March 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:0748-1: important: Security update for sles12sp1-docker-image
by opensuse-security＠opensuse.org 14 Mar '16

14 Mar '16

SUSE Security Update: Security update for sles12sp1-docker-image ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0748-1 Rating: important References: #969591 Cross-References: CVE-2014-9761 CVE-2015-3197 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Affected Products: SUSE Linux Enterprise Module for Containers 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for sles12sp1-docker-image fixes the following issues: glibc fixed the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) glibc received the following non-security bugfixes: - bsc#955647: Resource leak in resolver - bsc#956716: Don't do lock elision on an error checking mutex - bsc#958315: Reinitialize dl_load_write_lock on fork openssl fixed the following security issues: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes in the modular exponentation code were added that make sure that it is not possible to recover RSA secret keys by analyzing cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. Note that this was only exploitable if the malicious code was running on the same hyper threaded Intel Sandy Bridge processor as the victim thread performing decryptions. - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0798 (bnc#968265) The SRP user database lookup method SRP_VBASE_get_by_user() had a memory leak that attackers could abuse to facility DoS attacks. To mitigate the issue, the seed handling in SRP_VBASE_get_by_user() was disabled - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. openssl received the following non-security bugfixes: - Avoid running OPENSSL_config twice. This avoids breaking engine loading. (bsc#952871) - Ensure that OpenSSL doesn't fall back to the default digest algorithm (SHA1) in case a non-FIPS algorithm was negotiated while running in FIPS mode. Instead, OpenSSL will refuse the digest. (bnc#958501) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Containers 12: zypper in -t patch SUSE-SLE-Module-Containers-12-2016-440=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Containers 12 (ppc64le): sles12sp1-docker-image-1.0.4-20160308171022 - SUSE Linux Enterprise Module for Containers 12 (x86_64): sles12sp1-docker-image-1.0.4-20160308170633 - SUSE Linux Enterprise Module for Containers 12 (s390x): sles12sp1-docker-image-1.0.4-20160308170749 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0798.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/969591 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0747-1: important: Security update for kernel live patch 9
by opensuse-security＠opensuse.org 14 Mar '16

14 Mar '16

SUSE Security Update: Security update for kernel live patch 9 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0747-1 Rating: important References: #955837 #962078 Cross-References: CVE-2013-7446 CVE-2016-0728 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This kernel live patch for Linux Kernel 3.12.51-52.31.1 fixes two security issues: Fixes: - CVE-2016-0728: A reference leak in keyring handling with join_session_keyring() could lead to local attackers gain root privileges. (bsc#962078). - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. (bsc#955837) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-436=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_51-52_31-default-3-2.1 kgraft-patch-3_12_51-52_31-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2016-0728.html https://bugzilla.suse.com/955837 https://bugzilla.suse.com/962078 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0746-1: important: Security update for kernel live patch 4
by opensuse-security＠opensuse.org 14 Mar '16

14 Mar '16

SUSE Security Update: Security update for kernel live patch 4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0746-1 Rating: important References: #955837 #962078 Cross-References: CVE-2013-7446 CVE-2016-0728 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This kernel live patch for Linux Kernel 3.12.39-47.1 fixes two security issues: Fixes: - CVE-2016-0728: A reference leak in keyring handling with join_session_keyring() could lead to local attackers gain root privileges. (bsc#962078). - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. (bsc#955837) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-431=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_39-47-default-5-2.1 kgraft-patch-3_12_39-47-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2016-0728.html https://bugzilla.suse.com/955837 https://bugzilla.suse.com/962078 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0745-1: important: Security update for kernel live patch 3
