June 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:1570-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 14 Jun '16

14 Jun '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1570-1 Rating: important References: #867943 #982178 Cross-References: CVE-2016-5118 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for ImageMagick fixes the following issues: This security issue was fixed: - CVE-2016-5118: Prevent code execution via popen() (bsc#982178) This non-security issue was fixed: - Fix encoding of /Title in generated PDFs. (bsc#867943) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-935=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-935=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-935=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-935=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-935=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-935=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-935=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-935=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 ImageMagick-devel-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagick++-devel-6.8.8.1-25.1 perl-PerlMagick-6.8.8.1-25.1 perl-PerlMagick-debuginfo-6.8.8.1-25.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 ImageMagick-devel-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagick++-devel-6.8.8.1-25.1 perl-PerlMagick-6.8.8.1-25.1 perl-PerlMagick-debuginfo-6.8.8.1-25.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 - SUSE Linux Enterprise Desktop 12 (x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 References: https://www.suse.com/security/cve/CVE-2016-5118.html https://bugzilla.suse.com/867943 https://bugzilla.suse.com/982178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1568-1: important: Security update for ntp
by opensuse-security＠opensuse.org 14 Jun '16

14 Jun '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1568-1 Rating: important References: #957226 #962960 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 #979302 #979981 #981422 #982064 #982065 #982066 #982067 #982068 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 17 vulnerabilities and has two fixes is now available. Description: ntp was updated to version 4.2.8p8 to fix 17 security issues. These security issues were fixed: - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC (bsc#977457). - CVE-2016-2519: ctl_getitem() return value not always checked (bsc#977458). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2015-7974: NTP did not verify peer associations of symmetric keys when authenticating packets, which might allowed remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key (bsc#962960). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). - CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch (bsc#977452). - CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated (bsc#977455). - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-1547: CRYPTO-NAK DoS (bsc#977459). - CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering (bsc#977450). - CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing (bsc#977464). - CVE-2016-1548: Interleave-pivot - MITIGATION ONLY (bsc#977461). - CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY (bsc#977451). This release also contained improved patches for CVE-2015-7704, CVE-2015-7705, CVE-2015-7974. These non-security issues were fixed: - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). - bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service. - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". - bsc#957226: Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-933=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-933=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): ntp-4.2.8p8-46.8.1 ntp-debuginfo-4.2.8p8-46.8.1 ntp-debugsource-4.2.8p8-46.8.1 ntp-doc-4.2.8p8-46.8.1 - SUSE Linux Enterprise Desktop 12 (x86_64): ntp-4.2.8p8-46.8.1 ntp-debuginfo-4.2.8p8-46.8.1 ntp-debugsource-4.2.8p8-46.8.1 ntp-doc-4.2.8p8-46.8.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://www.suse.com/security/cve/CVE-2016-4953.html https://www.suse.com/security/cve/CVE-2016-4954.html https://www.suse.com/security/cve/CVE-2016-4955.html https://www.suse.com/security/cve/CVE-2016-4956.html https://www.suse.com/security/cve/CVE-2016-4957.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464 https://bugzilla.suse.com/979302 https://bugzilla.suse.com/979981 https://bugzilla.suse.com/981422 https://bugzilla.suse.com/982064 https://bugzilla.suse.com/982065 https://bugzilla.suse.com/982066 https://bugzilla.suse.com/982067 https://bugzilla.suse.com/982068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1566-1: important: Security update for nodejs
by opensuse-security＠opensuse.org 14 Jun '16

