June 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:1534-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 09 Jun '16

09 Jun '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1534-1 Rating: important References: #982178 Cross-References: CVE-2016-5118 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - security update: * CVE-2016-5118 [boo#982178] + ImageMagick-CVE-2016-5118.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-700=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-21.1 ImageMagick-debuginfo-6.8.9.8-21.1 ImageMagick-debugsource-6.8.9.8-21.1 ImageMagick-devel-6.8.9.8-21.1 ImageMagick-extra-6.8.9.8-21.1 ImageMagick-extra-debuginfo-6.8.9.8-21.1 libMagick++-6_Q16-5-6.8.9.8-21.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-21.1 libMagick++-devel-6.8.9.8-21.1 libMagickCore-6_Q16-2-6.8.9.8-21.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-21.1 libMagickWand-6_Q16-2-6.8.9.8-21.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-21.1 perl-PerlMagick-6.8.9.8-21.1 perl-PerlMagick-debuginfo-6.8.9.8-21.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-21.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-21.1 libMagick++-6_Q16-5-32bit-6.8.9.8-21.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-21.1 libMagick++-devel-32bit-6.8.9.8-21.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-21.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-21.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-21.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-21.1 References: https://www.suse.com/security/cve/CVE-2016-5118.html https://bugzilla.suse.com/982178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1523-1: important: Security update for expat
by opensuse-security＠opensuse.org 08 Jun '16

08 Jun '16

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1523-1 Rating: important References: #979441 #980391 Cross-References: CVE-2015-1283 CVE-2016-0718 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441) - CVE-2015-1283: Fix multiple integer overflows. (bnc#980391) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-695=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): expat-2.1.0-17.1 expat-debuginfo-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat-devel-2.1.0-17.1 libexpat1-2.1.0-17.1 libexpat1-debuginfo-2.1.0-17.1 - openSUSE Leap 42.1 (x86_64): expat-debuginfo-32bit-2.1.0-17.1 libexpat-devel-32bit-2.1.0-17.1 libexpat1-32bit-2.1.0-17.1 libexpat1-debuginfo-32bit-2.1.0-17.1 References: https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2016-0718.html https://bugzilla.suse.com/979441 https://bugzilla.suse.com/980391 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1522-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 08 Jun '16

08 Jun '16

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1522-1 Rating: important References: #982178 Cross-References: CVE-2016-5118 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - security update: * CVE-2016-5118 [boo#982178] + GraphicsMagick-CVE-2016-5118.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-694=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): GraphicsMagick-1.3.20-6.1 GraphicsMagick-debuginfo-1.3.20-6.1 GraphicsMagick-debugsource-1.3.20-6.1 GraphicsMagick-devel-1.3.20-6.1 libGraphicsMagick++-Q16-3-1.3.20-6.1 libGraphicsMagick++-Q16-3-debuginfo-1.3.20-6.1 libGraphicsMagick++-devel-1.3.20-6.1 libGraphicsMagick-Q16-3-1.3.20-6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.20-6.1 libGraphicsMagick3-config-1.3.20-6.1 libGraphicsMagickWand-Q16-2-1.3.20-6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.20-6.1 perl-GraphicsMagick-1.3.20-6.1 perl-GraphicsMagick-debuginfo-1.3.20-6.1 References: https://www.suse.com/security/cve/CVE-2016-5118.html https://bugzilla.suse.com/982178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1521-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 08 Jun '16

08 Jun '16

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1521-1 Rating: important References: #982178 Cross-References: CVE-2016-5118 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - security update: * CVE-2016-5118 [boo#982178] + GraphicsMagick-CVE-2016-5118.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-693=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-8.1 GraphicsMagick-debuginfo-1.3.21-8.1 GraphicsMagick-debugsource-1.3.21-8.1 GraphicsMagick-devel-1.3.21-8.1 libGraphicsMagick++-Q16-11-1.3.21-8.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-8.1 libGraphicsMagick++-devel-1.3.21-8.1 libGraphicsMagick-Q16-3-1.3.21-8.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-8.1 libGraphicsMagick3-config-1.3.21-8.1 libGraphicsMagickWand-Q16-2-1.3.21-8.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-8.1 perl-GraphicsMagick-1.3.21-8.1 perl-GraphicsMagick-debuginfo-1.3.21-8.1 References: https://www.suse.com/security/cve/CVE-2016-5118.html https://bugzilla.suse.com/982178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1512-1: important: Security update for expat
by opensuse-security＠opensuse.org 07 Jun '16