by opensuse-security＠opensuse.org 14 Mar '16

14 Mar '16

SUSE Security Update: Security update for kernel live patch 3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0745-1 Rating: important References: #955837 #962078 Cross-References: CVE-2013-7446 CVE-2016-0728 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This kernel live patch for Linux Kernel 3.12.38-44.1 fixes two security issues: Fixes: - CVE-2016-0728: A reference leak in keyring handling with join_session_keyring() could lead to local attackers gain root privileges. (bsc#962078). - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. (bsc#955837) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-430=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_38-44-default-5-2.1 kgraft-patch-3_12_38-44-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2016-0728.html https://bugzilla.suse.com/955837 https://bugzilla.suse.com/962078 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0734-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0734-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547) * APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-335=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.577-156.1 flash-player-gnome-11.2.202.577-156.1 flash-player-kde4-11.2.202.577-156.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0733-1: important: Security update for Firefox
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0733-1 Rating: important References: #969894 Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1968 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 CVE-2016-1977 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: MozillaFirefox was updated to Firefox 45.0 (boo#969894) * requires NSPR 4.12 / NSS 3.21.1 * Instant browser tab sharing through Hello * Synced Tabs button in button bar * Tabs synced via Firefox Accounts from other devices are now shown in dropdown area of Awesome Bar when searching * Introduce a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level * Tab Groups (Panorama) feature removed * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP reports fail to strip location information for embedded iframe pages * MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux video memory DOS with Intel drivers * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager out-of-bounds read in Service Worker Manager * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-26/CVE-2016-1963 (bmo#1238440) Memory corruption when modifying a file being read by FileReader * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-29/CVE-2016-1967 (bmo#1246956) Same-origin policy violation using perfomance.getEntries and history navigation with session restore * MFSA 2016-30/CVE-2016-1968 (bmo#1246742) Buffer overflow in Brotli decompression * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/ CVE-2016-1976/CVE-2016-1972 WebRTC and LibVPX vulnerabilities found through code inspection * MFSA 2016-33/CVE-2016-1973 (bmo#1219339) Use-after-free in GetStaticInstance in WebRTC * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library mozilla-nspr was updated to version 4.12 * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes mozilla-nss was updated to NSS 3.21.1 (bmo#969894) * required for Firefox 45.0 * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-334=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-45.0-109.1 MozillaFirefox-branding-upstream-45.0-109.1 MozillaFirefox-buildsymbols-45.0-109.1 MozillaFirefox-debuginfo-45.0-109.1 MozillaFirefox-debugsource-45.0-109.1 MozillaFirefox-devel-45.0-109.1 MozillaFirefox-translations-common-45.0-109.1 MozillaFirefox-translations-other-45.0-109.1 libfreebl3-3.21.1-74.1 libfreebl3-debuginfo-3.21.1-74.1 libsoftokn3-3.21.1-74.1 libsoftokn3-debuginfo-3.21.1-74.1 mozilla-nspr-4.12-34.1 mozilla-nspr-debuginfo-4.12-34.1 mozilla-nspr-debugsource-4.12-34.1 mozilla-nspr-devel-4.12-34.1 mozilla-nss-3.21.1-74.1 mozilla-nss-certs-3.21.1-74.1 mozilla-nss-certs-debuginfo-3.21.1-74.1 mozilla-nss-debuginfo-3.21.1-74.1 mozilla-nss-debugsource-3.21.1-74.1 mozilla-nss-devel-3.21.1-74.1 mozilla-nss-sysinit-3.21.1-74.1 mozilla-nss-sysinit-debuginfo-3.21.1-74.1 mozilla-nss-tools-3.21.1-74.1 mozilla-nss-tools-debuginfo-3.21.1-74.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.21.1-74.1 libfreebl3-debuginfo-32bit-3.21.1-74.1 libsoftokn3-32bit-3.21.1-74.1 libsoftokn3-debuginfo-32bit-3.21.1-74.1 mozilla-nspr-32bit-4.12-34.1 mozilla-nspr-debuginfo-32bit-4.12-34.1 mozilla-nss-32bit-3.21.1-74.1 mozilla-nss-certs-32bit-3.21.1-74.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-74.1 mozilla-nss-debuginfo-32bit-3.21.1-74.1 mozilla-nss-sysinit-32bit-3.21.1-74.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-74.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1959.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1963.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1967.html https://www.suse.com/security/cve/CVE-2016-1968.html https://www.suse.com/security/cve/CVE-2016-1970.html https://www.suse.com/security/cve/CVE-2016-1971.html https://www.suse.com/security/cve/CVE-2016-1972.html https://www.suse.com/security/cve/CVE-2016-1973.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1975.html https://www.suse.com/security/cve/CVE-2016-1976.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-1979.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0732-1: important: Security update for libotr,libotr2
