February 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:0400-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 10 Feb '16

10 Feb '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0400-1 Rating: important References: #965901 Cross-References: CVE-2016-0964 CVE-2016-0965 CVE-2016-0966 CVE-2016-0967 CVE-2016-0968 CVE-2016-0969 CVE-2016-0970 CVE-2016-0971 CVE-2016-0972 CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0976 CVE-2016-0977 CVE-2016-0978 CVE-2016-0979 CVE-2016-0980 CVE-2016-0981 CVE-2016-0982 CVE-2016-0983 CVE-2016-0984 CVE-2016-0985 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for flash-player fixes the following issues: - Security update to 11.2.202.569 (bsc#965901): * APSB16-04, CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0971, CVE-2016-0972, CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, CVE-2016-0981, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984, CVE-2016-0985 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-12393=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.569-0.35.1 flash-player-gnome-11.2.202.569-0.35.1 flash-player-kde4-11.2.202.569-0.35.1 References: https://www.suse.com/security/cve/CVE-2016-0964.html https://www.suse.com/security/cve/CVE-2016-0965.html https://www.suse.com/security/cve/CVE-2016-0966.html https://www.suse.com/security/cve/CVE-2016-0967.html https://www.suse.com/security/cve/CVE-2016-0968.html https://www.suse.com/security/cve/CVE-2016-0969.html https://www.suse.com/security/cve/CVE-2016-0970.html https://www.suse.com/security/cve/CVE-2016-0971.html https://www.suse.com/security/cve/CVE-2016-0972.html https://www.suse.com/security/cve/CVE-2016-0973.html https://www.suse.com/security/cve/CVE-2016-0974.html https://www.suse.com/security/cve/CVE-2016-0975.html https://www.suse.com/security/cve/CVE-2016-0976.html https://www.suse.com/security/cve/CVE-2016-0977.html https://www.suse.com/security/cve/CVE-2016-0978.html https://www.suse.com/security/cve/CVE-2016-0979.html https://www.suse.com/security/cve/CVE-2016-0980.html https://www.suse.com/security/cve/CVE-2016-0981.html https://www.suse.com/security/cve/CVE-2016-0982.html https://www.suse.com/security/cve/CVE-2016-0983.html https://www.suse.com/security/cve/CVE-2016-0984.html https://www.suse.com/security/cve/CVE-2016-0985.html https://bugzilla.suse.com/965901 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0399-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 10 Feb '16

10 Feb '16

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0399-1 Rating: important References: #960402 #963937 Cross-References: CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for java-1_7_1-ibm fixes the following issues by updating to 7.1-3.30 (bsc#963937): - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-java-1_7_1-ibm-12394=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-java-1_7_1-ibm-12394=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr3.30-9.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr3.30-9.1 java-1_7_1-ibm-jdbc-1.7.1_sr3.30-9.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr3.30-9.1 java-1_7_1-ibm-plugin-1.7.1_sr3.30-9.1 References: https://www.suse.com/security/cve/CVE-2015-5041.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-7981.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2015-8540.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960402 https://bugzilla.suse.com/963937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0398-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 10 Feb '16

10 Feb '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0398-1 Rating: important References: #965901 Cross-References: CVE-2016-0964 CVE-2016-0965 CVE-2016-0966 CVE-2016-0967 CVE-2016-0968 CVE-2016-0969 CVE-2016-0970 CVE-2016-0971 CVE-2016-0972 CVE-2016-0973 CVE-2016-0974 CVE-2016-0975 CVE-2016-0976 CVE-2016-0977 CVE-2016-0978 CVE-2016-0979 CVE-2016-0980 CVE-2016-0981 CVE-2016-0982 CVE-2016-0983 CVE-2016-0984 CVE-2016-0985 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for flash-player fixes the following issues: - Security update to 11.2.202.569 (bsc#965901): * APSB16-04, CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0971, CVE-2016-0972, CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, CVE-2016-0981, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984, CVE-2016-0985 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-235=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-235=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-235=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-235=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): flash-player-11.2.202.569-120.1 flash-player-gnome-11.2.202.569-120.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): flash-player-11.2.202.569-120.1 flash-player-gnome-11.2.202.569-120.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): flash-player-11.2.202.569-120.1 flash-player-gnome-11.2.202.569-120.1 - SUSE Linux Enterprise Desktop 12 (x86_64): flash-player-11.2.202.569-120.1 flash-player-gnome-11.2.202.569-120.1 References: https://www.suse.com/security/cve/CVE-2016-0964.html https://www.suse.com/security/cve/CVE-2016-0965.html https://www.suse.com/security/cve/CVE-2016-0966.html https://www.suse.com/security/cve/CVE-2016-0967.html https://www.suse.com/security/cve/CVE-2016-0968.html https://www.suse.com/security/cve/CVE-2016-0969.html https://www.suse.com/security/cve/CVE-2016-0970.html https://www.suse.com/security/cve/CVE-2016-0971.html https://www.suse.com/security/cve/CVE-2016-0972.html https://www.suse.com/security/cve/CVE-2016-0973.html https://www.suse.com/security/cve/CVE-2016-0974.html https://www.suse.com/security/cve/CVE-2016-0975.html https://www.suse.com/security/cve/CVE-2016-0976.html https://www.suse.com/security/cve/CVE-2016-0977.html https://www.suse.com/security/cve/CVE-2016-0978.html https://www.suse.com/security/cve/CVE-2016-0979.html https://www.suse.com/security/cve/CVE-2016-0980.html https://www.suse.com/security/cve/CVE-2016-0981.html https://www.suse.com/security/cve/CVE-2016-0982.html https://www.suse.com/security/cve/CVE-2016-0983.html https://www.suse.com/security/cve/CVE-2016-0984.html https://www.suse.com/security/cve/CVE-2016-0985.html https://bugzilla.suse.com/965901 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0391-1: important: Security update for rubygem-rails-html-sanitizer
by opensuse-security＠opensuse.org 09 Feb '16