07 Jun '16

SUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1512-1 Rating: important References: #979441 #980391 Cross-References: CVE-2015-1283 CVE-2016-0718 Affected Products: SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441) - CVE-2015-1283: Fix multiple integer overflows. (bnc#980391) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-expat-12600=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-expat-12600=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-expat-12600=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-expat-12600=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): libexpat-devel-2.0.1-88.38.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libexpat-devel-2.0.1-88.38.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): expat-2.0.1-88.38.1 libexpat1-2.0.1-88.38.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libexpat1-32bit-2.0.1-88.38.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libexpat1-x86-2.0.1-88.38.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): expat-debuginfo-2.0.1-88.38.1 expat-debugsource-2.0.1-88.38.1 References: https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2016-0718.html https://bugzilla.suse.com/979441 https://bugzilla.suse.com/980391 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1508-1: important: Security update for expat
by opensuse-security＠opensuse.org 07 Jun '16

07 Jun '16

SUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1508-1 Rating: important References: #979441 #980391 Cross-References: CVE-2015-1283 CVE-2016-0718 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441) - CVE-2015-1283: Fix multiple integer overflows. (bnc#980391) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-898=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-898=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-898=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-898=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-898=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-898=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): expat-debuginfo-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat-devel-2.1.0-17.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): expat-debuginfo-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat-devel-2.1.0-17.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): expat-2.1.0-17.1 expat-debuginfo-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat1-2.1.0-17.1 libexpat1-debuginfo-2.1.0-17.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): expat-debuginfo-32bit-2.1.0-17.1 libexpat1-32bit-2.1.0-17.1 libexpat1-debuginfo-32bit-2.1.0-17.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): expat-2.1.0-17.1 expat-debuginfo-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat1-2.1.0-17.1 libexpat1-debuginfo-2.1.0-17.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): expat-debuginfo-32bit-2.1.0-17.1 libexpat1-32bit-2.1.0-17.1 libexpat1-debuginfo-32bit-2.1.0-17.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): expat-2.1.0-17.1 expat-debuginfo-2.1.0-17.1 expat-debuginfo-32bit-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat1-2.1.0-17.1 libexpat1-32bit-2.1.0-17.1 libexpat1-debuginfo-2.1.0-17.1 libexpat1-debuginfo-32bit-2.1.0-17.1 - SUSE Linux Enterprise Desktop 12 (x86_64): expat-2.1.0-17.1 expat-debuginfo-2.1.0-17.1 expat-debuginfo-32bit-2.1.0-17.1 expat-debugsource-2.1.0-17.1 libexpat1-2.1.0-17.1 libexpat1-32bit-2.1.0-17.1 libexpat1-debuginfo-2.1.0-17.1 libexpat1-debuginfo-32bit-2.1.0-17.1 References: https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2016-0718.html https://bugzilla.suse.com/979441 https://bugzilla.suse.com/980391 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1496-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 05 Jun '16