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for libotr,libotr2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0732-1 Rating: important References: #969785 Cross-References: CVE-2016-2851 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libotr and libotr2 were updated to fix one security issue: - CVE-2016-2851: Integer overflow vulnerability allowed remote attackers to execute arbitrary code on 64 bit platforms (boo#969785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-333=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libotr-debugsource-4.0.0-5.7.1 libotr-devel-4.0.0-5.7.1 libotr-tools-4.0.0-5.7.1 libotr-tools-debuginfo-4.0.0-5.7.1 libotr2-3.2.1-5.3.1 libotr2-debuginfo-3.2.1-5.3.1 libotr2-debugsource-3.2.1-5.3.1 libotr2-devel-3.2.1-5.3.1 libotr2-tools-3.2.1-5.3.1 libotr2-tools-debuginfo-3.2.1-5.3.1 libotr5-4.0.0-5.7.1 libotr5-debuginfo-4.0.0-5.7.1 References: https://www.suse.com/security/cve/CVE-2016-2851.html https://bugzilla.suse.com/969785 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0731-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0731-1 Rating: important References: #969894 Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1968 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 CVE-2016-1977 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: MozillaFirefox was updated to Firefox 45.0 (boo#969894) * requires NSPR 4.12 / NSS 3.21.1 * Instant browser tab sharing through Hello * Synced Tabs button in button bar * Tabs synced via Firefox Accounts from other devices are now shown in dropdown area of Awesome Bar when searching * Introduce a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level * Tab Groups (Panorama) feature removed * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP reports fail to strip location information for embedded iframe pages * MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux video memory DOS with Intel drivers * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager out-of-bounds read in Service Worker Manager * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-26/CVE-2016-1963 (bmo#1238440) Memory corruption when modifying a file being read by FileReader * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-29/CVE-2016-1967 (bmo#1246956) Same-origin policy violation using perfomance.getEntries and history navigation with session restore * MFSA 2016-30/CVE-2016-1968 (bmo#1246742) Buffer overflow in Brotli decompression * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/ CVE-2016-1976/CVE-2016-1972 WebRTC and LibVPX vulnerabilities found through code inspection * MFSA 2016-33/CVE-2016-1973 (bmo#1219339) Use-after-free in GetStaticInstance in WebRTC * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library mozilla-nspr was updated to version 4.12 * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes mozilla-nss was updated to NSS 3.21.1 (bmo#969894) * required for Firefox 45.0 * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-332=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-332=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-45.0-18.1 MozillaFirefox-branding-upstream-45.0-18.1 MozillaFirefox-buildsymbols-45.0-18.1 MozillaFirefox-debuginfo-45.0-18.1 MozillaFirefox-debugsource-45.0-18.1 MozillaFirefox-devel-45.0-18.1 MozillaFirefox-translations-common-45.0-18.1 MozillaFirefox-translations-other-45.0-18.1 libfreebl3-3.21.1-12.1 libfreebl3-debuginfo-3.21.1-12.1 libsoftokn3-3.21.1-12.1 libsoftokn3-debuginfo-3.21.1-12.1 mozilla-nspr-4.12-10.1 mozilla-nspr-debuginfo-4.12-10.1 mozilla-nspr-debugsource-4.12-10.1 mozilla-nspr-devel-4.12-10.1 mozilla-nss-3.21.1-12.1 mozilla-nss-certs-3.21.1-12.1 mozilla-nss-certs-debuginfo-3.21.1-12.1 mozilla-nss-debuginfo-3.21.1-12.1 mozilla-nss-debugsource-3.21.1-12.1 mozilla-nss-devel-3.21.1-12.1 mozilla-nss-sysinit-3.21.1-12.1 mozilla-nss-sysinit-debuginfo-3.21.1-12.1 mozilla-nss-tools-3.21.1-12.1 mozilla-nss-tools-debuginfo-3.21.1-12.