14 Jun '16

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1566-1 Rating: important References: #968047 #968048 #968050 #977614 #977616 Cross-References: CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-2105 CVE-2016-2107 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs to version 4.4.5 fixes the several issues. These security issues introduced by the bundled openssl were fixed by going to version 1.0.2h: - CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider memory allocation during a certain padding check, which allowed remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session (bsc#977616). - CVE-2016-2105: Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL allowed remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data (bsc#977614). - CVE-2016-0705: Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL allowed remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key (bsc#968047). - CVE-2016-0797: Multiple integer overflows in OpenSSL allowed remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c (bsc#968048). - CVE-2016-0702: The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL did not properly consider cache-bank access times during modular exponentiation, which made it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack (bsc#968050). These non-security issues were fixed: - Fix faulty "if" condition (string cannot equal a boolean). - buffer: Buffer no longer errors if you call lastIndexOf with a search term longer than the buffer. - contextify: Context objects are now properly garbage collected, this solves a problem some individuals were experiencing with extreme memory growth. - Update npm to 2.15.5. - http: Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. - deps: Fix --gdbjit for embedders. Backported from v8 upstream. - querystring: Restore throw when attempting to stringify bad surrogate pair. - https: Under certain conditions SSL sockets may have been causing a memory leak when keepalive is enabled. This is no longer the case. - lib: The way that we were internally passing arguments was causing a potential leak. By copying the arguments into an array we can avoid this. - repl: Previously if you were using the repl in strict mode the column number would be wrong in a stack trace. This is no longer an issue. - deps: An update to v8 that introduces a new flag --perf_basic_prof_only_functions. - http: A new feature in http(s) agent that catches errors on keep alived connections. - src: Better support for big-endian systems. - tls: A new feature that allows you to pass common SSL options to tls.createSecurePair. - build: Support python path that includes spaces. - https: A potential fix for #3692 (HTTP/HTTPS client requests throwing EPROTO). - installer: More readable profiling information from isolate tick logs. - process: Add support for symbols in event emitters (symbols didn't exist when it was written). - querystring: querystring.parse() is now 13-22% faster! - streams: Performance improvements for moving small buffers that shows a 5% throughput gain. IoT projects have been seen to be as much as 10% faster with this change! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-715=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-715=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.4.5-27.1 nodejs-debuginfo-4.4.5-27.1 nodejs-debugsource-4.4.5-27.1 nodejs-devel-4.4.5-27.1 npm-4.4.5-27.1 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.4.5-27.1 - openSUSE 13.2 (i586 x86_64): nodejs-4.4.5-18.1 nodejs-debuginfo-4.4.5-18.1 nodejs-debugsource-4.4.5-18.1 nodejs-devel-4.4.5-18.1 - openSUSE 13.2 (noarch): nodejs-doc-4.4.5-18.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2107.html https://bugzilla.suse.com/968047 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977616 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1563-1: important: Security update for ntp
by opensuse-security＠opensuse.org 13 Jun '16

13 Jun '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1563-1 Rating: important References: #979302 #979981 #981422 #982056 #982064 #982065 #982066 #982067 #982068 Cross-References: CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has four fixes is now available. Description: ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - Keep the parent process alive until the daemon has finished initialisation, to make sure that the PID file exists when the parent returns. - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). - bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service. - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-930=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-930=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ntp-4.2.8p8-14.1 ntp-debuginfo-4.2.8p8-14.1 ntp-debugsource-4.2.8p8-14.1 ntp-doc-4.2.8p8-14.