066871: java.lang.VerifyError: Bad local variable type - local final String + S8068427: Hashtable deserialization reconstitutes table with wrong capacity + S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java needs to be updated for JDK-8061210 + S8069253: javax/net/ssl/TLS/TestJSSE.java failed on Mac + S8071125: Improve exception messages in URLPermission + S8072081: Supplementary characters are rejected in comments + S8072463: Remove requirement that AKID and SKID have to match when building certificate chain + S8072725: Provide more granular levels for GC verification + S8073400: Some Monospaced logical fonts have a different width + S8073872: Schemagen fails with StackOverflowError if element references containing class + S8074931: Additional tests for CertPath API + S8075286: Additional tests for signature algorithm OIDs and transformation string + S8076486: [TESTBUG] javax/security/auth/Subject/doAs/NestedActions.java fails if extra VM options are given + S8076545: Text size is twice bigger under Windows L&F on Win 8.1 with HiDPI display + S8076995: gc/ergonomics/TestDynamicNumberOfGCThreads.java failed with java.lang.RuntimeException: 'new_active_workers' missing from stdout/stderr + S8079138: Additional negative tests for XML signature processing + S8081512: Remove sun.invoke.anon classes, or move / co-locate them with tests + S8081771: ProcessTool.createJavaProcessBuilder() needs new addTestVmAndJavaOptions argument + S8129419: heapDumper.cpp: assert(length_in_bytes > 0) failed: nothing to copy + S8130150: Implement BigInteger.montgomeryMultiply intrinsic + S8130242: DataFlavorComparator transitivity exception + S8130304: Inference: NodeNotFoundException thrown with deep generic method call chain + S8130425: libjvm crash due to stack overflow in executables with 32k tbss/tdata + S8133023: ParallelGCThreads is not calculated correctly + S8134111: Unmarshaller unmarshalls XML element which doesn't have the expected namespace + S8135259: InetAddress.getAllByName only reports "unknown error" instead of actual cause + S8136506: Include sun.arch.data.model as a property that can be queried by jtreg + S8137068: Tests added in JDK-8048604 fail to compile + S8139040: Fix initializations before ShouldNotReachHere() etc. and enable -Wuninitialized on linux. + S8139581: AWT components are not drawn after removal and addition to a container + S8141243: Unexpected timezone returned after parsing a date + S8141420: Compiler runtime entries don't hold Klass* from being GCed + S8141445: Use of Solaris/SPARC M7 libadimalloc.so can generate unknown signal in hs_err file + S8141551: C2 can not handle returns with inccompatible interface arrays + S8143377: Test PKCS8Test.java fails + S8143647: Javac compiles method reference that allows results in an IllegalAccessError + S8144144: ORB destroy() leaks filedescriptors after unsuccessful connection + S8144593: Suppress not recognized property/feature warning messages from SAXParser + S8144957: Remove PICL warning message + S8145039: JAXB marshaller fails with ClassCastException on classes generated by xjc + S8145228: Java Access Bridge, getAccessibleStatesStringFromContext doesn't wrap the call to getAccessibleRole + S8145388: URLConnection.guessContentTypeFromStream returns image/jpg for some JPEG images + S8145974: XMLStreamWriter produces invalid XML for surrogate pairs on OutputStreamWriter + S8146035: Windows - With LCD antialiasing, some glyphs are not rendered correctly + S8146192: Add test for JDK-8049321 + S8146274: Thread spinning on WeakHashMap.getEntry() with concurrent use of nashorn + S8147468: Allow users to bound the size of buffers cached in the per-thread buffer caches + S8147645: get_ctrl_no_update() code is wrong + S8147807: crash in libkcms.so on linux-sparc + S8148379: jdk.nashorn.api.scripting spec. adjustments, clarifications + S8148627: RestrictTestMaxCachedBufferSize.java to 