February 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:0585-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 25 Feb '16

25 Feb '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0585-1 Rating: important References: #812259 #855062 #867583 #899908 #902606 #924919 #935087 #937261 #937444 #938577 #940338 #940946 #941363 #942476 #943989 #944749 #945649 #947953 #949440 #949936 #950292 #951199 #951392 #951615 #952579 #952976 #954992 #955118 #955354 #955654 #956514 #956708 #957525 #957988 #957990 #958463 #958886 #958951 #959090 #959146 #959190 #959257 #959364 #959399 #959436 #959463 #959629 #960221 #960227 #960281 #960300 #961202 #961257 #961500 #961509 #961516 #961588 #961971 #962336 #962356 #962788 #962965 #963449 #963572 #963765 #963767 #963825 #964230 #964821 #965344 #965840 Cross-References: CVE-2013-7446 CVE-2015-0272 CVE-2015-5707 CVE-2015-7550 CVE-2015-7799 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8550 CVE-2015-8551 CVE-2015-8569 CVE-2015-8575 CVE-2015-8660 CVE-2015-8767 CVE-2015-8785 CVE-2016-0723 CVE-2016-2069 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has 54 fixes is now available. Description: The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.53 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654). - CVE-2015-5707: Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request (bnc#940338). - CVE-2015-7550: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls (bnc#958951). - CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936). - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that was (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272 (bnc#955354). - CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c (bnc#958463). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886). - CVE-2015-8550: Optimizations introduced by the compiler could have lead to double fetch vulnerabilities, potentially possibly leading to arbitrary code execution in backend (bsc#957988). - CVE-2015-8551: Xen PCI backend driver did not perform proper sanity checks on the device's state, allowing for DoS (bsc#957990). - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8575: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959399). - CVE-2015-8660: The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel attempted to merge distinct setattr operations, which allowed local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application (bnc#960281). - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux kernel did not properly manage the relationship between a lock and a socket, which allowed local users to cause a denial of service (deadlock) via a crafted sctp_accept call (bnc#961509). - CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel allowed local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov (bnc#963765). - CVE-2016-0723: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). - CVE-2016-2069: A race in invalidating paging structures that were not in use locally could have lead to disclosoure of information or arbitrary code exectution (bnc#963767). The following non-security bugs were fixed: - ACPI: Introduce apic_id in struct processor to save parsed APIC id (bsc#959463). - ACPI: Make it possible to get local x2apic id via _MAT (bsc#959463). - ACPI: use apic_id and remove duplicated _MAT evaluation (bsc#959463). - ACPICA: Correctly cleanup after a ACPI table load failure (bnc#937261). - Add sd_mod to initrd modules. For some reason PowerVM backend can't work without sd_mod - Do not modify perf bias performance setting by default at boot (bnc#812259, bsc#959629). - Documentation: Document kernel.panic_on_io_nmi sysctl (bsc#940946, bsc#937444). - Driver for IBM System i/p VNIC protocol - Drop blktap patches from SLE12, since the driver is unsupported - Improve fairness when locking the per-superblock s_anon list (bsc#957525, bsc#941363). - Input: aiptek - fix crash on detecting device without endpoints (bnc#956708). - NFSD: Do not start lockd when only NFSv4 is running - NFSv4: Recovery of recalled read delegations is broken (bsc#956514). - Replace with 176bed1d vmstat: explicitly schedule per-cpu work on the CPU we need it to run on - Revert "ipv6: add complete rcu protection around np->opt" (bnc#961257). - Revert 874bbfe60 workqueue: make sure delayed work run in local cpu 1. Without 22b886dd, 874bbfe60 leads to timer corruption. 2. With 22b886dd applied, victim of 1 reports performance regression (1,2 https://lkml.org/lkml/2016/2/4/618) 3. Leads to scheduling work to offlined CPU (bnc#959463). SLERT: 4. NO_HZ_FULL regressession, unbound delayed work timer is no longer deflected to a housekeeper CPU. - be2net: fix some log messages (bnc#855062, bnc#867583). - blktap: also call blkif_disconnect() when frontend switched to closed (bsc#952976). - blktap: refine mm tracking (bsc#952976). - block: Always check queue limits for cloned requests (bsc#902606). - block: Always check queue limits for cloned requests (bsc#902606). - bnx2x: Add new device ids under the Qlogic vendor (bnc#964821). - btrfs: Add qgroup tracing (bnc#935087, bnc#945649). - btrfs: Update btrfs qgroup status item when rescan is done (bnc#960300). - btrfs: backref: Add special time_seq == (u64)-1 case for btrfs_find_all_roots() (bnc#935087, bnc#945649). - btrfs: backref: Do not merge refs which are not for same block (bnc#935087, bnc#945649). - btrfs: delayed-ref: Cleanup the unneeded functions (bnc#935087, bnc#945649). - btrfs: delayed-ref: Use list to replace the ref_root in ref_head (bnc#935087, bnc#945649). - btrfs: extent-tree: Use ref_node to replace unneeded parameters in __inc_extent_ref() and __free_extent() (bnc#935087, bnc#945649). - btrfs: fix comp_oper to get right order (bnc#935087, bnc#945649). - btrfs: fix deadlock between direct IO write and defrag/readpages (bnc#965344). - btrfs: fix leak in qgroup_subtree_accounting() error path (bnc#935087, bnc#945649). - btrfs: fix order by which delayed references are run (bnc#949440). - btrfs: fix qgroup sanity tests (bnc#951615). - btrfs: fix race waiting for qgroup rescan worker (bnc#960300). - btrfs: fix regression running delayed references when using qgroups (bnc#951615). - btrfs: fix regression when running delayed references (bnc#951615). - btrfs: fix sleeping inside atomic context in qgroup rescan worker (bnc#960300). - btrfs: keep dropped roots in cache until transaction commit (bnc#935087, bnc#945649). - btrfs: qgroup: Add function qgroup_update_counters() (bnc#935087, bnc#945649). - btrfs: qgroup: Add function qgroup_update_refcnt() (bnc#935087, bnc#945649). - btrfs: qgroup: Add new function to record old_roots (bnc#935087, bnc#945649). - btrfs: qgroup: Add new qgroup calculation function btrfs_qgroup_account_extents() (bnc#935087, bnc#945649). - btrfs: qgroup: Add the ability to skip given qgroup for old/new_roots (bnc#935087, bnc#945649). - btrfs: qgroup: Cleanup open-coded old/new_refcnt update and read (bnc#935087, bnc#945649). - btrfs: qgroup: Cleanup the old ref_node-oriented mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Do not copy extent buffer to do qgroup rescan (bnc#960300). - btrfs: qgroup: Fix a regression in qgroup reserved space (bnc#935087, bnc#945649). - btrfs: qgroup: Make snapshot accounting work with new extent-oriented qgroup (bnc#935087, bnc#945649). - btrfs: qgroup: Record possible quota-related extent for qgroup (bnc#935087, bnc#945649). - btrfs: qgroup: Switch rescan to new mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Switch self test to extent-oriented qgroup mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Switch to new extent-oriented qgroup mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: account shared subtree during snapshot delete (bnc#935087, bnc#945649). - btrfs: qgroup: clear STATUS_FLAG_ON in disabling quota (bnc#960300). - btrfs: qgroup: exit the rescan worker during umount (bnc#960300). - btrfs: qgroup: fix quota disable during rescan (bnc#960300). - btrfs: qgroup: move WARN_ON() to the correct location (bnc#935087, bnc#945649). - btrfs: remove transaction from send (bnc#935087, bnc#945649). - btrfs: skip locking when searching commit root (bnc#963825). - btrfs: ulist: Add ulist_del() function (bnc#935087, bnc#945649). - btrfs: use btrfs_get_fs_root in resolve_indirect_ref (bnc#935087, bnc#945649). - crypto: nx - use common code for both NX decompress success cases (bsc#942476). - crypto: nx-842 - Mask XERS0 bit in return value (bsc#960221). - driver core: Add BUS_NOTIFY_REMOVED_DEVICE event (bnc#962965). - drivers/firmware/memmap.c: do not allocate firmware_map_entry of same memory range (bsc#959463). - drivers/firmware/memmap.c: do not create memmap sysfs of same firmware_map_entry (bsc#959463). - drivers/firmware/memmap.c: pass the correct argument to firmware_map_find_entry_bootmem() (bsc#959463). - e1000e: Do not read ICR in Other interrupt (bsc#924919). - e1000e: Do not write lsc to ics in msi-x mode (bsc#924919). - e1000e: Fix msi-x interrupt automask (bsc#924919). - e1000e: Remove unreachable code (bsc#924919). - fuse: break infinite loop in fuse_fill_write_pages() (bsc#963765). - group-source-files: mark module.lds as devel file ld: cannot open linker script file /usr/src/linux-4.2.5-1/arch/arm/kernel/module.lds: No such file or directory - ipv6: fix tunnel error handling (bsc#952579). - jbd2: Fix unreclaimed pages after truncate in data=journal mode (bsc#961516). - kABI: reintroduce blk_rq_check_limits. - kabi: protect struct acpi_processor signature (bsc#959463). - kernel/watchdog.c: perform all-CPU backtrace in case of hard lockup (bsc#940946, bsc#937444). - kernel: Change ASSIGN_ONCE(val, x) to WRITE_ONCE(x, val) (bsc#940946, bsc#937444). - kernel: Provide READ_ONCE and ASSIGN_ONCE (bsc#940946, bsc#937444). - kernel: inadvertent free of the vector register save area (bnc#961202). - kexec: Fix race between panic() and crash_kexec() (bsc#940946, bsc#937444). - kgr: Remove the confusing search for fentry - kgr: Safe way to avoid an infinite redirection - kgr: do not print error for !abort_if_missing symbols (bnc#943989). - kgr: do not use WQ_MEM_RECLAIM workqueue (bnc#963572). - kgr: log when modifying kernel - kgr: mark some more missed kthreads (bnc#962336). - kgr: usb/storage: do not emit thread awakened (bnc#899908). - kvm: Add arch specific mmu notifier for page invalidation (bsc#959463). - kvm: Make init_rmode_identity_map() return 0 on success (bsc#959463). - kvm: Remove ept_identity_pagetable from struct kvm_arch (bsc#959463). - kvm: Rename make_all_cpus_request() to kvm_make_all_cpus_request() and make it non-static (bsc#959463). - kvm: Use APIC_DEFAULT_PHYS_BASE macro as the apic access page address (bsc#959463). - kvm: vmx: Implement set_apic_access_page_addr (bsc#959463). - kvm: x86: Add request bit to reload APIC access page address (bsc#959463). - kvm: x86: Unpin and remove kvm_arch->apic_access_page (bsc#959463). - libiscsi: Fix host busy blocking during connection teardown. - lpfc: Fix null ndlp dereference in target_reset_handler (bsc#951392). - md/bitmap: do not pass -1 to bitmap_storage_alloc (bsc#955118). - md/bitmap: remove confusing code from filemap_get_page. - md/bitmap: remove rcu annotation from pointer arithmetic. - mem-hotplug: reset node managed pages when hot-adding a new pgdat (bsc#959463). - mem-hotplug: reset node present pages when hot-adding a new pgdat (bsc#959463). - memory-hotplug: clear pgdat which is allocated by bootmem in try_offline_node() (bsc#959463). - mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() (VM Functionality, bnc#961588). - mm/mempolicy.c: convert the shared_policy lock to a rwlock (VM Performance, bnc#959436). - module: keep percpu symbols in module's symtab (bsc#962788). - nmi: provide the option to issue an NMI back trace to every cpu but current (bsc#940946, bsc#937444). - nmi: provide the option to issue an NMI back trace to every cpu but current (bsc#940946, bsc#937444). - nvme: Clear BIO_SEG_VALID flag in nvme_bio_split() (bsc#954992). - panic, x86: Allow CPUs to save registers even if looping in NMI context (bsc#940946, bsc#937444). - panic, x86: Fix re-entrance problem due to panic on NMI (bsc#940946, bsc#937444). - pci: Check for valid tags when calculating the VPD size (bsc#959146). - qeth: initialize net_device with carrier off (bnc#964230). - rpm/constraints.in: Bump disk space requirements up a bit Require 10GB on s390x, 20GB elsewhere. - rpm/kernel-binary.spec.in: Fix build if no UEFI certs are installed - rpm/kernel-binary.spec.in: Fix kernel-vanilla-devel dependency (bsc#959090) - rpm/kernel-binary.spec.in: Fix paths in kernel-vanilla-devel (bsc#959090). - rpm/kernel-binary.spec.in: Install libopenssl-devel for newer sign-file - rpm/kernel-binary.spec.in: Use bzip compression to speed up build (bsc#962356) - rpm/kernel-source.spec.in: Install kernel-macros for kernel-source-vanilla (bsc#959090) - rpm/kernel-spec-macros: Do not modify the release string in PTFs (bsc#963449) - rpm/package-descriptions: Add kernel-zfcpdump and drop -desktop - s390/cio: ensure consistent measurement state (bnc#964230). - s390/cio: fix measurement characteristics memleak (bnc#964230). - s390/cio: update measurement characteristics (bnc#964230). - s390/dasd: fix failfast for disconnected devices (bnc#961202). - s390/vtime: correct scaled cputime for SMT (bnc#964230). - s390/vtime: correct scaled cputime of partially idle CPUs (bnc#964230). - s390/vtime: limit MT scaling value updates (bnc#964230). - sched,numa: cap pte scanning overhead to 3% of run time (Automatic NUMA Balancing). - sched/fair: Care divide error in update_task_scan_period() (bsc#959463). - sched/fair: Disable tg load_avg/runnable_avg update for root_task_group (bnc#960227). - sched/fair: Move cache hot load_avg/runnable_avg into separate cacheline (bnc#960227). - sched/numa: Cap PTE scanning overhead to 3% of run time (Automatic NUMA Balancing). - sched: Fix race between task_group and sched_task_group (Automatic NUMA Balancing). - scsi: restart list search after unlock in scsi_remove_target (bsc#944749, bsc#959257). - supported.conf: Add more QEMU and VMware drivers to -base (bsc#965840). - supported.conf: Add netfilter modules to base (bsc#950292) - supported.conf: Add nls_iso8859-1 and nls_cp437 to -base (bsc#950292) - supported.conf: Add vfat to -base to be able to mount the ESP (bsc#950292). - supported.conf: Add virtio_{blk,net,scsi} to kernel-default-base (bsc#950292) - supported.conf: Also add virtio_pci to kernel-default-base (bsc#950292). - supported.conf: drop +external from ghash-clmulni-intel It was agreed that it does not make sense to maintain "external" for this specific module. Furthermore it causes problems in rather ordinary VMware environments. (bsc#961971) - udp: properly support MSG_PEEK with truncated buffers (bsc#951199 bsc#959364). - x86, xsave: Support eager-only xsave features, add MPX support (bsc#938577). - x86/apic: Introduce apic_extnmi command line parameter (bsc#940946, bsc#937444). - x86/fpu/xstate: Do not assume the first zero xfeatures zero bit means the end (bsc#938577). - x86/fpu: Fix double-increment in setup_xstate_features() (bsc#938577). - x86/fpu: Remove xsave_init() bootmem allocations (bsc#938577). - x86/nmi: Save regs in crash dump on external NMI (bsc#940946, bsc#937444). - x86/nmi: Save regs in crash dump on external NMI (bsc#940946, bsc#937444). - xen/pciback: Do not allow MSI-X ops if PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157). - xfs: add a few more verifier tests (bsc#947953). - xfs: fix double free in xlog_recover_commit_trans (bsc#947953). - xfs: recovery of XLOG_UNMOUNT_TRANS leaks memory (bsc#947953). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-329=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-329=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-329=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2016-329=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-329=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-329=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): kernel-default-debuginfo-3.12.53-60.30.1 kernel-default-debugsource-3.12.53-60.30.1 kernel-default-extra-3.12.53-60.30.1 kernel-default-extra-debuginfo-3.12.53-60.30.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): kernel-obs-build-3.12.53-60.30.2 kernel-obs-build-debugsource-3.12.53-60.30.2 - SUSE Linux Enterprise Software Development Kit 12-SP1 (noarch): kernel-docs-3.12.53-60.30.2 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): kernel-default-3.12.53-60.30.1 kernel-default-base-3.12.53-60.30.1 kernel-default-base-debuginfo-3.12.53-60.30.1 kernel-default-debuginfo-3.12.53-60.30.1 kernel-default-debugsource-3.12.53-60.30.1 kernel-default-devel-3.12.53-60.30.1 kernel-syms-3.12.53-60.30.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): kernel-xen-3.12.53-60.30.1 kernel-xen-base-3.12.53-60.30.1 kernel-xen-base-debuginfo-3.12.53-60.30.1 kernel-xen-debuginfo-3.12.53-60.30.1 kernel-xen-debugsource-3.12.53-60.30.1 kernel-xen-devel-3.12.53-60.30.1 lttng-modules-2.7.0-3.1 lttng-modules-debugsource-2.7.0-3.1 lttng-modules-kmp-default-2.7.0_k3.12.53_60.30-3.1 lttng-modules-kmp-default-debuginfo-2.7.0_k3.12.53_60.30-3.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): kernel-devel-3.12.53-60.30.1 kernel-macros-3.12.53-60.30.1 kernel-source-3.12.53-60.30.1 - SUSE Linux Enterprise Server 12-SP1 (s390x): kernel-default-man-3.12.53-60.30.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.53-60.30.1 kernel-ec2-debuginfo-3.12.53-60.30.1 kernel-ec2-debugsource-3.12.53-60.30.1 kernel-ec2-devel-3.12.53-60.30.1 kernel-ec2-extra-3.12.53-60.30.1 kernel-ec2-extra-debuginfo-3.12.53-60.30.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_53-60_30-default-1-2.1 kgraft-patch-3_12_53-60_30-xen-1-2.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): kernel-default-3.12.53-60.30.1 kernel-default-debuginfo-3.12.53-60.30.1 kernel-default-debugsource-3.12.53-60.30.1 kernel-default-devel-3.12.53-60.30.1 kernel-default-extra-3.12.53-60.30.1 kernel-default-extra-debuginfo-3.12.53-60.30.1 kernel-syms-3.12.53-60.30.1 kernel-xen-3.12.53-60.30.1 kernel-xen-debuginfo-3.12.53-60.30.1 kernel-xen-debugsource-3.12.53-60.30.1 kernel-xen-devel-3.12.53-60.30.1 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): kernel-devel-3.12.53-60.30.1 kernel-macros-3.12.53-60.30.1 kernel-source-3.12.53-60.30.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2015-0272.html https://www.suse.com/security/cve/CVE-2015-5707.html https://www.suse.com/security/cve/CVE-2015-7550.html https://www.suse.com/security/cve/CVE-2015-7799.html https://www.suse.com/security/cve/CVE-2015-8215.html https://www.suse.com/security/cve/CVE-2015-8539.html https://www.suse.com/security/cve/CVE-2015-8543.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8551.html https://www.suse.com/security/cve/CVE-2015-8569.html https://www.suse.com/security/cve/CVE-2015-8575.html https://www.suse.com/security/cve/CVE-2015-8660.html https://www.suse.com/security/cve/CVE-2015-8767.html https://www.suse.com/security/cve/CVE-2015-8785.html https://www.suse.com/security/cve/CVE-2016-0723.html https://www.suse.com/security/cve/CVE-2016-2069.html https://bugzilla.suse.com/812259 https://bugzilla.suse.com/855062 https://bugzilla.suse.com/867583 https://bugzilla.suse.com/899908 https://bugzilla.suse.com/902606 https://bugzilla.suse.com/924919 https://bugzilla.suse.com/935087 https://bugzilla.suse.com/937261 https://bugzilla.suse.com/937444 https://bugzilla.suse.com/938577 https://bugzilla.suse.com/940338 https://bugzilla.suse.com/940946 https://bugzilla.suse.com/941363 https://bugzilla.suse.com/942476 https://bugzilla.suse.com/943989 https://bugzilla.suse.com/944749 https://bugzilla.suse.com/945649 https://bugzilla.suse.com/947953 https://bugzilla.suse.com/949440 https://bugzilla.suse.com/949936 https://bugzilla.suse.com/950292 https://bugzilla.suse.com/951199 https://bugzilla.suse.com/951392 https://bugzilla.suse.com/951615 https://bugzilla.suse.com/952579 https://bugzilla.suse.com/952976 https://bugzilla.suse.com/954992 https://bugzilla.suse.com/955118 https://bugzilla.suse.com/955354 https://bugzilla.suse.com/955654 https://bugzilla.suse.com/956514 https://bugzilla.suse.com/956708 https://bugzilla.suse.com/957525 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/957990 https://bugzilla.suse.com/958463 https://bugzilla.suse.com/958886 https://bugzilla.suse.com/958951 https://bugzilla.suse.com/959090 https://bugzilla.suse.com/959146 https://bugzilla.suse.com/959190 https://bugzilla.suse.com/959257 https://bugzilla.suse.com/959364 https://bugzilla.suse.com/959399 https://bugzilla.suse.com/959436 https://bugzilla.suse.com/959463 https://bugzilla.suse.com/959629 https://bugzilla.suse.com/960221 https://bugzilla.suse.com/960227 https://bugzilla.suse.com/960281 https://bugzilla.suse.com/960300 https://bugzilla.suse.com/961202 https://bugzilla.suse.com/961257 https://bugzilla.suse.com/961500 https://bugzilla.suse.com/961509 https://bugzilla.suse.com/961516 https://bugzilla.suse.com/961588 https://bugzilla.suse.com/961971 https://bugzilla.suse.com/962336 https://bugzilla.suse.com/962356 https://bugzilla.suse.com/962788 https://bugzilla.suse.com/962965 https://bugzilla.suse.com/963449 https://bugzilla.suse.com/963572 https://bugzilla.suse.com/963765 https://bugzilla.suse.com/963767 https://bugzilla.suse.com/963825 https://bugzilla.suse.com/964230 https://bugzilla.suse.com/964821 https://bugzilla.suse.com/965344 https://bugzilla.suse.com/965840 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0578-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 25 Feb '16