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ntp-4.2.8p8-14.1 ntp-debuginfo-4.2.8p8-14.1 ntp-debugsource-4.2.8p8-14.1 ntp-doc-4.2.8p8-14.1 References: https://www.suse.com/security/cve/CVE-2016-4953.html https://www.suse.com/security/cve/CVE-2016-4954.html https://www.suse.com/security/cve/CVE-2016-4955.html https://www.suse.com/security/cve/CVE-2016-4956.html https://www.suse.com/security/cve/CVE-2016-4957.html https://bugzilla.suse.com/979302 https://bugzilla.suse.com/979981 https://bugzilla.suse.com/981422 https://bugzilla.suse.com/982056 https://bugzilla.suse.com/982064 https://bugzilla.suse.com/982065 https://bugzilla.suse.com/982066 https://bugzilla.suse.com/982067 https://bugzilla.suse.com/982068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1560-1: important: Security update for qemu
by opensuse-security＠opensuse.org 13 Jun '16

13 Jun '16

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1560-1 Rating: important References: #886378 #895528 #901508 #928393 #934069 #940929 #944463 #947159 #958491 #958917 #959005 #959386 #960334 #960708 #960725 #960835 #961332 #961333 #961358 #961556 #961691 #962320 #963782 #964413 #967969 #969121 #969122 #969350 #970036 #970037 #975128 #975136 #975700 #976109 #978158 #978160 #980711 #980723 #981266 Cross-References: CVE-2014-3615 CVE-2014-3689 CVE-2014-9718 CVE-2015-3214 CVE-2015-5239 CVE-2015-5745 CVE-2015-7295 CVE-2015-7549 CVE-2015-8504 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2015-8817 CVE-2015-8818 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922 CVE-2016-1981 CVE-2016-2198 CVE-2016-2538 CVE-2016-2841 CVE-2016-2857 CVE-2016-2858 CVE-2016-3710 CVE-2016-3712 CVE-2016-4001 CVE-2016-4002 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441 CVE-2016-4952 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 37 vulnerabilities and has two fixes is now available. Description: qemu was updated to fix 37 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711) - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723) - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266) - CVE-2015-8817: Avoid OOB access in PCI DMA I/O (bsc#969121) - CVE-2015-8818: Avoid OOB access in PCI DMA I/O (bsc#969122) - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158) - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160) - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109) - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969) - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350) - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036) - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037) - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128) - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136) - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700) - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069) - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393) - CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508) - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528). - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463). - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929). - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159). - CVE-2015-7549: PCI null pointer dereferences (bsc#958917). - CVE-2015-8504: VNC floating point exception (bsc#958491). - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005). - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386). - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386). - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358). - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334). - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725). - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835). - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708). - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332). - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691). - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320). - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782). - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413). This non-security issue was fixed - bsc#886378: qemu truncates vhd images in virt-rescue Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-924=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-924=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): qemu-2.0.2-48.19.1 qemu-block-curl-2.0.2-48.19.1 qemu-block-curl-debuginfo-2.0.2-48.19.1 qemu-debugsource-2.0.2-48.19.1 qemu-guest-agent-2.0.2-48.19.1 qemu-guest-agent-debuginfo-2.0.2-48.19.1 qemu-lang-2.0.2-48.19.1 qemu-tools-2.0.2-48.19.1 qemu-tools-debuginfo-2.0.2-48.19.