December 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:3257-1: important: Security update for dnsmasq
by opensuse-security＠opensuse.org 23 Dec '16

23 Dec '16

SUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3257-1 Rating: important References: #983273 Cross-References: CVE-2015-8899 Affected Products: SUSE OpenStack Cloud Compute 5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dnsmasq fixes the following issues: - CVE-2015-8899: Denial of service between local and remote dns entries (bsc#983273) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Compute 5: zypper in -t patch SUSE-SLE12-CLOUD-5-2016-1906=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud Compute 5 (x86_64): dnsmasq-debuginfo-2.71-6.3.1 dnsmasq-debugsource-2.71-6.3.1 dnsmasq-utils-2.71-6.3.1 dnsmasq-utils-debuginfo-2.71-6.3.1 References: https://www.suse.com/security/cve/CVE-2015-8899.html https://bugzilla.suse.com/983273 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3252-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3252-1 Rating: important References: #1013533 #1013604 Cross-References: CVE-2016-9576 CVE-2016-9794 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The SUSE Linux Enterprise 11 SP 2 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-kernel-12915=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-kernel-12915=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.7.47.1 kernel-default-base-3.0.101-0.7.47.1 kernel-default-devel-3.0.101-0.7.47.1 kernel-source-3.0.101-0.7.47.1 kernel-syms-3.0.101-0.7.47.1 kernel-trace-3.0.101-0.7.47.1 kernel-trace-base-3.0.101-0.7.47.1 kernel-trace-devel-3.0.101-0.7.47.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.7.47.1 kernel-ec2-base-3.0.101-0.7.47.1 kernel-ec2-devel-3.0.101-0.7.47.1 kernel-xen-3.0.101-0.7.47.1 kernel-xen-base-3.0.101-0.7.47.1 kernel-xen-devel-3.0.101-0.7.47.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x): kernel-default-man-3.0.101-0.7.47.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): kernel-pae-3.0.101-0.7.47.1 kernel-pae-base-3.0.101-0.7.47.1 kernel-pae-devel-3.0.101-0.7.47.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.7.47.1 kernel-default-debugsource-3.0.101-0.7.47.1 kernel-default-devel-debuginfo-3.0.101-0.7.47.1 kernel-trace-debuginfo-3.0.101-0.7.47.1 kernel-trace-debugsource-3.0.101-0.7.47.1 kernel-trace-devel-debuginfo-3.0.101-0.7.47.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.7.47.1 kernel-ec2-debugsource-3.0.101-0.7.47.1 kernel-xen-debuginfo-3.0.101-0.7.47.1 kernel-xen-debugsource-3.0.101-0.7.47.1 kernel-xen-devel-debuginfo-3.0.101-0.7.47.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586): kernel-pae-debuginfo-3.0.101-0.7.47.1 kernel-pae-debugsource-3.0.101-0.7.47.1 kernel-pae-devel-debuginfo-3.0.101-0.7.47.1 References: https://www.suse.com/security/cve/CVE-2016-9576.html https://www.suse.com/security/cve/CVE-2016-9794.html https://bugzilla.suse.com/1013533 https://bugzilla.suse.com/1013604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3250-1: important: Security update for libgme
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for libgme ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3250-1 Rating: important References: #1015941 Cross-References: CVE-2016-9957 CVE-2016-9958 CVE-2016-9959 CVE-2016-9960 CVE-2016-9961 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgme fixes the following issues: - CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961: Various issues were fixed in the handling of SPC music files that could have been exploited for gaining privileges of desktop users. [bsc#1015941] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1898=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1898=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2016-1898=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1898=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1898=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1898=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1898=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libgme-debugsource-0.6.0-5.1 libgme-devel-0.6.0-5.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libgme-debugsource-0.6.0-5.1 libgme-devel-0.6.0-5.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libgme-debugsource-0.6.0-5.1 libgme0-0.6.0-5.1 libgme0-debuginfo-0.6.0-5.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libgme-debugsource-0.6.0-5.1 libgme0-0.6.0-5.1 libgme0-debuginfo-0.6.0-5.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libgme-debugsource-0.6.0-5.1 libgme0-0.6.0-5.1 libgme0-debuginfo-0.6.0-5.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libgme-debugsource-0.6.0-5.1 libgme0-0.6.0-5.1 libgme0-debuginfo-0.6.0-5.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libgme-debugsource-0.6.0-5.1 libgme0-0.6.0-5.1 libgme0-debuginfo-0.6.0-5.1 References: https://www.suse.com/security/cve/CVE-2016-9957.html https://www.suse.com/security/cve/CVE-2016-9958.html https://www.suse.com/security/cve/CVE-2016-9959.html https://www.suse.com/security/cve/CVE-2016-9960.html https://www.suse.com/security/cve/CVE-2016-9961.html https://bugzilla.suse.com/1015941 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3249-1: important: Security update for Linux Kernel Live Patch 10 for SLE 12