64-bit platforms + S8148820: Missing @since Javadoc tag in Logger.log(Level, Supplier) + S8148926: Call site profiling fails on braces-wrapped anonymous function + S8149017: Delayed provider selection broken in RSA client key exchange + S8149029: Secure validation of XML based digital signature always enabled when checking wrapping attacks + S8149330: Capacity of StringBuilder should not get close to Integer.MAX_VALUE unless necessary + S8149334: JSON.parse(JSON.stringify([])).push(10) creates an array containing two elements + S8149368: [hidpi] JLabel font is twice bigger than JTextArea font on Windows 7,HiDPI, Windows L&F + S8149411: PKCS12KeyStore cannot extract AES Secret Keys + S8149417: Use final restricted flag + S8149450: LdapCtx.processReturnCode() throwing Null Pointer Exception + S8149453: [hidpi] JFileChooser does not scale properly on Windows with HiDPI display and Windows L&F + S8149543: range check CastII nodes should not be split through Phi + S8149743: JVM crash after debugger hotswap with lambdas + S8149744: fix testng.jar delivery in Nashorn build.xml + S8149915: enabling validate-annotations feature for xsd schema with annotation causes NPE + S8150002: Check for the validity of oop before printing it in verify_remembered_set + S8150470: JCK: api/xsl/conf/copy/copy19 test failure + S8150518: G1 GC crashes at G1CollectedHeap::do_collection_pause_at_safepoint(double) + S8150533: Test java/util/logging/LogManagerAppContextDeadlock.java times out intermittently. + S8150704: XALAN: ERROR: 'No more DTM IDs are available' when transforming with lots of temporary result trees + S8150780: Repeated offer and remove on ConcurrentLinkedQueue lead to an OutOfMemoryError + S8151064: com/sun/jdi/RedefineAddPrivateMethod.sh fails intermittently + S8151197: [TEST_BUG] Need to backport fix for test/javax/net/ssl/TLS/TestJSSE.java + S8151352: jdk/test/sample fails with "effective library path is outside the test suite" + S8151431: DateFormatSymbols triggers this.clone() in the constructor + S8151535: TESTBUG: java/lang/invoke/AccessControlTest.java should be modified to run with JTREG 4.1 b13 + S8151731: Add new jtreg keywords to jdk 8 + S8151998: VS2010 ThemeReader.cpp(758) : error C3861: 'round': identifier not found + S8152927: Incorrect GPL header in StubFactoryDynamicBase.java reported + S8153252: SA: Hotspot build on Windows fails if make/closed folder does not exist + S8153531: Improve exception messaging for RSAClientKeyExchange + S8153641: assert(thread_state == _thread_in_native) failed: Assumed thread_in_native while heap dump + S8153673: [BACKOUT] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command + S8154304: NullpointerException at LdapReferralException.getReferralContext + S8154722: Test gc/ergonomics/TestDynamicNumberOfGCThreads.java fails + S8157078: 8u102 L10n resource file updates + S8157838: Personalized Windows Font Size is not taken into account in Java8u102 * Import of OpenJDK 8 u111 build 14 + S6882559: new JEditorPane("text/plain","") fails for null context class loader + S8049171: Additional tests for jarsigner's warnings + S8063086: Math.pow yields different results upon repeated calls + S8140530: Creating a VolatileImage with size 0,0 results in no longer working g2d.drawString + S8142926: OutputAnalyzer's shouldXXX() calls return this + S8147077: IllegalArgumentException thrown by api/java_awt/Component/FlipBufferStrategy/indexTGF_General + S8148127: IllegalArgumentException thrown by JCK test api/java_awt/Component/FlipBufferStrategy/indexTGF_General in opengl pipeline + S8150611: Security problem on sun.misc.resources.Messages* + S8153399: Constrain AppCDS behavior (back port) + S8157653: [Parfait] Uninitialised variable in awt_Font.cpp + S8158734: JEditorPane.createEditorKitForContentType throws NPE after 6882559 + S8158994: Service Menu services + S8159684: (tz) Support tzdata2016f + S8160904: Typo