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): qemu-kvm-2.0.2-48.19.1 - SUSE Linux Enterprise Server 12 (ppc64le): qemu-ppc-2.0.2-48.19.1 qemu-ppc-debuginfo-2.0.2-48.19.1 - SUSE Linux Enterprise Server 12 (x86_64): qemu-block-rbd-2.0.2-48.19.1 qemu-block-rbd-debuginfo-2.0.2-48.19.1 qemu-x86-2.0.2-48.19.1 qemu-x86-debuginfo-2.0.2-48.19.1 - SUSE Linux Enterprise Server 12 (noarch): qemu-ipxe-1.0.0-48.19.1 qemu-seabios-1.7.4-48.19.1 qemu-sgabios-8-48.19.1 qemu-vgabios-1.7.4-48.19.1 - SUSE Linux Enterprise Server 12 (s390x): qemu-s390-2.0.2-48.19.1 qemu-s390-debuginfo-2.0.2-48.19.1 - SUSE Linux Enterprise Desktop 12 (x86_64): qemu-2.0.2-48.19.1 qemu-block-curl-2.0.2-48.19.1 qemu-block-curl-debuginfo-2.0.2-48.19.1 qemu-debugsource-2.0.2-48.19.1 qemu-kvm-2.0.2-48.19.1 qemu-tools-2.0.2-48.19.1 qemu-tools-debuginfo-2.0.2-48.19.1 qemu-x86-2.0.2-48.19.1 qemu-x86-debuginfo-2.0.2-48.19.1 - SUSE Linux Enterprise Desktop 12 (noarch): qemu-ipxe-1.0.0-48.19.1 qemu-seabios-1.7.4-48.19.1 qemu-sgabios-8-48.19.1 qemu-vgabios-1.7.4-48.19.1 References: https://www.suse.com/security/cve/CVE-2014-3615.html https://www.suse.com/security/cve/CVE-2014-3689.html https://www.suse.com/security/cve/CVE-2014-9718.html https://www.suse.com/security/cve/CVE-2015-3214.html https://www.suse.com/security/cve/CVE-2015-5239.html https://www.suse.com/security/cve/CVE-2015-5745.html https://www.suse.com/security/cve/CVE-2015-7295.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8567.html https://www.suse.com/security/cve/CVE-2015-8568.html https://www.suse.com/security/cve/CVE-2015-8613.html https://www.suse.com/security/cve/CVE-2015-8619.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8744.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2015-8817.html https://www.suse.com/security/cve/CVE-2015-8818.html https://www.suse.com/security/cve/CVE-2016-1568.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1922.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2198.html https://www.suse.com/security/cve/CVE-2016-2538.html https://www.suse.com/security/cve/CVE-2016-2841.html https://www.suse.com/security/cve/CVE-2016-2857.html https://www.suse.com/security/cve/CVE-2016-2858.html https://www.suse.com/security/cve/CVE-2016-3710.html https://www.suse.com/security/cve/CVE-2016-3712.html https://www.suse.com/security/cve/CVE-2016-4001.html https://www.suse.com/security/cve/CVE-2016-4002.html https://www.suse.com/security/cve/CVE-2016-4020.html https://www.suse.com/security/cve/CVE-2016-4037.html https://www.suse.com/security/cve/CVE-2016-4439.html https://www.suse.com/security/cve/CVE-2016-4441.html https://www.suse.com/security/cve/CVE-2016-4952.html https://bugzilla.suse.com/886378 https://bugzilla.suse.com/895528 https://bugzilla.suse.com/901508 https://bugzilla.suse.com/928393 https://bugzilla.suse.com/934069 https://bugzilla.suse.com/940929 https://bugzilla.suse.com/944463 https://bugzilla.suse.com/947159 https://bugzilla.suse.com/958491 https://bugzilla.suse.com/958917 https://bugzilla.suse.com/959005 https://bugzilla.suse.com/959386 https://bugzilla.suse.com/960334 https://bugzilla.suse.com/960708 https://bugzilla.suse.com/960725 https://bugzilla.suse.com/960835 https://bugzilla.suse.com/961332 https://bugzilla.suse.com/961333 https://bugzilla.suse.com/961358 https://bugzilla.suse.com/961556 https://bugzilla.suse.com/961691 https://bugzilla.suse.com/962320 https://bugzilla.suse.com/963782 https://bugzilla.suse.com/964413 https://bugzilla.suse.com/967969 https://bugzilla.suse.com/969121 https://bugzilla.suse.com/969122 https://bugzilla.suse.com/969350 https://bugzilla.suse.com/970036 https://bugzilla.suse.com/970037 https://bugzilla.suse.com/975128 https://bugzilla.suse.com/975136 https://bugzilla.suse.com/975700 https://bugzilla.suse.com/976109 https://bugzilla.suse.com/978158 https://bugzilla.suse.com/978160 https://bugzilla.suse.com/980711 https://bugzilla.suse.com/980723 https://bugzilla.suse.com/981266 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1557-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1557-1 Rating: important References: #980384 #981695 #983549 #983632 #983638 #983639 #983640 #983643 #983644 #983646 #983649 #983651 #983652 #983653 #983655 Cross-References: CVE-2016-1950 CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 CVE-2016-2834 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has one errata is now available. Description: This update to Mozilla Firefox 47 fixes the following issues (boo#983549): Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities: - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included: - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included: - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided: - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-714=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-47.0-116.1 MozillaFirefox-branding-upstream-47.0-116.1 MozillaFirefox-buildsymbols-47.0-116.1 MozillaFirefox-debuginfo-47.0-116.1 MozillaFirefox-debugsource-47.0-116.1 MozillaFirefox-devel-47.0-116.1 MozillaFirefox-translations-common-47.0-116.1 MozillaFirefox-translations-other-47.0-116.1 libfreebl3-3.23-80.1 libfreebl3-debuginfo-3.23-80.1 libsoftokn3-3.23-80.1 libsoftokn3-debuginfo-3.23-80.1 mozilla-nss-3.23-80.1 mozilla-nss-certs-3.23-80.1 mozilla-nss-certs-debuginfo-3.23-80.1 mozilla-nss-debuginfo-3.23-80.1 mozilla-nss-debugsource-3.23-80.1 mozilla-nss-devel-3.23-80.1 mozilla-nss-sysinit-3.23-80.1 mozilla-nss-sysinit-debuginfo-3.23-80.1 mozilla-nss-tools-3.23-80.1 mozilla-nss-tools-debuginfo-3.23-80.