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for Linux Kernel Live Patch 10 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3249-1 Rating: important References: #1003253 #1012183 #1012759 Cross-References: CVE-2016-7117 CVE-2016-8655 CVE-2016-9555 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.51-52_34 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003253). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1895=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1895=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_51-52_34-default-7-2.1 kgraft-patch-3_12_51-52_34-xen-7-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_51-52_34-default-7-2.1 kgraft-patch-3_12_51-52_34-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2016-7117.html https://www.suse.com/security/cve/CVE-2016-8655.html https://www.suse.com/security/cve/CVE-2016-9555.html https://bugzilla.suse.com/1003253 https://bugzilla.suse.com/1012183 https://bugzilla.suse.com/1012759 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3248-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3248-1 Rating: important References: #1013533 #1013604 Cross-References: CVE-2016-9576 CVE-2016-9794 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The SUSE Linux Enterprise 11 SP 3 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-kernel-12909=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-kernel-12909=1 - SUSE Manager 2.1: zypper in -t patch sleman21-kernel-12909=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-kernel-12909=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-12909=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-kernel-12909=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-12909=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): kernel-bigsmp-3.0.101-0.47.93.1 kernel-bigsmp-base-3.0.101-0.47.93.1 kernel-bigsmp-devel-3.0.101-0.47.93.1 kernel-default-3.0.101-0.47.93.1 kernel-default-base-3.0.101-0.47.93.1 kernel-default-devel-3.0.101-0.47.93.1 kernel-ec2-3.0.101-0.47.93.1 kernel-ec2-base-3.0.101-0.47.93.1 kernel-ec2-devel-3.0.101-0.47.93.1 kernel-source-3.0.101-0.47.93.1 kernel-syms-3.0.101-0.47.93.1 kernel-trace-3.0.101-0.47.93.1 kernel-trace-base-3.0.101-0.47.93.1 kernel-trace-devel-3.0.101-0.47.93.1 kernel-xen-3.0.101-0.47.93.1 kernel-xen-base-3.0.101-0.47.93.1 kernel-xen-devel-3.0.101-0.47.93.1 - SUSE Manager Proxy 2.1 (x86_64): kernel-bigsmp-3.0.101-0.47.93.1 kernel-bigsmp-base-3.0.101-0.47.93.1 kernel-bigsmp-devel-3.0.101-0.47.93.1 kernel-default-3.0.101-0.47.93.1 kernel-default-base-3.0.101-0.47.93.1 kernel-default-devel-3.0.101-0.47.93.1 kernel-ec2-3.0.101-0.47.93.1 kernel-ec2-base-3.0.101-0.47.93.1 kernel-ec2-devel-3.0.101-0.47.93.1 kernel-source-3.0.101-0.47.93.1 kernel-syms-3.0.101-0.47.93.1 kernel-trace-3.0.101-0.47.93.1 kernel-trace-base-3.0.101-0.47.93.1 kernel-trace-devel-3.0.101-0.47.93.1 kernel-xen-3.0.101-0.47.93.1 kernel-xen-base-3.0.101-0.47.93.1 kernel-xen-devel-3.0.101-0.47.93.1 - SUSE Manager 2.1 (s390x x86_64): kernel-default-3.0.101-0.47.93.1 kernel-default-base-3.0.101-0.47.93.1 kernel-default-devel-3.0.101-0.47.93.1 kernel-source-3.0.101-0.47.93.1 kernel-syms-3.0.101-0.47.93.1 kernel-trace-3.0.101-0.47.93.1 kernel-trace-base-3.0.101-0.47.93.1 kernel-trace-devel-3.0.101-0.47.93.1 - SUSE Manager 2.1 (x86_64): kernel-bigsmp-3.0.101-0.47.93.1 kernel-bigsmp-base-3.0.101-0.47.93.1 kernel-bigsmp-devel-3.0.101-0.47.93.1 kernel-ec2-3.0.101-0.47.93.1 kernel-ec2-base-3.0.101-0.47.93.1 kernel-ec2-devel-3.0.101-0.47.93.1 kernel-xen-3.0.101-0.47.93.1 kernel-xen-base-3.0.101-0.47.93.1 kernel-xen-devel-3.0.101-0.47.93.1 - SUSE Manager 2.1 (s390x): kernel-default-man-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.47.93.1 kernel-default-base-3.0.101-0.47.93.1 kernel-default-devel-3.0.101-0.47.93.1 kernel-source-3.0.101-0.47.93.1 kernel-syms-3.0.101-0.47.93.1 kernel-trace-3.0.101-0.47.93.1 kernel-trace-base-3.0.101-0.47.93.1 kernel-trace-devel-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.47.93.1 kernel-ec2-base-3.0.101-0.47.93.1 kernel-ec2-devel-3.0.101-0.47.93.1 kernel-xen-3.0.101-0.47.93.1 kernel-xen-base-3.0.101-0.47.93.1 kernel-xen-devel-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): kernel-bigsmp-3.0.101-0.47.93.1 kernel-bigsmp-base-3.0.101-0.47.93.1 kernel-bigsmp-devel-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x): kernel-default-man-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): kernel-pae-3.0.101-0.47.93.1 kernel-pae-base-3.0.101-0.47.93.1 kernel-pae-devel-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.93.1 kernel-trace-extra-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.93.