in code from 8079718 fix : enableCustomValueHanlde + S8160934: isnan() is not available on older MSVC compilers + S8161141: correct bugId for JDK-8158994 fix push + S8162411: Service Menu services 2 + S8162419: closed/com/oracle/jfr/runtime/TestVMInfoEvent.sh failing after JDK-8155968 + S8162511: 8u111 L10n resource file updates + S8162792: Remove constraint DSA keySize < 1024 from jdk.jar.disabledAlgorithms in jdk8 + S8164452: 8u111 L10n resource file update - msgdrop 20 + S8165816: jarsigner -verify shows jar unsigned if it was signed with a weak algorithm + S8166381: Back out changes to the java.security file to not disable MD5 * Backports + S8078628, PR3208: Zero build fails with pre-compiled headers disabled + S8141491, PR3159, G592292: Unaligned memory access in Bits.c + S8157306, PR3121: Random infrequent null pointer exceptions in javac (enabled on AArch64 only) + S8162384, PR3122: Performance regression: bimorphic inlining may be bypassed by type speculation * Bug fixes + PR3123: Some object files built without -fPIC on x86 only + PR3126: pax-mark-vm script calls "exit -1" which is invalid in dash + PR3127, G590348: Only apply PaX markings by default on running PaX kernels + PR3199: Invalid nashorn URL + PR3201: Update infinality configure test + PR3218: PR3159 leads to build failure on clean tree * AArch64 port + S8131779, PR3220: AARCH64: add Montgomery multiply intrinsic + S8167200, PR3220: AArch64: Broken stack pointer adjustment in interpreter + S8167421, PR3220: AArch64: in one core system, fatal error: Illegal threadstate encountered + S8167595, PR3220: AArch64: SEGV in stub code cipherBlockChaining_decryptAESCrypt + S8168888, PR3220: Port 8160591: Improve internal array handling to AArch64. * Shenandoah + PR3224: Shenandoah broken when building without pre-compiled headers - Build against system kerberos - Build against system pcsc and sctp - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1380=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1380=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.111-3.1 java-1_8_0-openjdk-accessibility-1.8.0.111-3.1 java-1_8_0-openjdk-debuginfo-1.8.0.111-3.1 java-1_8_0-openjdk-debugsource-1.8.0.111-3.1 java-1_8_0-openjdk-demo-1.8.0.111-3.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.111-3.1 java-1_8_0-openjdk-devel-1.8.0.111-3.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.111-3.1 java-1_8_0-openjdk-headless-1.8.0.111-3.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.111-3.1 java-1_8_0-openjdk-src-1.8.0.111-3.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.111-3.1 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.111-18.1 java-1_8_0-openjdk-accessibility-1.8.0.111-18.1 java-1_8_0-openjdk-debuginfo-1.8.0.111-18.1 java-1_8_0-openjdk-debugsource-1.8.0.111-18.1 java-1_8_0-openjdk-demo-1.8.0.111-18.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.111-18.1 java-1_8_0-openjdk-devel-1.8.0.111-18.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.111-18.1 java-1_8_0-openjdk-headless-1.8.0.111-18.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.111-18.1 java-1_8_0-openjdk-src-1.8.0.111-18.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.111-18.1 References: https://www.suse.com/security/cve/CVE-2016-5542.html https://www.suse.com/security/cve/CVE-2016-5554.html https://www.suse.com/security/cve/CVE-2016-5556.html https://www.suse.com/security/cve/CVE-2016-5568.html https://www.suse.com/security/cve/CVE-2016-5573.html https://www.suse.com/security/cve/CVE-2016-5582.html https://www.suse.com/security/cve/CVE-2016-5597.html https://bugzilla.suse.com/1005522 https://bugzilla.suse.com/1005523 https://bugzilla.suse.com/1005524 https://bugzilla.suse.com/1005525 https://bugzilla.suse.com/1005526 https://bugzilla.suse.com/1005527 https://bugzilla.suse.com/1005528 https://bugzilla.suse.com/988651 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0