05 Jun '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1496-1 Rating: important References: #981886 #982719 Cross-References: CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683 CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: Chromium was updated to 51.0.2704.79 to fix the following vulnerabilities: - CVE-2016-1696: Cross-origin bypass in Extension bindings - CVE-2016-1697: Cross-origin bypass in Blink - CVE-2016-1698: Information leak in Extension bindings - CVE-2016-1699: Parameter sanitization failure in DevTools - CVE-2016-1700: Use-after-free in Extensions - CVE-2016-1701: Use-after-free in Autofill - CVE-2016-1702: Out-of-bounds read in Skia - CVE-2016-1703: Various fixes from internal audits, fuzzing and other initiatives Also includes vulnerabilities fixed in 51.0.2704.63 (boo#981886): - CVE-2016-1672: Cross-origin bypass in extension bindings - CVE-2016-1673: Cross-origin bypass in Blink - CVE-2016-1674: Cross-origin bypass in extensions - CVE-2016-1675: Cross-origin bypass in Blink - CVE-2016-1676: Cross-origin bypass in extension bindings - CVE-2016-1677: Type confusion in V8 - CVE-2016-1678: Heap overflow in V8 - CVE-2016-1679: Heap use-after-free in V8 bindings - CVE-2016-1680: Heap use-after-free in Skia - CVE-2016-1681: Heap overflow in PDFium - CVE-2016-1682: CSP bypass for ServiceWorker - CVE-2016-1683: Out-of-bounds access in libxslt - CVE-2016-1684: Integer overflow in libxslt - CVE-2016-1685: Out-of-bounds read in PDFium - CVE-2016-1686: Out-of-bounds read in PDFium - CVE-2016-1687: Information leak in extensions - CVE-2016-1688: Out-of-bounds read in V8 - CVE-2016-1689: Heap buffer overflow in media - CVE-2016-1690: Heap use-after-free in Autofill - CVE-2016-1691: Heap buffer-overflow in Skia - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker - CVE-2016-1693: HTTP Download of Software Removal Tool - CVE-2016-1694: HPKP pins removed on cache clearance - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-682=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-51.0.2704.79-105.2 chromedriver-debuginfo-51.0.2704.79-105.2 chromium-51.0.2704.79-105.2 chromium-debuginfo-51.0.2704.79-105.2 chromium-debugsource-51.0.2704.79-105.2 chromium-desktop-gnome-51.0.2704.79-105.2 chromium-desktop-kde-51.0.2704.79-105.2 chromium-ffmpegsumo-51.0.2704.79-105.2 chromium-ffmpegsumo-debuginfo-51.0.2704.79-105.2 References: https://www.suse.com/security/cve/CVE-2016-1672.html https://www.suse.com/security/cve/CVE-2016-1673.html https://www.suse.com/security/cve/CVE-2016-1674.html https://www.suse.com/security/cve/CVE-2016-1675.html https://www.suse.com/security/cve/CVE-2016-1676.html https://www.suse.com/security/cve/CVE-2016-1677.html https://www.suse.com/security/cve/CVE-2016-1678.html https://www.suse.com/security/cve/CVE-2016-1679.html https://www.suse.com/security/cve/CVE-2016-1680.html https://www.suse.com/security/cve/CVE-2016-1681.html https://www.suse.com/security/cve/CVE-2016-1682.html https://www.suse.com/security/cve/CVE-2016-1683.html https://www.suse.com/security/cve/CVE-2016-1684.html https://www.suse.com/security/cve/CVE-2016-1685.html https://www.suse.com/security/cve/CVE-2016-1686.html https://www.suse.com/security/cve/CVE-2016-1687.html https://www.suse.com/security/cve/CVE-2016-1688.html https://www.suse.com/security/cve/CVE-2016-1689.html https://www.suse.com/security/cve/CVE-2016-1690.html https://www.suse.com/security/cve/CVE-2016-1691.html https://www.suse.com/security/cve/CVE-2016-1692.html https://www.suse.com/security/cve/CVE-2016-1693.html https://www.suse.com/security/cve/CVE-2016-1694.html https://www.suse.com/security/cve/CVE-2016-1695.html https://www.suse.com/security/cve/CVE-2016-1696.html https://www.suse.com/security/cve/CVE-2016-1697.html https://www.suse.com/security/cve/CVE-2016-1698.html https://www.suse.com/security/cve/CVE-2016-1699.html https://www.suse.com/security/cve/CVE-2016-1700.html https://www.suse.com/security/cve/CVE-2016-1701.html https://www.suse.com/security/cve/CVE-2016-1702.html https://www.suse.com/security/cve/CVE-2016-1703.html https://bugzilla.suse.com/981886 https://bugzilla.suse.com/982719 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1490-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 04 Jun '16