25 Feb '16

openSUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0578-1 Rating: important References: #578053 #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql94 fixes the following issues: - Security and bugfix release 9.4.6: * *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries. * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html - PL/Perl still needs to be linked with rpath, so that it can find libperl.so at runtime. bsc#578053, postgresql-plperl-keep-rpath.patch This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libecpg6-9.4.6-4.1 libecpg6-debuginfo-9.4.6-4.1 libpq5-9.4.6-4.1 libpq5-debuginfo-9.4.6-4.1 postgresql94-9.4.6-4.1 postgresql94-contrib-9.4.6-4.1 postgresql94-contrib-debuginfo-9.4.6-4.1 postgresql94-debuginfo-9.4.6-4.1 postgresql94-debugsource-9.4.6-4.1 postgresql94-devel-9.4.6-4.1 postgresql94-devel-debuginfo-9.4.6-4.1 postgresql94-libs-debugsource-9.4.6-4.1 postgresql94-plperl-9.4.6-4.1 postgresql94-plperl-debuginfo-9.4.6-4.1 postgresql94-plpython-9.4.6-4.1 postgresql94-plpython-debuginfo-9.4.6-4.1 postgresql94-pltcl-9.4.6-4.1 postgresql94-pltcl-debuginfo-9.4.6-4.1 postgresql94-server-9.4.6-4.1 postgresql94-server-debuginfo-9.4.6-4.1 postgresql94-test-9.4.6-4.1 - openSUSE Leap 42.1 (x86_64): libecpg6-32bit-9.4.6-4.1 libecpg6-debuginfo-32bit-9.4.6-4.1 libpq5-32bit-9.4.6-4.1 libpq5-debuginfo-32bit-9.4.6-4.1 - openSUSE Leap 42.1 (noarch): postgresql94-docs-9.4.6-4.1 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/578053 https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0564-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Feb '16

24 Feb '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0564-1 Rating: important References: #967087 Cross-References: CVE-2016-1523 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox fixes the following issues: - update to Firefox 38.6.1 ESR (bsc#967087) * MFSA 2016-14/CVE-2016-1523 (bmo#1246093) Vulnerabilities in Graphite 2 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-12416=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-12416=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-MozillaFirefox-12416=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-12416=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-38.6.1esr-34.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-38.6.1esr-34.1 MozillaFirefox-translations-38.6.1esr-34.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): MozillaFirefox-38.6.1esr-34.1 MozillaFirefox-translations-38.6.1esr-34.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-38.6.1esr-34.1 MozillaFirefox-debugsource-38.6.1esr-34.1 References: https://www.suse.com/security/cve/CVE-2016-1523.html https://bugzilla.suse.com/967087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0555-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 24 Feb '16

24 Feb '16

SUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0555-1 Rating: important References: #578053 #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql94 fixes the following issues: - Security and bugfix release 9.4.6: * *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries. * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html - PL/Perl still needs to be linked with rpath, so that it can find libperl.so at runtime. bsc#578053, postgresql-plperl-keep-rpath.patch Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-306=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-306=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-306=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-306=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-306=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-306=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): postgresql94-devel-9.4.6-7.1 postgresql94-devel-debuginfo-9.4.6-7.1 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): postgresql94-devel-9.4.6-7.1 postgresql94-devel-debuginfo-9.4.6-7.1 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-contrib-9.4.6-7.2 postgresql94-contrib-debuginfo-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 postgresql94-server-9.4.6-7.2 postgresql94-server-debuginfo-9.4.6-7.2 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libpq5-32bit-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): postgresql94-docs-9.4.6-7.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-contrib-9.4.6-7.2 postgresql94-contrib-debuginfo-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 postgresql94-server-9.4.6-7.2 postgresql94-server-debuginfo-9.4.6-7.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libpq5-32bit-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 - SUSE Linux Enterprise Server 12 (noarch): postgresql94-docs-9.4.6-7.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-32bit-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-32bit-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/578053 https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0554-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Feb '16

24 Feb '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0554-1 Rating: important References: #967087 Cross-References: CVE-2016-1523 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox fixes the following issues: - update to Firefox 38.6.1 ESR (bsc#967087) * MFSA 2016-14/CVE-2016-1523 (bmo#1246093) Vulnerabilities in Graphite 2 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-307=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-307=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-307=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-307=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-307=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-307=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-devel-38.6.1esr-60.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-devel-38.6.1esr-60.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 References: https://www.suse.com/security/cve/CVE-2016-1523.html https://bugzilla.suse.com/967087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0539-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 22 Feb '16

22 Feb '16

SUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0539-1 Rating: important References: #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.3/static/release-9-3-11.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-292=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-292=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-292=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): postgresql93-devel-9.3.11-14.1 postgresql93-devel-debuginfo-9.3.11-14.1 postgresql93-libs-debugsource-9.3.11-14.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): postgresql93-9.3.11-14.2 postgresql93-contrib-9.3.11-14.2 postgresql93-contrib-debuginfo-9.3.11-14.2 postgresql93-debuginfo-9.3.11-14.2 postgresql93-debugsource-9.3.11-14.2 postgresql93-server-9.3.11-14.2 postgresql93-server-debuginfo-9.3.11-14.2 - SUSE Linux Enterprise Server 12 (noarch): postgresql93-docs-9.3.11-14.2 - SUSE Linux Enterprise Desktop 12 (x86_64): postgresql93-9.3.11-14.2 postgresql93-debuginfo-9.3.11-14.2 postgresql93-debugsource-9.3.11-14.2 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0537-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Feb '16