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.23-80.1 libfreebl3-debuginfo-32bit-3.23-80.1 libsoftokn3-32bit-3.23-80.1 libsoftokn3-debuginfo-32bit-3.23-80.1 mozilla-nss-32bit-3.23-80.1 mozilla-nss-certs-32bit-3.23-80.1 mozilla-nss-certs-debuginfo-32bit-3.23-80.1 mozilla-nss-debuginfo-32bit-3.23-80.1 mozilla-nss-sysinit-32bit-3.23-80.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-80.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://www.suse.com/security/cve/CVE-2016-2819.html https://www.suse.com/security/cve/CVE-2016-2821.html https://www.suse.com/security/cve/CVE-2016-2822.html https://www.suse.com/security/cve/CVE-2016-2824.html https://www.suse.com/security/cve/CVE-2016-2825.html https://www.suse.com/security/cve/CVE-2016-2828.html https://www.suse.com/security/cve/CVE-2016-2829.html https://www.suse.com/security/cve/CVE-2016-2831.html https://www.suse.com/security/cve/CVE-2016-2832.html https://www.suse.com/security/cve/CVE-2016-2833.html https://www.suse.com/security/cve/CVE-2016-2834.html https://bugzilla.suse.com/980384 https://bugzilla.suse.com/981695 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/983632 https://bugzilla.suse.com/983638 https://bugzilla.suse.com/983639 https://bugzilla.suse.com/983640 https://bugzilla.suse.com/983643 https://bugzilla.suse.com/983644 https://bugzilla.suse.com/983646 https://bugzilla.suse.com/983649 https://bugzilla.suse.com/983651 https://bugzilla.suse.com/983652 https://bugzilla.suse.com/983653 https://bugzilla.suse.com/983655 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1553-1: important: Security update for php5
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1553-1 Rating: important References: #976775 #980366 #980373 #980375 #981049 #981050 #981061 #982009 #982010 #982011 #982012 #982013 #982162 Cross-References: CVE-2013-7456 CVE-2015-4116 CVE-2015-8873 CVE-2015-8874 CVE-2015-8876 CVE-2015-8877 CVE-2015-8879 CVE-2016-3074 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 CVE-2016-5114 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2013-7456: imagescale out-of-bounds read (bnc#982009). - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don't create strings with lengths outside int range (bnc#982011). - CVE-2016-5095: Don't create strings with lengths outside int range (bnc#982012). - CVE-2016-5096: int/size_t confusion in fread (bsc#982013). - CVE-2016-5114: fpm_log.c memory leak and buffer overflow (bnc#982162). - CVE-2015-8877: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd), as used in PHP, used inconsistent allocate and free approaches, which allowed remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function (bsc#981061). - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not validate certain Exception objects, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data (bsc#981049). - CVE-2015-8879: The odbc_bindcols function in ext/odbc/php_odbc.c in PHP mishandled driver behavior for SQL_WVARCHAR columns, which allowed remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table Aliased: (bsc#981050). - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP allowed remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation (bsc#980366). - CVE-2015-8874: Stack consumption vulnerability in GD in PHP allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call (bsc#980375). - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c in PHP allowed remote attackers to cause a denial of service (segmentation fault) via recursive method calls (bsc#980373). - CVE-2016-3074: Integer signedness error in GD Graphics Library (aka libgd or libgd2) allowed remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow (bsc#976775). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-703=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-66.1 apache2-mod_php5-debuginfo-5.6.1-66.1 php5-5.6.1-66.1 php5-bcmath-5.6.1-66.1 php5-bcmath-debuginfo-5.6.1-66.1 php5-bz2-5.6.1-66.1 php5-bz2-debuginfo-5.6.1-66.1 php5-calendar-5.6.1-66.1 php5-calendar-debuginfo-5.6.1-66.1 php5-ctype-5.6.1-66.1 php5-ctype-debuginfo-5.6.1-66.1 php5-curl-5.6.1-66.1 php5-curl-debuginfo-5.6.1-66.1 php5-dba-5.6.1-66.1 php5-dba-debuginfo-5.6.1-66.1 php5-debuginfo-5.6.1-66.1 php5-debugsource-5.6.1-66.1 php5-devel-5.6.1-66.1 php5-dom-5.6.1-66.1 php5-dom-debuginfo-5.6.1-66.1 php5-enchant-5.6.1-66.1 php5-enchant-debuginfo-5.6.1-66.1 php5-exif-5.6.1-66.1 php5-exif-debuginfo-5.6.1-66.1 php5-fastcgi-5.6.1-66.1 php5-fastcgi-debuginfo-5.6.1-66.1 php5-fileinfo-5.6.1-66.1 php5-fileinfo-debuginfo-5.6.1-66.1 php5-firebird-5.6.1-66.1 php5-firebird-debuginfo-5.6.1-66.1 php5-fpm-5.6.1-66.1 php5-fpm-debuginfo-5.6.1-66.1 php5-ftp-5.6.1-66.1 php5-ftp-debuginfo-5.6.1-66.1 php5-gd-5.6.1-66.1 php5-gd-debuginfo-5.6.1-66.1 php5-gettext-5.6.1-66.1 php5-gettext-debuginfo-5.6.1-66.1 php5-gmp-5.6.1-66.1 php5-gmp-debuginfo-5.6.1-66.1 php5-iconv-5.6.1-66.1 php5-iconv-debuginfo-5.6.1-66.1 php5-imap-5.6.1-66.1 php5-imap-debuginfo-5.6.1-66.1 php5-intl-5.6.1-66.1 php5-intl-debuginfo-5.6.1-66.1 php5-json-5.6.1-66.1 php5-json-debuginfo-5.6.1-66.1 php5-ldap-5.6.1-66.1 php5-ldap-debuginfo-5.6.1-66.1 php5-mbstring-5.6.1-66.1 php5-mbstring-debuginfo-5.6.1-66.1 php5-mcrypt-5.6.1-66.1 php5-mcrypt-debuginfo-5.6.1-66.1 php5-mssql-5.6.1-66.1 php5-mssql-debuginfo-5.6.1-66.1 php5-mysql-5.6.1-66.1 php5-mysql-debuginfo-5.6.1-66.1 php5-odbc-5.6.1-66.1 php5-odbc-debuginfo-5.6.1-66.1 php5-opcache-5.6.1-66.1 php5-opcache-debuginfo-5.6.1-66.1 php5-openssl-5.6.1-66.1 php5-openssl-debuginfo-5.6.1-66.1 php5-pcntl-5.6.1-66.1 php5-pcntl-debuginfo-5.6.1-66.1 php5-pdo-5.6.1-66.1 php5-pdo-debuginfo-5.6.1-66.1 php5-pgsql-5.6.1-66.1 php5-pgsql-debuginfo-5.6.1-66.1 php5-phar-5.6.1-66.1 php5-phar-debuginfo-5.6.1-66.1 php5-posix-5.6.1-66.1 php5-posix-debuginfo-5.6.1-66.1 php5-pspell-5.6.1-66.1 php5-pspell-debuginfo-5.6.1-66.1 php5-readline-5.6.1-66.1 php5-readline-debuginfo-5.6.1-66.1 php5-shmop-5.6.1-66.1 php5-shmop-debuginfo-5.6.1-66.1 php5-snmp-5.6.1-66.1 php5-snmp-debuginfo-5.6.1-66.1 php5-soap-5.6.1-66.1 php5-soap-debuginfo-5.6.1-66.1 php5-sockets-5.6.1-66.1 php5-sockets-debuginfo-5.6.1-66.1 php5-sqlite-5.6.1-66.1 php5-sqlite-debuginfo-5.6.1-66.1 php5-suhosin-5.6.1-66.1 php5-suhosin-debuginfo-5.6.1-66.1 php5-sysvmsg-5.6.1-66.1 php5-sysvmsg-debuginfo-5.6.1-66.1 php5-sysvsem-5.6.1-66.1 php5-sysvsem-debuginfo-5.6.1-66.1 php5-sysvshm-5.6.1-66.1 php5-sysvshm-debuginfo-5.6.1-66.1 php5-tidy-5.6.1-66.1 php5-tidy-debuginfo-5.6.1-66.1 php5-tokenizer-5.6.1-66.1 php5-tokenizer-debuginfo-5.6.1-66.1 php5-wddx-5.6.1-66.1 php5-wddx-debuginfo-5.6.1-66.1 php5-xmlreader-5.6.1-66.1 php5-xmlreader-debuginfo-5.6.1-66.1 php5-xmlrpc-5.6.1-66.1 php5-xmlrpc-debuginfo-5.6.1-66.1 php5-xmlwriter-5.6.1-66.1 php5-xmlwriter-debuginfo-5.6.1-66.1 php5-xsl-5.6.1-66.1 php5-xsl-debuginfo-5.6.1-66.1 php5-zip-5.6.1-66.1 php5-zip-debuginfo-5.6.1-66.1 php5-zlib-5.6.1-66.1 php5-zlib-debuginfo-5.6.1-66.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-66.1 References: https://www.suse.com/security/cve/CVE-2013-7456.html https://www.suse.com/security/cve/CVE-2015-4116.html https://www.suse.com/security/cve/CVE-2015-8873.html https://www.suse.com/security/cve/CVE-2015-8874.html https://www.suse.com/security/cve/CVE-2015-8876.html https://www.suse.com/security/cve/CVE-2015-8877.html https://www.suse.com/security/cve/CVE-2015-8879.html https://www.suse.com/security/cve/CVE-2016-3074.html https://www.suse.com/security/cve/CVE-2016-5093.html https://www.suse.com/security/cve/CVE-2016-5094.html https://www.suse.com/security/cve/CVE-2016-5095.html https://www.suse.com/security/cve/CVE-2016-5096.html https://www.suse.com/security/cve/CVE-2016-5114.html https://bugzilla.suse.com/976775 https://bugzilla.suse.com/980366 https://bugzilla.suse.com/980373 https://bugzilla.suse.com/980375 https://bugzilla.suse.com/981049 https://bugzilla.suse.com/981050 https://bugzilla.suse.com/981061 https://bugzilla.suse.com/982009 https://bugzilla.suse.com/982010 https://bugzilla.suse.com/982011 https://bugzilla.suse.com/982012 https://bugzilla.suse.com/982013 https://bugzilla.suse.com/982162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1552-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1552-1 Rating: important References: #980384 #981695 #983549 #983632 #983638 #983639 #983640 #983643 #983644 #983646 #983649 #983651 #983652 #983653 #983655 Cross-References: CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 CVE-2016-2834 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has two fixes is now available. Description: This update to Mozilla Firefox 47 fixes the following issues (boo#983549): Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities: - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included: - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included: - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided: - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-704=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-704=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-47.0-24.1 MozillaFirefox-branding-upstream-47.0-24.1 MozillaFirefox-buildsymbols-47.0-24.1 MozillaFirefox-debuginfo-47.0-24.1 MozillaFirefox-debugsource-47.0-24.1 MozillaFirefox-devel-47.0-24.1 MozillaFirefox-translations-common-47.0-24.1 MozillaFirefox-translations-other-47.0-24.1 libfreebl3-3.23-18.1 libfreebl3-debuginfo-3.23-18.1 libsoftokn3-3.23-18.1 libsoftokn3-debuginfo-3.23-18.1 mozilla-nss-3.23-18.1 mozilla-nss-certs-3.23-18.1 mozilla-nss-certs-debuginfo-3.23-18.1 mozilla-nss-debuginfo-3.23-18.1 mozilla-nss-debugsource-3.23-18.1 mozilla-nss-devel-3.23-18.1 mozilla-nss-sysinit-3.23-18.1 mozilla-nss-sysinit-debuginfo-3.23-18.1 mozilla-nss-tools-3.23-18.1 mozilla-nss-tools-debuginfo-3.23-18.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.23-18.1 libfreebl3-debuginfo-32bit-3.23-18.1 libsoftokn3-32bit-3.23-18.1 libsoftokn3-debuginfo-32bit-3.23-18.1 mozilla-nss-32bit-3.23-18.1 mozilla-nss-certs-32bit-3.23-18.1 mozilla-nss-certs-debuginfo-32bit-3.23-18.1 mozilla-nss-debuginfo-32bit-3.23-18.1 mozilla-nss-sysinit-32bit-3.23-18.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-18.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-47.0-71.1 MozillaFirefox-branding-upstream-47.0-71.1 MozillaFirefox-buildsymbols-47.0-71.1 MozillaFirefox-debuginfo-47.0-71.1 MozillaFirefox-debugsource-47.0-71.1 MozillaFirefox-devel-47.0-71.1 MozillaFirefox-translations-common-47.0-71.1 MozillaFirefox-translations-other-47.0-71.1 libfreebl3-3.23-34.1 libfreebl3-debuginfo-3.23-34.1 libsoftokn3-3.23-34.1 libsoftokn3-debuginfo-3.23-34.1 mozilla-nss-3.23-34.1 mozilla-nss-certs-3.23-34.1 mozilla-nss-certs-debuginfo-3.23-34.1 mozilla-nss-debuginfo-3.23-34.1 mozilla-nss-debugsource-3.23-34.1 mozilla-nss-devel-3.23-34.1 mozilla-nss-sysinit-3.23-34.1 mozilla-nss-sysinit-debuginfo-3.23-34.1 mozilla-nss-tools-3.23-34.1 mozilla-nss-tools-debuginfo-3.23-34.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.23-34.1 libfreebl3-debuginfo-32bit-3.23-34.1 libsoftokn3-32bit-3.23-34.1 libsoftokn3-debuginfo-32bit-3.23-34.1 mozilla-nss-32bit-3.23-34.1 mozilla-nss-certs-32bit-3.23-34.1 mozilla-nss-certs-debuginfo-32bit-3.23-34.1 mozilla-nss-debuginfo-32bit-3.23-34.1 mozilla-nss-sysinit-32bit-3.23-34.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-34.1 References: https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://www.suse.com/security/cve/CVE-2016-2819.html https://www.suse.com/security/cve/CVE-2016-2821.html https://www.suse.com/security/cve/CVE-2016-2822.html https://www.suse.com/security/cve/CVE-2016-2824.html https://www.suse.com/security/cve/CVE-2016-2825.html https://www.suse.com/security/cve/CVE-2016-2828.html https://www.suse.com/security/cve/CVE-2016-2829.html https://www.suse.com/security/cve/CVE-2016-2831.html https://www.suse.com/security/cve/CVE-2016-2832.html https://www.suse.com/security/cve/CVE-2016-2833.html https://www.suse.com/security/cve/CVE-2016-2834.html https://bugzilla.suse.com/980384 https://bugzilla.suse.com/981695 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/983632 https://bugzilla.suse.com/983638 https://bugzilla.suse.com/983639 https://bugzilla.suse.com/983640 https://bugzilla.suse.com/983643 https://bugzilla.suse.com/983644 https://bugzilla.suse.com/983646 https://bugzilla.suse.com/983649 https://bugzilla.suse.com/983651 https://bugzilla.suse.com/983652 https://bugzilla.suse.com/983653 https://bugzilla.suse.com/983655 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1541-1: important: Security update for bind
by opensuse-security＠opensuse.org 10 Jun '16

10 Jun '16

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1541-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes two assertion failures that could lead to a remote denial of service attack: - CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) - CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-bind-12608=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-bind-12608=1 - SUSE Manager 2.1: zypper in -t patch sleman21-bind-12608=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): bind-9.9.6P1-0.27.1 bind-chrootenv-9.9.6P1-0.27.1 bind-doc-9.9.6P1-0.27.1 bind-libs-32bit-9.9.6P1-0.27.1 bind-libs-9.9.6P1-0.27.1 bind-utils-9.9.6P1-0.27.1 - SUSE Manager Proxy 2.1 (x86_64): bind-9.9.6P1-0.27.1 bind-chrootenv-9.9.6P1-0.27.1 bind-doc-9.9.6P1-0.27.1 bind-libs-32bit-9.9.6P1-0.27.1 bind-libs-9.9.6P1-0.27.1 bind-utils-9.9.6P1-0.27.1 - SUSE Manager 2.1 (s390x x86_64): bind-9.9.6P1-0.27.1 bind-chrootenv-9.9.6P1-0.27.1 bind-doc-9.9.6P1-0.27.1 bind-libs-32bit-9.9.6P1-0.27.1 bind-libs-9.9.6P1-0.27.1 bind-utils-9.9.6P1-0.27.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1538-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 09 Jun '16