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.93.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): kernel-default-3.0.101-0.47.93.1 kernel-default-base-3.0.101-0.47.93.1 kernel-default-devel-3.0.101-0.47.93.1 kernel-ec2-3.0.101-0.47.93.1 kernel-ec2-base-3.0.101-0.47.93.1 kernel-ec2-devel-3.0.101-0.47.93.1 kernel-pae-3.0.101-0.47.93.1 kernel-pae-base-3.0.101-0.47.93.1 kernel-pae-devel-3.0.101-0.47.93.1 kernel-source-3.0.101-0.47.93.1 kernel-syms-3.0.101-0.47.93.1 kernel-trace-3.0.101-0.47.93.1 kernel-trace-base-3.0.101-0.47.93.1 kernel-trace-devel-3.0.101-0.47.93.1 kernel-xen-3.0.101-0.47.93.1 kernel-xen-base-3.0.101-0.47.93.1 kernel-xen-devel-3.0.101-0.47.93.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.93.1 kernel-default-debugsource-3.0.101-0.47.93.1 kernel-trace-debuginfo-3.0.101-0.47.93.1 kernel-trace-debugsource-3.0.101-0.47.93.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.93.1 kernel-ec2-debugsource-3.0.101-0.47.93.1 kernel-xen-debuginfo-3.0.101-0.47.93.1 kernel-xen-debugsource-3.0.101-0.47.93.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.93.1 kernel-bigsmp-debugsource-3.0.101-0.47.93.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.93.1 kernel-pae-debugsource-3.0.101-0.47.93.1 References: https://www.suse.com/security/cve/CVE-2016-9576.html https://www.suse.com/security/cve/CVE-2016-9794.html https://bugzilla.suse.com/1013533 https://bugzilla.suse.com/1013604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3247-1: important: Security update for Linux Kernel Live Patch 16 for SLE 12
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for Linux Kernel Live Patch 16 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3247-1 Rating: important References: #1012183 #1012759 Cross-References: CVE-2016-8655 CVE-2016-9555 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.60-52_57 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1892=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1892=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_57-default-2-2.1 kgraft-patch-3_12_60-52_57-xen-2-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_57-default-2-2.1 kgraft-patch-3_12_60-52_57-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2016-8655.html https://www.suse.com/security/cve/CVE-2016-9555.html https://bugzilla.suse.com/1012183 https://bugzilla.suse.com/1012759 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3241-1: important: Security update for xen
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3241-1 Rating: important References: #1012651 #1014298 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-9932 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1885=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1885=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): xen-4.4.4_05-22.28.2 xen-debugsource-4.4.4_05-22.28.2 xen-doc-html-4.4.4_05-22.28.2 xen-kmp-default-4.4.4_05_k3.12.60_52.63-22.28.2 xen-kmp-default-debuginfo-4.4.4_05_k3.12.60_52.63-22.28.2 xen-libs-32bit-4.4.4_05-22.28.2 xen-libs-4.4.4_05-22.28.2 xen-libs-debuginfo-32bit-4.4.4_05-22.28.2 xen-libs-debuginfo-4.4.4_05-22.28.2 xen-tools-4.4.4_05-22.28.2 xen-tools-debuginfo-4.4.4_05-22.28.2 xen-tools-domU-4.4.4_05-22.28.2 xen-tools-domU-debuginfo-4.4.4_05-22.28.2 - SUSE Linux Enterprise Server 12-LTSS (x86_64): xen-4.4.4_05-22.28.2 xen-debugsource-4.4.4_05-22.28.2 xen-doc-html-4.4.4_05-22.28.2 xen-kmp-default-4.4.4_05_k3.12.60_52.63-22.28.2 xen-kmp-default-debuginfo-4.4.4_05_k3.12.60_52.63-22.28.2 xen-libs-32bit-4.4.4_05-22.28.2 xen-libs-4.4.4_05-22.28.2 xen-libs-debuginfo-32bit-4.4.4_05-22.28.2 xen-libs-debuginfo-4.4.4_05-22.28.2 xen-tools-4.4.4_05-22.28.2 xen-tools-debuginfo-4.4.4_05-22.28.2 xen-tools-domU-4.4.4_05-22.28.2 xen-tools-domU-debuginfo-4.4.4_05-22.28.2 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:3233-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3233-1 Rating: important References: #1009318 #1013376 #1014159 Cross-References: CVE-2016-8707 CVE-2016-8862 CVE-2016-8866 CVE-2016-9556 CVE-2016-9773 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This security update for ImageMagick fixes the following issues: - a maliciously crafted compressed TIFF image could cause code remote code execution in the convert utility in particular circumstances (CVE-2016-8707, boo#1014159) - a memory allocation failure was fixed (CVE-2016-8866, boo#1009318, follow up on CVE-2016-8862) - the identify utility could crash on maliciously crafted images (CVE-2016-9773, boo#1013376, follow up on CVE-2016-9556) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-45.1 ImageMagick-debuginfo-6.8.9.8-45.1 ImageMagick-debugsource-6.8.9.8-45.1 ImageMagick-devel-6.8.9.8-45.1 ImageMagick-extra-6.8.9.8-45.1 ImageMagick-extra-debuginfo-6.8.9.8-45.1 libMagick++-6_Q16-5-6.8.9.8-45.