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.21.1-12.1 libfreebl3-debuginfo-32bit-3.21.1-12.1 libsoftokn3-32bit-3.21.1-12.1 libsoftokn3-debuginfo-32bit-3.21.1-12.1 mozilla-nspr-32bit-4.12-10.1 mozilla-nspr-debuginfo-32bit-4.12-10.1 mozilla-nss-32bit-3.21.1-12.1 mozilla-nss-certs-32bit-3.21.1-12.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-12.1 mozilla-nss-debuginfo-32bit-3.21.1-12.1 mozilla-nss-sysinit-32bit-3.21.1-12.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-12.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-45.0-65.1 MozillaFirefox-branding-upstream-45.0-65.1 MozillaFirefox-buildsymbols-45.0-65.1 MozillaFirefox-debuginfo-45.0-65.1 MozillaFirefox-debugsource-45.0-65.1 MozillaFirefox-devel-45.0-65.1 MozillaFirefox-translations-common-45.0-65.1 MozillaFirefox-translations-other-45.0-65.1 libfreebl3-3.21.1-28.1 libfreebl3-debuginfo-3.21.1-28.1 libsoftokn3-3.21.1-28.1 libsoftokn3-debuginfo-3.21.1-28.1 mozilla-nspr-4.12-15.1 mozilla-nspr-debuginfo-4.12-15.1 mozilla-nspr-debugsource-4.12-15.1 mozilla-nspr-devel-4.12-15.1 mozilla-nss-3.21.1-28.1 mozilla-nss-certs-3.21.1-28.1 mozilla-nss-certs-debuginfo-3.21.1-28.1 mozilla-nss-debuginfo-3.21.1-28.1 mozilla-nss-debugsource-3.21.1-28.1 mozilla-nss-devel-3.21.1-28.1 mozilla-nss-sysinit-3.21.1-28.1 mozilla-nss-sysinit-debuginfo-3.21.1-28.1 mozilla-nss-tools-3.21.1-28.1 mozilla-nss-tools-debuginfo-3.21.1-28.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.21.1-28.1 libfreebl3-debuginfo-32bit-3.21.1-28.1 libsoftokn3-32bit-3.21.1-28.1 libsoftokn3-debuginfo-32bit-3.21.1-28.1 mozilla-nspr-32bit-4.12-15.1 mozilla-nspr-debuginfo-32bit-4.12-15.1 mozilla-nss-32bit-3.21.1-28.1 mozilla-nss-certs-32bit-3.21.1-28.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-28.1 mozilla-nss-debuginfo-32bit-3.21.1-28.1 mozilla-nss-sysinit-32bit-3.21.1-28.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-28.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1959.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1963.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1967.html https://www.suse.com/security/cve/CVE-2016-1968.html https://www.suse.com/security/cve/CVE-2016-1970.html https://www.suse.com/security/cve/CVE-2016-1971.html https://www.suse.com/security/cve/CVE-2016-1972.html https://www.suse.com/security/cve/CVE-2016-1973.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1975.html https://www.suse.com/security/cve/CVE-2016-1976.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-1979.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0729-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0729-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-330=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-49.0.2623.75-81.2 chromedriver-debuginfo-49.0.2623.75-81.2 chromium-49.0.2623.75-81.2 chromium-debuginfo-49.0.2623.75-81.2 chromium-debugsource-49.0.2623.75-81.2 chromium-desktop-gnome-49.0.2623.75-81.2 chromium-desktop-kde-49.0.2623.75-81.2 chromium-ffmpegsumo-49.0.2623.75-81.2 chromium-ffmpegsumo-debuginfo-49.0.2623.75-81.2 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0727-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0727-1 Rating: important References: #969894 Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-1978 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894), fixing following security issues: * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7) * MFSA 2016-17/CVE-2016-1954 Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960 Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961 Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1 decoding in NSS * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Mozilla NSPR was updated to version 4.12 (bsc#969894), fixing following bugs: * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes Mozilla NSS was updated to fix security issues (bsc#969894): * MFSA 2016-15/CVE-2016-1978 Use-after-free in NSS during SSL connections in low memory * MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1 decoding in NSS * MFSA 2016-36/CVE-2016-1979 Use-after-free during processing of DER encoded keys in NSS Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-419=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-419=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-419=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-419=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-419=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-419=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-devel-38.7.0esr-63.3 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nspr-devel-4.12-12.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-devel-3.20.2-40.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-devel-38.7.0esr-63.3 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nspr-devel-4.12-12.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-devel-3.20.2-40.