22 Feb '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0537-1 Rating: important References: #907378 #961500 #963767 #965308 #965356 Cross-References: CVE-2016-0723 CVE-2016-2069 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: The openSUSE 13.2 kernel was updated to receive security and bugfixes. It also fixes a regression that caused the Chromium sandbox to no longer work (bsc#965356). Following security bugs were fixed: - CVE-2016-2069: A flaw was discovered in a way the Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question, causing a local denial service (machine crash). (bnc#963767). - CVE-2016-0723: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). The following non-security bugs were fixed: - Bluetooth: ath3k: workaround the compatibility issue with xHCI controller (bnc#907378). - kABI fix for addition of user_namespace.flags field (bnc#965308, bnc#965356). - userns: Add a knob to disable setgroups on a per user namespace basis (bnc#965308, bnc#965356). - userns: Allow setting gid_maps without privilege when setgroups is disabled (bnc#965308, bnc#965356). - userns: Rename id_map_mutex to userns_state_mutex (bnc#965308, bnc#965356). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-256=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i686 x86_64): kernel-debug-3.16.7-35.1 kernel-debug-base-3.16.7-35.1 kernel-debug-base-debuginfo-3.16.7-35.1 kernel-debug-debuginfo-3.16.7-35.1 kernel-debug-debugsource-3.16.7-35.1 kernel-debug-devel-3.16.7-35.1 kernel-debug-devel-debuginfo-3.16.7-35.1 kernel-desktop-3.16.7-35.1 kernel-desktop-base-3.16.7-35.1 kernel-desktop-base-debuginfo-3.16.7-35.1 kernel-desktop-debuginfo-3.16.7-35.1 kernel-desktop-debugsource-3.16.7-35.1 kernel-desktop-devel-3.16.7-35.1 kernel-ec2-base-debuginfo-3.16.7-35.1 kernel-ec2-debuginfo-3.16.7-35.1 kernel-ec2-debugsource-3.16.7-35.1 kernel-vanilla-3.16.7-35.1 kernel-vanilla-debuginfo-3.16.7-35.1 kernel-vanilla-debugsource-3.16.7-35.1 kernel-vanilla-devel-3.16.7-35.1 kernel-xen-3.16.7-35.1 kernel-xen-base-3.16.7-35.1 kernel-xen-base-debuginfo-3.16.7-35.1 kernel-xen-debuginfo-3.16.7-35.1 kernel-xen-debugsource-3.16.7-35.1 kernel-xen-devel-3.16.7-35.1 - openSUSE 13.2 (i586 x86_64): bbswitch-0.8-3.17.1 bbswitch-debugsource-0.8-3.17.1 bbswitch-kmp-default-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-default-debuginfo-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-desktop-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-desktop-debuginfo-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-xen-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-xen-debuginfo-0.8_k3.16.7_35-3.17.1 cloop-2.639-14.17.1 cloop-debuginfo-2.639-14.17.1 cloop-debugsource-2.639-14.17.1 cloop-kmp-default-2.639_k3.16.7_35-14.17.1 cloop-kmp-default-debuginfo-2.639_k3.16.7_35-14.17.1 cloop-kmp-desktop-2.639_k3.16.7_35-14.17.1 cloop-kmp-desktop-debuginfo-2.639_k3.16.7_35-14.17.1 cloop-kmp-xen-2.639_k3.16.7_35-14.17.1 cloop-kmp-xen-debuginfo-2.639_k3.16.7_35-14.17.1 crash-7.0.8-17.1 crash-debuginfo-7.0.8-17.1 crash-debugsource-7.0.8-17.1 crash-devel-7.0.8-17.1 crash-doc-7.0.8-17.1 crash-eppic-7.0.8-17.1 crash-eppic-debuginfo-7.0.8-17.1 crash-gcore-7.0.8-17.1 crash-gcore-debuginfo-7.0.8-17.1 crash-kmp-default-7.0.8_k3.16.7_35-17.1 crash-kmp-default-debuginfo-7.0.8_k3.16.7_35-17.1 crash-kmp-desktop-7.0.8_k3.16.7_35-17.1 crash-kmp-desktop-debuginfo-7.0.8_k3.16.7_35-17.1 crash-kmp-xen-7.0.8_k3.16.7_35-17.1 crash-kmp-xen-debuginfo-7.0.8_k3.16.7_35-17.1 hdjmod-debugsource-1.28-18.18.1 hdjmod-kmp-default-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-default-debuginfo-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-desktop-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-xen-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-xen-debuginfo-1.28_k3.16.7_35-18.18.1 ipset-6.23-17.1 ipset-debuginfo-6.23-17.1 ipset-debugsource-6.23-17.1 ipset-devel-6.23-17.1 ipset-kmp-default-6.23_k3.16.7_35-17.1 ipset-kmp-default-debuginfo-6.23_k3.16.7_35-17.1 ipset-kmp-desktop-6.23_k3.16.7_35-17.1 ipset-kmp-desktop-debuginfo-6.23_k3.16.7_35-17.1 ipset-kmp-xen-6.23_k3.16.7_35-17.1 ipset-kmp-xen-debuginfo-6.23_k3.16.7_35-17.1 kernel-default-3.16.7-35.1 kernel-default-base-3.16.7-35.1 kernel-default-base-debuginfo-3.16.7-35.1 kernel-default-debuginfo-3.16.7-35.1 kernel-default-debugsource-3.16.7-35.1 kernel-default-devel-3.16.7-35.1 kernel-ec2-3.16.7-35.1 kernel-ec2-base-3.16.7-35.1 kernel-ec2-devel-3.16.7-35.1 kernel-obs-build-3.16.7-35.2 kernel-obs-build-debugsource-3.16.7-35.2 kernel-obs-qa-3.16.7-35.1 kernel-obs-qa-xen-3.16.7-35.1 kernel-syms-3.16.7-35.1 libipset3-6.23-17.1 libipset3-debuginfo-6.23-17.1 pcfclock-0.44-260.17.1 pcfclock-debuginfo-0.44-260.17.1 pcfclock-debugsource-0.44-260.17.1 pcfclock-kmp-default-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-default-debuginfo-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-desktop-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.16.7_35-260.17.1 python-virtualbox-4.3.36-43.2 python-virtualbox-debuginfo-4.3.36-43.2 vhba-kmp-debugsource-20140629-2.17.1 vhba-kmp-default-20140629_k3.16.7_35-2.17.1 vhba-kmp-default-debuginfo-20140629_k3.16.7_35-2.17.1 vhba-kmp-desktop-20140629_k3.16.7_35-2.17.1 vhba-kmp-desktop-debuginfo-20140629_k3.16.7_35-2.17.1 vhba-kmp-xen-20140629_k3.16.7_35-2.17.1 vhba-kmp-xen-debuginfo-20140629_k3.16.7_35-2.17.1 virtualbox-4.3.36-43.2 virtualbox-debuginfo-4.3.36-43.2 virtualbox-debugsource-4.3.36-43.2 virtualbox-devel-4.3.36-43.2 virtualbox-guest-kmp-default-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-default-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-desktop-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-desktop-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-guest-tools-4.3.36-43.2 virtualbox-guest-tools-debuginfo-4.3.36-43.2 virtualbox-guest-x11-4.3.36-43.2 virtualbox-guest-x11-debuginfo-4.3.36-43.2 virtualbox-host-kmp-default-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-default-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-desktop-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-desktop-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-qt-4.3.36-43.2 virtualbox-qt-debuginfo-4.3.36-43.2 virtualbox-websrv-4.3.36-43.2 virtualbox-websrv-debuginfo-4.3.36-43.2 xen-debugsource-4.4.3_08-40.1 xen-devel-4.4.3_08-40.1 xen-libs-4.4.3_08-40.1 xen-libs-debuginfo-4.4.3_08-40.1 xen-tools-domU-4.4.3_08-40.1 xen-tools-domU-debuginfo-4.4.3_08-40.1 xtables-addons-2.6-17.1 xtables-addons-debuginfo-2.6-17.1 xtables-addons-debugsource-2.6-17.1 xtables-addons-kmp-default-2.6_k3.16.7_35-17.1 xtables-addons-kmp-default-debuginfo-2.6_k3.16.7_35-17.1 xtables-addons-kmp-desktop-2.6_k3.16.7_35-17.1 xtables-addons-kmp-desktop-debuginfo-2.6_k3.16.7_35-17.1 xtables-addons-kmp-xen-2.6_k3.16.7_35-17.1 xtables-addons-kmp-xen-debuginfo-2.6_k3.16.7_35-17.1 - openSUSE 13.2 (noarch): kernel-devel-3.16.7-35.1 kernel-docs-3.16.7-35.2 kernel-macros-3.16.7-35.1 kernel-source-3.16.7-35.1 kernel-source-vanilla-3.16.7-35.1 virtualbox-guest-desktop-icons-4.3.36-43.2 virtualbox-host-source-4.3.36-43.2 - openSUSE 13.2 (x86_64): xen-4.4.3_08-40.1 xen-doc-html-4.4.3_08-40.1 xen-kmp-default-4.4.3_08_k3.16.7_35-40.1 xen-kmp-default-debuginfo-4.4.3_08_k3.16.7_35-40.1 xen-kmp-desktop-4.4.3_08_k3.16.7_35-40.1 xen-kmp-desktop-debuginfo-4.4.3_08_k3.16.7_35-40.1 xen-libs-32bit-4.4.3_08-40.1 xen-libs-debuginfo-32bit-4.4.3_08-40.1 xen-tools-4.4.3_08-40.1 xen-tools-debuginfo-4.4.3_08-40.1 - openSUSE 13.2 (i686): kernel-pae-3.16.7-35.1 kernel-pae-base-3.16.7-35.1 kernel-pae-base-debuginfo-3.16.7-35.1 kernel-pae-debuginfo-3.16.7-35.1 kernel-pae-debugsource-3.16.7-35.1 kernel-pae-devel-3.16.7-35.1 - openSUSE 13.2 (i586): bbswitch-kmp-pae-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-pae-debuginfo-0.8_k3.16.7_35-3.17.1 cloop-kmp-pae-2.639_k3.16.7_35-14.17.1 cloop-kmp-pae-debuginfo-2.639_k3.16.7_35-14.17.1 crash-kmp-pae-7.0.8_k3.16.7_35-17.1 crash-kmp-pae-debuginfo-7.0.8_k3.16.7_35-17.1 hdjmod-kmp-pae-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-pae-debuginfo-1.28_k3.16.7_35-18.18.1 ipset-kmp-pae-6.23_k3.16.7_35-17.1 ipset-kmp-pae-debuginfo-6.23_k3.16.7_35-17.1 pcfclock-kmp-pae-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-pae-debuginfo-0.44_k3.16.7_35-260.17.1 vhba-kmp-pae-20140629_k3.16.7_35-2.17.1 vhba-kmp-pae-debuginfo-20140629_k3.16.7_35-2.17.1 virtualbox-guest-kmp-pae-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-pae-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-pae-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-pae-debuginfo-4.3.36_k3.16.7_35-43.2 xtables-addons-kmp-pae-2.6_k3.16.7_35-17.1 xtables-addons-kmp-pae-debuginfo-2.6_k3.16.7_35-17.1 References: https://www.suse.com/security/cve/CVE-2016-0723.html https://www.suse.com/security/cve/CVE-2016-2069.html https://bugzilla.suse.com/907378 https://bugzilla.suse.com/961500 https://bugzilla.suse.com/963767 https://bugzilla.suse.com/965308 https://bugzilla.suse.com/965356 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0536-1: important: Security update for qemu
by opensuse-security＠opensuse.org 21 Feb '16