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-45.1 libMagick++-devel-6.8.9.8-45.1 libMagickCore-6_Q16-2-6.8.9.8-45.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-45.1 libMagickWand-6_Q16-2-6.8.9.8-45.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-45.1 perl-PerlMagick-6.8.9.8-45.1 perl-PerlMagick-debuginfo-6.8.9.8-45.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-45.1 libMagick++-6_Q16-5-32bit-6.8.9.8-45.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-45.1 libMagick++-devel-32bit-6.8.9.8-45.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-45.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-45.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-45.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-45.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-45.1 References: https://www.suse.com/security/cve/CVE-2016-8707.html https://www.suse.com/security/cve/CVE-2016-8862.html https://www.suse.com/security/cve/CVE-2016-8866.html https://www.suse.com/security/cve/CVE-2016-9556.html https://www.suse.com/security/cve/CVE-2016-9773.html https://bugzilla.suse.com/1009318 https://bugzilla.suse.com/1013376 https://bugzilla.suse.com/1014159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3223-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3223-1 Rating: important References: #1000751 #1015422 Cross-References: CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: * MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES * MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution * MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees * MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements * MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms * MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments * MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag * MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs * MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 * MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information. - Fix fontconfig issue (bsc#1000751) on 32bit systems as well. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-MozillaFirefox-12907=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-MozillaFirefox-12907=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): MozillaFirefox-45.6.0esr-66.1 MozillaFirefox-translations-45.6.0esr-66.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): MozillaFirefox-debuginfo-45.6.0esr-66.1 MozillaFirefox-debugsource-45.6.0esr-66.1 References: https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9904.html https://www.suse.com/security/cve/CVE-2016-9905.html https://bugzilla.suse.com/1000751 https://bugzilla.suse.com/1015422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3222-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3222-1 Rating: important References: #1015422 Cross-References: CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: * MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES * MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution * MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees * MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements * MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms * MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments * MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag * MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs * MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 * MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1880=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1880=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1880=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2016-1880=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1880=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1880=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1880=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1880=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1880=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-devel-45.6.0esr-96.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-devel-45.6.0esr-96.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-45.6.0esr-96.1 MozillaFirefox-debuginfo-45.6.0esr-96.1 MozillaFirefox-debugsource-45.6.0esr-96.1 MozillaFirefox-translations-45.6.0esr-96.1 References: https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9904.html https://www.suse.com/security/cve/CVE-2016-9905.html https://bugzilla.suse.com/1015422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0