04 Jun '16

SUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1490-1 Rating: important References: #982719 Cross-References: CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: Chromium was updated to 51.0.2704.79 to fix a number of security issues. [boo#982719] - CVE-2016-1696: Cross-origin bypass in Extension bindings - CVE-2016-1697: Cross-origin bypass in Blink - CVE-2016-1698: Information leak in Extension bindings - CVE-2016-1699: Parameter sanitization failure in DevTools - CVE-2016-1700: Use-after-free in Extensions - CVE-2016-1701: Use-after-free in Autofill - CVE-2016-1702: Out-of-bounds read in Skia - CVE-2016-1703: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch 5171=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-51.0.2704.79-81.1 chromedriver-debuginfo-51.0.2704.79-81.1 chromium-51.0.2704.79-81.1 chromium-debuginfo-51.0.2704.79-81.1 chromium-debugsource-51.0.2704.79-81.1 chromium-desktop-gnome-51.0.2704.79-81.1 chromium-desktop-kde-51.0.2704.79-81.1 chromium-ffmpegsumo-51.0.2704.79-81.1 chromium-ffmpegsumo-debuginfo-51.0.2704.79-81.1 References: https://www.suse.com/security/cve/CVE-2016-1696.html https://www.suse.com/security/cve/CVE-2016-1697.html https://www.suse.com/security/cve/CVE-2016-1698.html https://www.suse.com/security/cve/CVE-2016-1699.html https://www.suse.com/security/cve/CVE-2016-1700.html https://www.suse.com/security/cve/CVE-2016-1701.html https://www.suse.com/security/cve/CVE-2016-1702.html https://www.suse.com/security/cve/CVE-2016-1703.html https://bugzilla.suse.com/982719 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1489-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 04 Jun '16

04 Jun '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1489-1 Rating: important References: #982719 Cross-References: CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: Chromium was updated to 51.0.2704.79 to fix a number of security issues. [boo#982719] - CVE-2016-1696: Cross-origin bypass in Extension bindings - CVE-2016-1697: Cross-origin bypass in Blink - CVE-2016-1698: Information leak in Extension bindings - CVE-2016-1699: Parameter sanitization failure in DevTools - CVE-2016-1700: Use-after-free in Extensions - CVE-2016-1701: Use-after-free in Autofill - CVE-2016-1702: Out-of-bounds read in Skia - CVE-2016-1703: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 5171=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-51.0.2704.79-54.1 chromedriver-debuginfo-51.0.2704.79-54.1 chromium-51.0.2704.79-54.1 chromium-debuginfo-51.0.2704.79-54.1 chromium-debugsource-51.0.2704.79-54.1 chromium-desktop-gnome-51.0.2704.79-54.1 chromium-desktop-kde-51.0.2704.79-54.1 chromium-ffmpegsumo-51.0.2704.79-54.1 chromium-ffmpegsumo-debuginfo-51.0.2704.79-54.1 References: https://www.suse.com/security/cve/CVE-2016-1696.html https://www.suse.com/security/cve/CVE-2016-1697.html https://www.suse.com/security/cve/CVE-2016-1698.html https://www.suse.com/security/cve/CVE-2016-1699.html https://www.suse.com/security/cve/CVE-2016-1700.html https://www.suse.com/security/cve/CVE-2016-1701.html https://www.suse.com/security/cve/CVE-2016-1702.html https://www.suse.com/security/cve/CVE-2016-1703.html https://bugzilla.suse.com/982719 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1475-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 02 Jun '16