21 Feb '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0536-1 Rating: important References: #954864 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - Enforce receive packet size, thus eliminating buffer overflow and potential security issue. (bsc#957162 CVE-2015-7512) - Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829): This update also fixes a non-security bug: - Due to space restrictions in limited bios data areas, don't create mptable if vcpu count is "high" (ie more than ~19). (bsc#954864) (No supported guests are negatively impacted by this change, which is taken from upstream seabios) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-252=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): qemu-2.3.1-12.1 qemu-arm-2.3.1-12.1 qemu-arm-debuginfo-2.3.1-12.1 qemu-block-curl-2.3.1-12.1 qemu-block-curl-debuginfo-2.3.1-12.1 qemu-debugsource-2.3.1-12.1 qemu-extra-2.3.1-12.1 qemu-extra-debuginfo-2.3.1-12.1 qemu-guest-agent-2.3.1-12.1 qemu-guest-agent-debuginfo-2.3.1-12.1 qemu-kvm-2.3.1-12.1 qemu-lang-2.3.1-12.1 qemu-linux-user-2.3.1-12.1 qemu-linux-user-debuginfo-2.3.1-12.1 qemu-linux-user-debugsource-2.3.1-12.1 qemu-ppc-2.3.1-12.1 qemu-ppc-debuginfo-2.3.1-12.1 qemu-s390-2.3.1-12.1 qemu-s390-debuginfo-2.3.1-12.1 qemu-tools-2.3.1-12.1 qemu-tools-debuginfo-2.3.1-12.1 qemu-x86-2.3.1-12.1 qemu-x86-debuginfo-2.3.1-12.1 - openSUSE Leap 42.1 (x86_64): qemu-block-rbd-2.3.1-12.1 qemu-block-rbd-debuginfo-2.3.1-12.1 qemu-testsuite-2.3.1-12.2 - openSUSE Leap 42.1 (noarch): qemu-ipxe-1.0.0-12.1 qemu-seabios-1.8.1-12.1 qemu-sgabios-8-12.1 qemu-vgabios-1.8.1-12.1 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/954864 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0531-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 21 Feb '16