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-38.7.0esr-63.3 MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-translations-38.7.0esr-63.3 libfreebl3-3.20.2-40.1 libfreebl3-debuginfo-3.20.2-40.1 libfreebl3-hmac-3.20.2-40.1 libsoftokn3-3.20.2-40.1 libsoftokn3-debuginfo-3.20.2-40.1 libsoftokn3-hmac-3.20.2-40.1 mozilla-nspr-4.12-12.1 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nss-3.20.2-40.1 mozilla-nss-certs-3.20.2-40.1 mozilla-nss-certs-debuginfo-3.20.2-40.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-sysinit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-3.20.2-40.1 mozilla-nss-tools-3.20.2-40.1 mozilla-nss-tools-debuginfo-3.20.2-40.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libfreebl3-32bit-3.20.2-40.1 libfreebl3-debuginfo-32bit-3.20.2-40.1 libfreebl3-hmac-32bit-3.20.2-40.1 libsoftokn3-32bit-3.20.2-40.1 libsoftokn3-debuginfo-32bit-3.20.2-40.1 libsoftokn3-hmac-32bit-3.20.2-40.1 mozilla-nspr-32bit-4.12-12.1 mozilla-nspr-debuginfo-32bit-4.12-12.1 mozilla-nss-32bit-3.20.2-40.1 mozilla-nss-certs-32bit-3.20.2-40.1 mozilla-nss-certs-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debuginfo-32bit-3.20.2-40.1 mozilla-nss-sysinit-32bit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-32bit-3.20.2-40.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.7.0esr-63.3 MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-translations-38.7.0esr-63.3 libfreebl3-3.20.2-40.1 libfreebl3-debuginfo-3.20.2-40.1 libfreebl3-hmac-3.20.2-40.1 libsoftokn3-3.20.2-40.1 libsoftokn3-debuginfo-3.20.2-40.1 libsoftokn3-hmac-3.20.2-40.1 mozilla-nspr-4.12-12.1 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nss-3.20.2-40.1 mozilla-nss-certs-3.20.2-40.1 mozilla-nss-certs-debuginfo-3.20.2-40.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-sysinit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-3.20.2-40.1 mozilla-nss-tools-3.20.2-40.1 mozilla-nss-tools-debuginfo-3.20.2-40.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.20.2-40.1 libfreebl3-debuginfo-32bit-3.20.2-40.1 libfreebl3-hmac-32bit-3.20.2-40.1 libsoftokn3-32bit-3.20.2-40.1 libsoftokn3-debuginfo-32bit-3.20.2-40.1 libsoftokn3-hmac-32bit-3.20.2-40.1 mozilla-nspr-32bit-4.12-12.1 mozilla-nspr-debuginfo-32bit-4.12-12.1 mozilla-nss-32bit-3.20.2-40.1 mozilla-nss-certs-32bit-3.20.2-40.1 mozilla-nss-certs-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debuginfo-32bit-3.20.2-40.1 mozilla-nss-sysinit-32bit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-32bit-3.20.2-40.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-38.7.0esr-63.3 MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-translations-38.7.0esr-63.3 libfreebl3-3.20.2-40.1 libfreebl3-32bit-3.20.2-40.1 libfreebl3-debuginfo-3.20.2-40.1 libfreebl3-debuginfo-32bit-3.20.2-40.1 libsoftokn3-3.20.2-40.1 libsoftokn3-32bit-3.20.2-40.1 libsoftokn3-debuginfo-3.20.2-40.1 libsoftokn3-debuginfo-32bit-3.20.2-40.1 mozilla-nspr-32bit-4.12-12.1 mozilla-nspr-4.12-12.1 mozilla-nspr-debuginfo-32bit-4.12-12.1 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nss-3.20.2-40.1 mozilla-nss-32bit-3.20.2-40.1 mozilla-nss-certs-3.20.2-40.1 mozilla-nss-certs-32bit-3.20.2-40.1 mozilla-nss-certs-debuginfo-3.20.2-40.1 mozilla-nss-certs-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-sysinit-3.20.2-40.1 mozilla-nss-sysinit-32bit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-32bit-3.20.2-40.1 mozilla-nss-tools-3.20.2-40.1 mozilla-nss-tools-debuginfo-3.20.2-40.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.7.0esr-63.3 MozillaFirefox-debuginfo-38.7.0esr-63.3 MozillaFirefox-debugsource-38.7.0esr-63.3 MozillaFirefox-translations-38.7.0esr-63.3 libfreebl3-3.20.2-40.1 libfreebl3-32bit-3.20.2-40.1 libfreebl3-debuginfo-3.20.2-40.1 libfreebl3-debuginfo-32bit-3.20.2-40.1 libsoftokn3-3.20.2-40.1 libsoftokn3-32bit-3.20.2-40.1 libsoftokn3-debuginfo-3.20.2-40.1 libsoftokn3-debuginfo-32bit-3.20.2-40.1 mozilla-nspr-32bit-4.12-12.1 mozilla-nspr-4.12-12.1 mozilla-nspr-debuginfo-32bit-4.12-12.1 mozilla-nspr-debuginfo-4.12-12.1 mozilla-nspr-debugsource-4.12-12.1 mozilla-nss-3.20.2-40.1 mozilla-nss-32bit-3.20.2-40.1 mozilla-nss-certs-3.20.2-40.1 mozilla-nss-certs-32bit-3.20.2-40.1 mozilla-nss-certs-debuginfo-3.20.2-40.1 mozilla-nss-certs-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debuginfo-3.20.2-40.1 mozilla-nss-debuginfo-32bit-3.20.2-40.1 mozilla-nss-debugsource-3.20.2-40.1 mozilla-nss-sysinit-3.20.2-40.1 mozilla-nss-sysinit-32bit-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-3.20.2-40.1 mozilla-nss-sysinit-debuginfo-32bit-3.20.2-40.1 mozilla-nss-tools-3.20.2-40.1 mozilla-nss-tools-debuginfo-3.20.2-40.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-1978.html https://www.suse.com/security/cve/CVE-2016-1979.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0