09 Jun '16

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1538-1 Rating: important References: #963963 #965283 #978395 #981040 #981041 #981108 #981109 #981111 #981112 #981114 #981115 #981548 #981549 #981550 Cross-References: CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 CVE-2016-4483 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc#978395]. - CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040]. - CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041]. - CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108]. - CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109]. - CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral [bsc#981111]. - CVE-2016-1838: Fixed a heap-based buffer overread in xmlParserPrintFileContextInternal [bsc#981112]. - CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115]. - CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548]. - CVE-2016-4448: Fixed some format string warnings with possible format string vulnerability [bsc#981549], - CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550]. - CVE-2016-3705: Fixed missing increment of recursion counter. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-915=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-915=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-915=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-915=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-915=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-915=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libxml2-debugsource-2.9.1-24.1 libxml2-devel-2.9.1-24.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libxml2-debugsource-2.9.1-24.1 libxml2-devel-2.9.1-24.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libxml2-2-2.9.1-24.1 libxml2-2-debuginfo-2.9.1-24.1 libxml2-debugsource-2.9.1-24.1 libxml2-tools-2.9.1-24.1 libxml2-tools-debuginfo-2.9.1-24.1 python-libxml2-2.9.1-24.1 python-libxml2-debuginfo-2.9.1-24.1 python-libxml2-debugsource-2.9.1-24.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libxml2-2-32bit-2.9.1-24.1 libxml2-2-debuginfo-32bit-2.9.1-24.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): libxml2-doc-2.9.1-24.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libxml2-2-2.9.1-24.1 libxml2-2-debuginfo-2.9.1-24.1 libxml2-debugsource-2.9.1-24.1 libxml2-tools-2.9.1-24.1 libxml2-tools-debuginfo-2.9.1-24.1 python-libxml2-2.9.1-24.1 python-libxml2-debuginfo-2.9.1-24.1 python-libxml2-debugsource-2.9.1-24.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libxml2-2-32bit-2.9.1-24.1 libxml2-2-debuginfo-32bit-2.9.1-24.1 - SUSE Linux Enterprise Server 12 (noarch): libxml2-doc-2.9.1-24.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libxml2-2-2.9.1-24.1 libxml2-2-32bit-2.9.1-24.1 libxml2-2-debuginfo-2.9.1-24.1 libxml2-2-debuginfo-32bit-2.9.1-24.1 libxml2-debugsource-2.9.1-24.1 libxml2-tools-2.9.1-24.1 libxml2-tools-debuginfo-2.9.1-24.1 python-libxml2-2.9.1-24.1 python-libxml2-debuginfo-2.9.1-24.1 python-libxml2-debugsource-2.9.1-24.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libxml2-2-2.9.1-24.1 libxml2-2-32bit-2.9.1-24.1 libxml2-2-debuginfo-2.9.1-24.1 libxml2-2-debuginfo-32bit-2.9.1-24.1 libxml2-debugsource-2.9.1-24.1 libxml2-tools-2.9.1-24.1 libxml2-tools-debuginfo-2.9.1-24.1 python-libxml2-2.9.1-24.1 python-libxml2-debuginfo-2.9.1-24.1 python-libxml2-debugsource-2.9.1-24.1 References: https://www.suse.com/security/cve/CVE-2015-8806.html https://www.suse.com/security/cve/CVE-2016-1762.html https://www.suse.com/security/cve/CVE-2016-1833.html https://www.suse.com/security/cve/CVE-2016-1834.html https://www.suse.com/security/cve/CVE-2016-1835.html https://www.suse.com/security/cve/CVE-2016-1837.html https://www.suse.com/security/cve/CVE-2016-1838.html https://www.suse.com/security/cve/CVE-2016-1839.html https://www.suse.com/security/cve/CVE-2016-1840.html https://www.suse.com/security/cve/CVE-2016-2073.html https://www.suse.com/security/cve/CVE-2016-3705.html https://www.suse.com/security/cve/CVE-2016-4447.html https://www.suse.com/security/cve/CVE-2016-4448.html https://www.suse.com/security/cve/CVE-2016-4449.html https://www.suse.com/security/cve/CVE-2016-4483.html https://bugzilla.suse.com/963963 https://bugzilla.suse.com/965283 https://bugzilla.suse.com/978395 https://bugzilla.suse.com/981040 https://bugzilla.suse.com/981041 https://bugzilla.suse.com/981108 https://bugzilla.suse.com/981109 https://bugzilla.suse.com/981111 https://bugzilla.suse.com/981112 https://bugzilla.suse.com/981114 https://bugzilla.suse.com/981115 https://bugzilla.suse.com/981548 https://bugzilla.suse.com/981549 https://bugzilla.suse.com/981550 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0