21 Feb '16

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0531-1 Rating: important References: #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, boo#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, boo#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.3/static/release-9-3-11.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-253=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-253=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): postgresql93-9.3.11-3.2 postgresql93-contrib-9.3.11-3.2 postgresql93-contrib-debuginfo-9.3.11-3.2 postgresql93-debuginfo-9.3.11-3.2 postgresql93-debugsource-9.3.11-3.2 postgresql93-devel-9.3.11-3.2 postgresql93-devel-debuginfo-9.3.11-3.2 postgresql93-libs-debugsource-9.3.11-3.2 postgresql93-plperl-9.3.11-3.2 postgresql93-plperl-debuginfo-9.3.11-3.2 postgresql93-plpython-9.3.11-3.2 postgresql93-plpython-debuginfo-9.3.11-3.2 postgresql93-pltcl-9.3.11-3.2 postgresql93-pltcl-debuginfo-9.3.11-3.2 postgresql93-server-9.3.11-3.2 postgresql93-server-debuginfo-9.3.11-3.2 postgresql93-test-9.3.11-3.2 - openSUSE Leap 42.1 (noarch): postgresql-init-9.4-6.1 postgresql93-docs-9.3.11-3.2 - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.11-2.10.1 libecpg6-debuginfo-9.3.11-2.10.1 libpq5-9.3.11-2.10.1 libpq5-debuginfo-9.3.11-2.10.1 postgresql93-9.3.11-2.10.1 postgresql93-contrib-9.3.11-2.10.1 postgresql93-contrib-debuginfo-9.3.11-2.10.1 postgresql93-debuginfo-9.3.11-2.10.1 postgresql93-debugsource-9.3.11-2.10.1 postgresql93-devel-9.3.11-2.10.1 postgresql93-devel-debuginfo-9.3.11-2.10.1 postgresql93-libs-debugsource-9.3.11-2.10.1 postgresql93-plperl-9.3.11-2.10.1 postgresql93-plperl-debuginfo-9.3.11-2.10.1 postgresql93-plpython-9.3.11-2.10.1 postgresql93-plpython-debuginfo-9.3.11-2.10.1 postgresql93-pltcl-9.3.11-2.10.1 postgresql93-pltcl-debuginfo-9.3.11-2.10.1 postgresql93-server-9.3.11-2.10.1 postgresql93-server-debuginfo-9.3.11-2.10.1 postgresql93-test-9.3.11-2.10.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.11-2.10.1 libecpg6-debuginfo-32bit-9.3.11-2.10.1 libpq5-32bit-9.3.11-2.10.1 libpq5-debuginfo-32bit-9.3.11-2.10.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.11-2.10.1 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0529-1: critical: Security update for Chromium
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0529-1 Rating: critical References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update contains Chromium 48.0.2564.116 and fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-249=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-48.0.2564.116-129.1 chromedriver-debuginfo-48.0.2564.116-129.1 chromium-48.0.2564.116-129.1 chromium-debuginfo-48.0.2564.116-129.1 chromium-debugsource-48.0.2564.116-129.1 chromium-desktop-gnome-48.0.2564.116-129.1 chromium-desktop-kde-48.0.2564.116-129.1 chromium-ffmpegsumo-48.0.2564.116-129.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-129.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0525-1: critical: Security update to Chromium 48.0.2564.116
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update to Chromium 48.0.2564.116 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0525-1 Rating: critical References: #967376 Cross-References: CVE-2016-1629 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Chromium 48.0.2564.116 ans fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-239=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-48.0.2564.116-24.1 chromedriver-debuginfo-48.0.2564.116-24.1 chromium-48.0.2564.116-24.1 chromium-debuginfo-48.0.2564.116-24.1 chromium-debugsource-48.0.2564.116-24.1 chromium-desktop-gnome-48.0.2564.116-24.1 chromium-desktop-kde-48.0.2564.116-24.1 chromium-ffmpegsumo-48.0.2564.116-24.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-24.1 - openSUSE 13.2 (i586 x86_64): chromedriver-48.0.2564.116-78.1 chromedriver-debuginfo-48.0.2564.116-78.1 chromium-48.0.2564.116-78.1 chromium-debuginfo-48.0.2564.116-78.1 chromium-debugsource-48.0.2564.116-78.1 chromium-desktop-gnome-48.0.2564.116-78.1 chromium-desktop-kde-48.0.2564.116-78.1 chromium-ffmpegsumo-48.0.2564.116-78.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-78.1 References: https://www.suse.com/security/cve/CVE-2016-1629.html https://bugzilla.suse.com/967376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0521-1: important: Security update for obs-service-download_files, obs-service-extract_file, obs-service-recompress, obs-service-source_validator, obs-service-verify_file
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update for obs-service-download_files, obs-service-extract_file, obs-service-recompress, obs-service-source_validator, obs-service-verify_file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0521-1 Rating: important References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for a number of source services fixes the following issues: - boo#967265: Various code/parameter injection issues could have allowed malicious service definition to execute commands or make changes to the user's file system The following source services are affected - obs-service-source_validator - obs-service-extract_file - obs-service-download_files - obs-service-recompress - obs-service-verify_file Also contains all bug fixes and improvements from the openSUSE:Tools versions. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-247=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-247=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): obs-service-download_files-0.5.1.git.1455712026.9c0a4a0-6.1 obs-service-extract_file-0.3-5.1 obs-service-recompress-0.3.1+git20160217.7897d3f-7.1 obs-service-source_validator-0.6+git20160218.73d6618-5.1 obs-service-verify_file-0.1.1-20.1 - openSUSE 13.2 (noarch): obs-service-download_files-0.5.1.git.1455712026.9c0a4a0-2.6.1 obs-service-extract_file-0.3-3.1 obs-service-recompress-0.3.1+git20160217.7897d3f-3.3.1 obs-service-source_validator-0.6+git20160218.73d6618-3.1 obs-service-verify_file-0.1.1-12.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0520-1: critical: Security update to Chromium 48.0.2564.116
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update to Chromium 48.0.2564.116 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0520-1 Rating: critical References: #967376 Cross-References: CVE-2016-1629 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Chromium 48.0.2564.116 ans fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-239=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-48.0.2564.116-52.1 chromedriver-debuginfo-48.0.2564.116-52.1 chromium-48.0.2564.116-52.1 chromium-debuginfo-48.0.2564.116-52.1 chromium-debugsource-48.0.2564.116-52.1 chromium-desktop-gnome-48.0.2564.116-52.1 chromium-desktop-kde-48.0.2564.116-52.1 chromium-ffmpegsumo-48.0.2564.116-52.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-52.1 References: https://www.suse.com/security/cve/CVE-2016-1629.html https://bugzilla.suse.com/967376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0512-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0512-1 Rating: critical References: Cross-References: CVE-2015-7547 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issues: * fix stack overflow in the glibc libresolv DNS resolver function getaddrinfo(), known as CVE-2015-7547. It is a client side networked/remote vulnerability. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): glibc-2.18-4.41.2 glibc-debuginfo-2.18-4.41.2 glibc-debugsource-2.18-4.41.2 glibc-devel-2.18-4.41.2 glibc-devel-debuginfo-2.18-4.41.2 glibc-devel-static-2.18-4.41.2 glibc-extra-2.18-4.41.2 glibc-extra-debuginfo-2.18-4.41.2 glibc-locale-2.18-4.41.2 glibc-locale-debuginfo-2.18-4.41.2 glibc-profile-2.18-4.41.2 glibc-utils-2.18-4.41.4 glibc-utils-debuginfo-2.18-4.41.4 glibc-utils-debugsource-2.18-4.41.4 nscd-2.18-4.41.2 nscd-debuginfo-2.18-4.41.2 - openSUSE 13.1 (x86_64): glibc-32bit-2.18-4.41.1 glibc-debuginfo-32bit-2.18-4.41.1 glibc-devel-32bit-2.18-4.41.1 glibc-devel-debuginfo-32bit-2.18-4.41.1 glibc-devel-static-32bit-2.18-4.41.1 glibc-locale-32bit-2.18-4.41.1 glibc-locale-debuginfo-32bit-2.18-4.41.1 glibc-profile-32bit-2.18-4.41.1 glibc-utils-32bit-2.18-4.41.4 glibc-utils-debuginfo-32bit-2.18-4.41.4 - openSUSE 13.1 (noarch): glibc-html-2.18-4.41.2 glibc-i18ndata-2.18-4.41.1 glibc-i18ndata-2.18-4.41.2 glibc-info-2.18-4.41.1 glibc-info-2.18-4.41.2 - openSUSE 13.1 (i686): glibc-2.18-4.41.1 glibc-debuginfo-2.18-4.41.1 glibc-debugsource-2.18-4.41.1 glibc-devel-2.18-4.41.1 glibc-devel-debuginfo-2.18-4.41.1 glibc-devel-static-2.18-4.41.1 glibc-extra-2.18-4.41.1 glibc-extra-debuginfo-2.18-4.41.1 glibc-locale-2.18-4.41.1 glibc-locale-debuginfo-2.18-4.41.1 glibc-obsolete-2.18-4.41.1 glibc-obsolete-debuginfo-2.18-4.41.1 glibc-profile-2.18-4.41.1 nscd-2.18-4.41.1 nscd-debuginfo-2.18-4.41.1 - openSUSE 13.1 (i586): glibc-obsolete-2.18-4.41.2 glibc-obsolete-debuginfo-2.18-4.41.2 References: https://www.suse.com/security/cve/CVE-2015-7547.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0511-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0511-1 Rating: critical References: Cross-References: CVE-2015-7547 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issues: * fix stack overflow in the glibc libresolv DNS resolver function getaddrinfo(), known as CVE-2015-7547. It is a client side networked/remote vulnerability. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): glibc-2.11.3-69.2 glibc-debuginfo-2.11.3-69.2 glibc-debugsource-2.11.3-69.2 glibc-devel-2.11.3-69.2 glibc-devel-debuginfo-2.11.3-69.2 glibc-html-2.11.3-69.2 glibc-i18ndata-2.11.3-69.2 glibc-info-2.11.3-69.2 glibc-locale-2.11.3-69.2 glibc-locale-debuginfo-2.11.3-69.2 glibc-obsolete-2.11.3-69.2 glibc-profile-2.11.3-69.2 nscd-2.11.3-69.2 nscd-debuginfo-2.11.3-69.2 - openSUSE Evergreen 11.4 (x86_64): glibc-32bit-2.11.3-69.1 glibc-debuginfo-32bit-2.11.3-69.1 glibc-devel-32bit-2.11.3-69.1 glibc-devel-debuginfo-32bit-2.11.3-69.1 glibc-locale-32bit-2.11.3-69.1 glibc-locale-debuginfo-32bit-2.11.3-69.1 glibc-profile-32bit-2.11.3-69.1 - openSUSE Evergreen 11.4 (ia64): glibc-debuginfo-x86-2.11.3-69.1 glibc-devel-debuginfo-x86-2.11.3-69.1 glibc-locale-debuginfo-x86-2.11.3-69.1 glibc-locale-x86-2.11.3-69.1 glibc-profile-x86-2.11.3-69.1 glibc-x86-2.11.3-69.1 - openSUSE Evergreen 11.4 (i686): glibc-2.11.3-69.1 glibc-debuginfo-2.11.3-69.1 glibc-debugsource-2.11.3-69.1 glibc-devel-2.11.3-69.1 glibc-devel-debuginfo-2.11.3-69.1 glibc-html-2.11.3-69.1 glibc-i18ndata-2.11.3-69.1 glibc-info-2.11.3-69.1 glibc-locale-2.11.3-69.1 glibc-locale-debuginfo-2.11.3-69.1 glibc-obsolete-2.11.3-69.1 glibc-obsolete-debuginfo-2.11.3-69.1 glibc-profile-2.11.3-69.1 nscd-2.11.3-69.1 nscd-debuginfo-2.11.3-69.1 - openSUSE Evergreen 11.4 (i586): glibc-obsolete-debuginfo-2.11.3-69.2 References: https://www.suse.com/security/cve/CVE-2015-7547.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0510-1: important: Security update for glibc
by opensuse-security＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0510-1 Rating: important References: #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8778 CVE-2015-8779 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for glibc fixes the following issues: - errorcheck-mutex-no-elision.patch: Don't do lock elision on an error checking mutex (boo#956716, BZ #17514) - reinitialize-dl_load_write_lock.patch: Reinitialize dl_load_write_lock on fork (boo#958315, BZ #19282) - send-dg-buffer-overflow.patch: Fix getaddrinfo stack-based buffer overflow (CVE-2015-7547, boo#961721, BZ #18665) - strftime-range-check.patch: Add range check on time fields (CVE-2015-8776, boo#962736, BZ #18985) - hcreate-overflow-check.patch: Handle overflow in hcreate (CVE-2015-8778, boo#962737, BZ #18240) - refactor-nan-parsing.patch: Refactor strtod parsing of NaN payloads (CVE-2014-9761, boo#962738, BZ #16962) - catopen-unbound-alloca.patch: Fix unbound alloca in catopen (CVE-2015-8779, boo#962739, BZ #17905) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 i686 x86_64): glibc-2.19-16.22.2 glibc-debuginfo-2.19-16.22.2 glibc-debugsource-2.19-16.22.2 glibc-devel-2.19-16.22.2 glibc-devel-debuginfo-2.19-16.22.2 glibc-devel-static-2.19-16.22.2 glibc-locale-2.19-16.22.2 glibc-locale-debuginfo-2.19-16.22.2 glibc-profile-2.19-16.22.2 - openSUSE 13.2 (i586 x86_64): glibc-extra-2.19-16.22.2 glibc-extra-debuginfo-2.19-16.22.2 glibc-utils-2.19-16.22.2 glibc-utils-debuginfo-2.19-16.22.2 glibc-utils-debugsource-2.19-16.22.2 nscd-2.19-16.22.2 nscd-debuginfo-2.19-16.22.2 - openSUSE 13.2 (x86_64): glibc-32bit-2.19-16.22.2 glibc-debuginfo-32bit-2.19-16.22.2 glibc-devel-32bit-2.19-16.22.2 glibc-devel-debuginfo-32bit-2.19-16.22.2 glibc-devel-static-32bit-2.19-16.22.2 glibc-locale-32bit-2.19-16.22.2 glibc-locale-debuginfo-32bit-2.19-16.22.2 glibc-profile-32bit-2.19-16.22.2 glibc-utils-32bit-2.19-16.22.2 glibc-utils-debuginfo-32bit-2.19-16.22.2 - openSUSE 13.2 (noarch): glibc-html-2.19-16.22.2 glibc-i18ndata-2.19-16.22.2 glibc-info-2.19-16.22.2 - openSUSE 13.2 (i586): glibc-obsolete-2.19-16.22.2 glibc-obsolete-debuginfo-2.19-16.22.2 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0490-1: important: Security update for glibc