09 Feb '16

SUSE Security Update: Security update for rubygem-rails-html-sanitizer ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0391-1 Rating: important References: #963326 #963327 #963328 Cross-References: CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 Affected Products: SUSE Enterprise Storage 2.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2015-7579: XSS vulnerability in rails-html-sanitizer (bsc#963327) - CVE-2015-7578: XSS vulnerability via attributes (bsc#963326) - CVE-2015-7580: XSS via whitelist sanitizer (bsc#963328) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Enterprise Storage 2.1: zypper in -t patch SUSE-Storage-2.1-2016-228=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Enterprise Storage 2.1 (x86_64): ruby2.1-rubygem-rails-html-sanitizer-1.0.2-7.1 References: https://www.suse.com/security/cve/CVE-2015-7578.html https://www.suse.com/security/cve/CVE-2015-7579.html https://www.suse.com/security/cve/CVE-2015-7580.html https://bugzilla.suse.com/963326 https://bugzilla.suse.com/963327 https://bugzilla.suse.com/963328 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0390-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 09 Feb '16

09 Feb '16

SUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0390-1 Rating: important References: #960402 #963937 Cross-References: CVE-2015-5041 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0475 CVE-2016-0483 CVE-2016-0494 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_8_0-ibm fixes the following security issues by updating to 8.0-2.10 (bsc#963937): - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0475: An unspecified vulnerability related to the Libraries component has partial confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-227=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-227=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr2.10-7.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr2.10-7.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr2.10-7.1 java-1_8_0-ibm-plugin-1.8.0_sr2.10-7.1 References: https://www.suse.com/security/cve/CVE-2015-5041.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0475.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960402 https://bugzilla.suse.com/963937 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0387-1: important: Security update for kernel live patch 7
by opensuse-security＠opensuse.org 08 Feb '16

08 Feb '16

SUSE Security Update: Security update for kernel live patch 7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0387-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.44-52.18.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-223=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_44-52_18-default-3-2.1 kgraft-patch-3_12_44-52_18-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0386-1: important: Security update for kernel live patch 6
by opensuse-security＠opensuse.org 08 Feb '16

08 Feb '16

SUSE Security Update: Security update for kernel live patch 6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0386-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.44-52.10.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-222=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_44-52_10-default-3-2.1 kgraft-patch-3_12_44-52_10-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0384-1: important: Security update for kernel live patch 2
by opensuse-security＠opensuse.org 08 Feb '16

08 Feb '16

SUSE Security Update: Security update for kernel live patch 2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0384-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.36-38.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-224=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_36-38-default-5-2.1 kgraft-patch-3_12_36-38-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0383-1: important: Security update for kernel live patch 5
by opensuse-security＠opensuse.org 08 Feb '16

08 Feb '16

SUSE Security Update: Security update for kernel live patch 5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0383-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.43-52.6.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-219=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_43-52_6-default-4-2.1 kgraft-patch-3_12_43-52_6-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0381-1: important: Security update for kernel live patch 4
by opensuse-security＠opensuse.org 08 Feb '16

08 Feb '16

SUSE Security Update: Security update for kernel live patch 4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0381-1 Rating: important References: #916225 #940342 #951542 #951625 #953052 #954005 #958601 Cross-References: CVE-2015-2925 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8539 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This kernel live patch for Linux Kernel 3.12.39-47.1 fixes security issues and bugs: Security issues fixed: - CVE-2015-8539: A negatively instantiated user key could have been used by a local user to leverage privileges (bnc#958601). - CVE-2015-6937: A NULL pointer dereference flaw was found in the Reliable Datagram Sockets (RDS) implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. (bsc#953052) - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#953052). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951542). - CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack (bnc#951625). Non-security bugfix were also done: - xfs: Fix lost direct IO write in the last block (bsc#954005). - simple fix in kallsyms initialization (bsc#940342 bsc#916225) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-220=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_39-47-default-4-2.1 kgraft-patch-3_12_39-47-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2015-2925.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8539.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/940342 https://bugzilla.suse.com/951542 https://bugzilla.suse.com/951625 https://bugzilla.suse.com/953052 https://bugzilla.suse.com/954005 https://bugzilla.suse.com/958601 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0