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0490-1 Rating: important References: #950944 #955647 #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#955647: Resource leak in resolver - bsc#956716: Don't do lock elision on an error checking mutex - bsc#958315: Reinitialize dl_load_write_lock on fork This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-224=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 i686 x86_64): glibc-2.19-19.1 glibc-debuginfo-2.19-19.1 glibc-debugsource-2.19-19.1 glibc-devel-2.19-19.1 glibc-devel-debuginfo-2.19-19.1 glibc-devel-static-2.19-19.1 glibc-locale-2.19-19.1 glibc-locale-debuginfo-2.19-19.1 glibc-profile-2.19-19.1 - openSUSE Leap 42.1 (i586 x86_64): glibc-extra-2.19-19.1 glibc-extra-debuginfo-2.19-19.1 glibc-utils-2.19-19.1 glibc-utils-debuginfo-2.19-19.1 glibc-utils-debugsource-2.19-19.1 nscd-2.19-19.1 nscd-debuginfo-2.19-19.1 - openSUSE Leap 42.1 (x86_64): glibc-32bit-2.19-19.1 glibc-debuginfo-32bit-2.19-19.1 glibc-devel-32bit-2.19-19.1 glibc-devel-debuginfo-32bit-2.19-19.1 glibc-devel-static-32bit-2.19-19.1 glibc-locale-32bit-2.19-19.1 glibc-locale-debuginfo-32bit-2.19-19.1 glibc-profile-32bit-2.19-19.1 glibc-utils-32bit-2.19-19.1 glibc-utils-debuginfo-32bit-2.19-19.1 - openSUSE Leap 42.1 (noarch): glibc-html-2.19-19.1 glibc-i18ndata-2.19-19.1 glibc-info-2.19-19.1 - openSUSE Leap 42.1 (i586): glibc-obsolete-2.19-19.1 glibc-obsolete-debuginfo-2.19-19.1 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/950944 https://bugzilla.suse.com/955647 https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0476-1: important: Security update for vlc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0476-1 Rating: important References: #965227 Cross-References: CVE-2015-5949 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: - CVE-2015-5949: Remote attackers could have caused a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file (boo#965227) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-213=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvlc5-2.2.1-24.1 libvlc5-debuginfo-2.2.1-24.1 libvlccore8-2.2.1-24.1 libvlccore8-debuginfo-2.2.1-24.1 vlc-2.2.1-24.1 vlc-debuginfo-2.2.1-24.1 vlc-debugsource-2.2.1-24.1 vlc-devel-2.2.1-24.1 vlc-gnome-2.2.1-24.1 vlc-gnome-debuginfo-2.2.1-24.1 vlc-noX-2.2.1-24.1 vlc-noX-debuginfo-2.2.1-24.1 vlc-qt-2.2.1-24.1 vlc-qt-debuginfo-2.2.1-24.1 - openSUSE Leap 42.1 (noarch): vlc-noX-lang-2.2.1-24.1 References: https://www.suse.com/security/cve/CVE-2015-5949.html https://bugzilla.suse.com/965227 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0473-1: important: Security update for glibc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0473-1 Rating: important References: #950944 #955647 #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#955647: Resource leak in resolver - bsc#956716: Don't do lock elision on an error checking mutex - bsc#958315: Reinitialize dl_load_write_lock on fork Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-272=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-272=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-272=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): glibc-debuginfo-2.19-22.13.1 glibc-debugsource-2.19-22.13.1 glibc-devel-static-2.19-22.13.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): glibc-2.19-22.13.1 glibc-debuginfo-2.19-22.13.1 glibc-debugsource-2.19-22.13.1 glibc-devel-2.19-22.13.1 glibc-devel-debuginfo-2.19-22.13.1 glibc-locale-2.19-22.13.1 glibc-locale-debuginfo-2.19-22.13.1 glibc-profile-2.19-22.13.1 nscd-2.19-22.13.1 nscd-debuginfo-2.19-22.13.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): glibc-32bit-2.19-22.13.1 glibc-debuginfo-32bit-2.19-22.13.1 glibc-devel-32bit-2.19-22.13.1 glibc-devel-debuginfo-32bit-2.19-22.13.1 glibc-locale-32bit-2.19-22.13.1 glibc-locale-debuginfo-32bit-2.19-22.13.1 glibc-profile-32bit-2.19-22.13.1 - SUSE Linux Enterprise Server 12 (noarch): glibc-html-2.19-22.13.1 glibc-i18ndata-2.19-22.13.1 glibc-info-2.19-22.13.1 - SUSE Linux Enterprise Desktop 12 (x86_64): glibc-2.19-22.13.1 glibc-32bit-2.19-22.13.1 glibc-debuginfo-2.19-22.13.1 glibc-debuginfo-32bit-2.19-22.13.1 glibc-debugsource-2.19-22.13.1 glibc-devel-2.19-22.13.1 glibc-devel-32bit-2.19-22.13.1 glibc-devel-debuginfo-2.19-22.13.1 glibc-devel-debuginfo-32bit-2.19-22.13.1 glibc-locale-2.19-22.13.1 glibc-locale-32bit-2.19-22.13.1 glibc-locale-debuginfo-2.19-22.13.1 glibc-locale-debuginfo-32bit-2.19-22.13.1 nscd-2.19-22.13.1 nscd-debuginfo-2.19-22.13.1 - SUSE Linux Enterprise Desktop 12 (noarch): glibc-i18ndata-2.19-22.13.1 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/950944 https://bugzilla.suse.com/955647 https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0472-1: important: Security update for glibc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0472-1 Rating: important References: #930721 #942317 #950944 #956988 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#930721: Accept leading and trailing spaces in getdate input string - bsc#942317: Recognize power8 platform - bsc#950944: Always enable pointer guard - bsc#956988: Fix deadlock in __dl_iterate_phdr Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-glibc-12406=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-glibc-12406=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-glibc-12406=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-glibc-12406=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-glibc-12406=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-glibc-12406=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-glibc-12406=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-glibc-12406=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-glibc-12406=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): glibc-html-2.11.3-17.95.2 glibc-info-2.11.3-17.95.2 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 x86_64): glibc-html-2.11.3-17.95.2 glibc-info-2.11.3-17.95.2 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): glibc-2.11.3-17.95.2 glibc-devel-2.11.3-17.95.2 glibc-html-2.11.3-17.95.2 glibc-i18ndata-2.11.3-17.95.2 glibc-info-2.11.3-17.95.2 glibc-locale-2.11.3-17.95.2 glibc-profile-2.11.3-17.95.2 nscd-2.11.3-17.95.2 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): glibc-32bit-2.11.3-17.95.2 glibc-devel-32bit-2.11.3-17.95.2 glibc-locale-32bit-2.11.3-17.95.2 glibc-profile-32bit-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP4 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.95.2 glibc-devel-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.95.2 glibc-i18ndata-2.11.3-17.95.2 glibc-info-2.11.3-17.95.2 glibc-locale-2.11.3-17.95.2 glibc-profile-2.11.3-17.95.2 nscd-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.95.2 glibc-devel-32bit-2.11.3-17.95.2 glibc-locale-32bit-2.11.3-17.95.2 glibc-profile-32bit-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP4 (ia64): glibc-locale-x86-2.11.3-17.95.2 glibc-profile-x86-2.11.3-17.95.2 glibc-x86-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP3 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.95.2 glibc-devel-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.95.2 glibc-i18ndata-2.11.3-17.95.2 glibc-info-2.11.3-17.95.2 glibc-locale-2.11.3-17.95.2 glibc-profile-2.11.3-17.95.2 nscd-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.95.2 glibc-devel-32bit-2.11.3-17.95.2 glibc-locale-32bit-2.11.3-17.95.2 glibc-profile-32bit-2.11.3-17.95.2 - SUSE Linux Enterprise Server 11-SP3 (ia64): glibc-locale-x86-2.11.3-17.95.2 glibc-profile-x86-2.11.3-17.95.2 glibc-x86-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP4 (i586 i686 x86_64): glibc-2.11.3-17.95.2 glibc-devel-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): glibc-i18ndata-2.11.3-17.95.2 glibc-locale-2.11.3-17.95.2 nscd-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): glibc-32bit-2.11.3-17.95.2 glibc-devel-32bit-2.11.3-17.95.2 glibc-locale-32bit-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586 i686 x86_64): glibc-2.11.3-17.95.2 glibc-devel-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): glibc-i18ndata-2.11.3-17.95.2 glibc-locale-2.11.3-17.95.2 nscd-2.11.3-17.95.2 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): glibc-32bit-2.11.3-17.95.2 glibc-devel-32bit-2.11.3-17.95.2 glibc-locale-32bit-2.11.3-17.95.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 i686 ia64 ppc64 s390x x86_64): glibc-debuginfo-2.11.3-17.95.2 glibc-debugsource-2.11.3-17.95.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 i686 ia64 ppc64 s390x x86_64): glibc-debuginfo-2.11.3-17.95.2 glibc-debugsource-2.11.3-17.95.2 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/930721 https://bugzilla.suse.com/942317 https://bugzilla.suse.com/950944 https://bugzilla.suse.com/956988 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0471-1: important: Security update for glibc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0471-1 Rating: important References: #950944 #955647 #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#955647: Resource leak in resolver - bsc#956716: Don't do lock elision on an error checking mutex - bsc#958315: Reinitialize dl_load_write_lock on fork Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-271=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-271=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-271=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): glibc-debuginfo-2.19-35.1 glibc-debugsource-2.19-35.1 glibc-devel-static-2.19-35.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (noarch): glibc-info-2.19-35.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): glibc-2.19-35.1 glibc-debuginfo-2.19-35.1 glibc-debugsource-2.19-35.1 glibc-devel-2.19-35.1 glibc-devel-debuginfo-2.19-35.1 glibc-locale-2.19-35.1 glibc-locale-debuginfo-2.19-35.1 glibc-profile-2.19-35.1 nscd-2.19-35.1 nscd-debuginfo-2.19-35.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): glibc-32bit-2.19-35.1 glibc-debuginfo-32bit-2.19-35.1 glibc-devel-32bit-2.19-35.1 glibc-devel-debuginfo-32bit-2.19-35.1 glibc-locale-32bit-2.19-35.1 glibc-locale-debuginfo-32bit-2.19-35.1 glibc-profile-32bit-2.19-35.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): glibc-html-2.19-35.1 glibc-i18ndata-2.19-35.1 glibc-info-2.19-35.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): glibc-2.19-35.1 glibc-32bit-2.19-35.1 glibc-debuginfo-2.19-35.1 glibc-debuginfo-32bit-2.19-35.1 glibc-debugsource-2.19-35.1 glibc-devel-2.19-35.1 glibc-devel-32bit-2.19-35.1 glibc-devel-debuginfo-2.19-35.1 glibc-devel-debuginfo-32bit-2.19-35.1 glibc-locale-2.19-35.1 glibc-locale-32bit-2.19-35.1 glibc-locale-debuginfo-2.19-35.1 glibc-locale-debuginfo-32bit-2.19-35.1 nscd-2.19-35.1 nscd-debuginfo-2.19-35.1 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): glibc-i18ndata-2.19-35.1 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/950944 https://bugzilla.suse.com/955647 https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0470-1: important: Security update for glibc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0470-1 Rating: important References: #830257 #847227 #863499 #892065 #918187 #920338 #927080 #945779 #950944 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2013-2207 CVE-2013-4458 CVE-2014-8121 CVE-2014-9761 CVE-2015-1781 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) - CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal (bsc#830257) - CVE-2013-4458: Stack (frame) overflow in getaddrinfo() when called with AF_INET6 (bsc#847227) - CVE-2014-8121: denial of service issue in the NSS backends (bsc#918187) - bsc#920338: Read past end of pattern in fnmatch - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080) The following non-security bugs were fixed: - bnc#892065: SIGSEV tst-setlocale3 in glibc-2.11.3-17.68.1 - bnc#863499: Memory leak in getaddrinfo when many RRs are returned - bsc#892065: Avoid unbound alloca in setenv - bsc#945779: Properly reread entry after failure in nss_files getent function Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-glibc-12405=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-glibc-12405=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 i686 s390x x86_64): glibc-2.11.3-17.45.66.1 glibc-devel-2.11.3-17.45.66.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): glibc-html-2.11.3-17.45.66.1 glibc-i18ndata-2.11.3-17.45.66.1 glibc-info-2.11.3-17.45.66.1 glibc-locale-2.11.3-17.45.66.1 glibc-profile-2.11.3-17.45.66.1 nscd-2.11.3-17.45.66.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): glibc-32bit-2.11.3-17.45.66.1 glibc-devel-32bit-2.11.3-17.45.66.1 glibc-locale-32bit-2.11.3-17.45.66.1 glibc-profile-32bit-2.11.3-17.45.66.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 i686 s390x x86_64): glibc-debuginfo-2.11.3-17.45.66.1 glibc-debugsource-2.11.3-17.45.66.1 References: https://www.suse.com/security/cve/CVE-2013-2207.html https://www.suse.com/security/cve/CVE-2013-4458.html https://www.suse.com/security/cve/CVE-2014-8121.html https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-1781.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/830257 https://bugzilla.suse.com/847227 https://bugzilla.suse.com/863499 https://bugzilla.suse.com/892065 https://bugzilla.suse.com/918187 https://bugzilla.suse.com/920338 https://bugzilla.suse.com/927080 https://bugzilla.suse.com/945779 https://bugzilla.suse.com/950944 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0459-1: important: Security update for qemu
by opensuse-security＠opensuse.org 15 Feb '16

15 Feb '16

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0459-1 Rating: important References: #954864 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - Enforce receive packet size, thus eliminating buffer overflow and potential security issue. (bsc#957162 CVE-2015-7512) - Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829): This update also fixes a non-security bug: - Due to space restrictions in limited bios data areas, don't create mptable if vcpu count is "high" (ie more than ~19). (bsc#954864) (No supported guests are negatively impacted by this change, which is taken from upstream seabios) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-263=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-263=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): qemu-2.3.1-7.7 qemu-block-curl-2.3.1-7.7 qemu-block-curl-debuginfo-2.3.1-7.7 qemu-debugsource-2.3.1-7.7 qemu-guest-agent-2.3.1-7.7 qemu-guest-agent-debuginfo-2.3.1-7.7 qemu-lang-2.3.1-7.7 qemu-tools-2.3.1-7.7 qemu-tools-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): qemu-kvm-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (ppc64le): qemu-ppc-2.3.1-7.7 qemu-ppc-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (x86_64): qemu-block-rbd-2.3.1-7.7 qemu-block-rbd-debuginfo-2.3.1-7.7 qemu-x86-2.3.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (noarch): qemu-ipxe-1.0.0-7.7 qemu-seabios-1.8.1-7.7 qemu-sgabios-8-7.7 qemu-vgabios-1.8.1-7.7 - SUSE Linux Enterprise Server 12-SP1 (s390x): qemu-s390-2.3.1-7.7 qemu-s390-debuginfo-2.3.1-7.7 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): qemu-2.3.1-7.7 qemu-block-curl-2.3.1-7.7 qemu-block-curl-debuginfo-2.3.1-7.7 qemu-debugsource-2.3.1-7.7 qemu-kvm-2.3.1-7.7 qemu-tools-2.3.1-7.7 qemu-tools-debuginfo-2.3.1-7.7 qemu-x86-2.3.1-7.7 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): qemu-ipxe-1.0.0-7.7 qemu-seabios-1.8.1-7.7 qemu-sgabios-8-7.7 qemu-vgabios-1.8.1-7.7 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/954864 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0434-1: important: Security update for kernel live patch 1
by opensuse-security＠opensuse.org 11 Feb '16

11 Feb '16

SUSE Security Update: Security update for kernel live patch 1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0434-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.32-33.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-249=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_32-33-default-5-2.1 kgraft-patch-3_12_32-33-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0433-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 11 Feb '16

11 Feb '16

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0433-1 Rating: important References: #960402 #963937 Cross-References: CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937): - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-java-1_7_0-ibm-12398=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.30-45.1 java-1_7_0-ibm-devel-1.7.0_sr9.30-45.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.30-45.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.30-45.1 java-1_7_0-ibm-plugin-1.7.0_sr9.30-45.1 References: https://www.suse.com/security/cve/CVE-2015-5041.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-7981.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2015-8540.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960402 https://bugzilla.suse.com/963937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0