02 Jun '16

SUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1475-1 Rating: important References: #965665 #977646 #977648 #977650 #979252 Cross-References: CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for java-1_8_0-ibm fixes the following issues: - IBM Java 80-3.0 released: (bsc#977646 bsc#977648 bsc#977650 bsc#979252) CVE-2016-0376 CVE-2016-0264 CVE-2016-0363 CVE-2016-3443 CVE-2016-0687 CVE-2016-0686 CVE-2016-3427 CVE-2016-3449 CVE-2016-3422 CVE-2016-3426 - There is no HtmlConverter and apt provided by jdk8 bsc#965665 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-876=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-876=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr3.0-10.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr3.0-10.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr3.0-10.1 java-1_8_0-ibm-plugin-1.8.0_sr3.0-10.1 References: https://www.suse.com/security/cve/CVE-2016-0264.html https://www.suse.com/security/cve/CVE-2016-0363.html https://www.suse.com/security/cve/CVE-2016-0376.html https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-3422.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://www.suse.com/security/cve/CVE-2016-3443.html https://www.suse.com/security/cve/CVE-2016-3449.html https://bugzilla.suse.com/965665 https://bugzilla.suse.com/977646 https://bugzilla.suse.com/977648 https://bugzilla.suse.com/977650 https://bugzilla.suse.com/979252 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1471-1: important: Security update for ntp
by opensuse-security＠opensuse.org 01 Jun '16

01 Jun '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1471-1 Rating: important References: #957226 #977446 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for ntp fixes the following issues: - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". - Update to 4.2.8p7 (bsc#977446): * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * integrate ntp-fork.patch * Improve the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ntp-12592=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ntp-12592=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ntp-12592=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ntp-12592=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ntp-12592=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ntp-12592=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-ntp-12592=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): ntp-4.2.8p7-44.1 ntp-doc-4.2.8p7-44.1 - SUSE Manager Proxy 2.1 (x86_64): ntp-4.2.8p7-44.1 ntp-doc-4.2.8p7-44.1 - SUSE Manager 2.1 (s390x x86_64): ntp-4.2.8p7-44.1 ntp-doc-4.2.8p7-44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): ntp-4.2.8p7-44.1 ntp-doc-4.2.8p7-44.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): ntp-4.2.8p7-44.1 ntp-doc-4.2.8p7-44.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ntp-debuginfo-4.2.8p7-44.1 ntp-debugsource-4.2.8p7-44.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): ntp-debuginfo-4.2.8p7-44.1 ntp-debugsource-4.2.8p7-44.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/977446 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1459-1: important: Security update for cyrus-imapd
by opensuse-security＠opensuse.org 01 Jun '16

01 Jun '16

SUSE Security Update: Security update for cyrus-imapd ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1459-1 Rating: important References: #860611 #901748 #954200 #954201 #981670 Cross-References: CVE-2014-3566 CVE-2015-8076 CVE-2015-8077 CVE-2015-8078 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for cyrus-imapd fixes the following issues: - Previous versions of cyrus-imapd would not allow its users to disable old SSL variants that are vulnerable to attacks like BEAST and POODLE. This patch adds the configuration option 'tls_versions' to remedy that issue. Note that users who upgrade an existing installation will *not* have their imapd.conf file overwritten, i.e. their IMAP server will continue to support SSLv2 and SSLv3 like before. To disable support for those protocols, edit imapd.conf manually to include "tls_versions: tls1_0 tls1_1 tls1_2". New installations, however, will have an imapd.conf file that contains these settings already, i.e. newly installed IMAP servers do *not* support unsafe versions of SSL unless that support is explicitly enabled by the user. (bsc#901748) - An integer overflow vulnerability in cyrus-imapd's urlfetch range checking code was fixed. (CVE-2015-8076, CVE-2015-8077, CVE-2015-8078, bsc#981670, bsc#954200, bsc#954201) - Support for Elliptic Curve Diffie–Hellman (ECDH) has been added to cyrus-imapd. (bsc#860611) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-cyrus-imapd-12589=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-cyrus-imapd-12589=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-cyrus-imapd-12589=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): cyrus-imapd-devel-2.3.11-60.65.67.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): perl-Cyrus-IMAP-2.3.11-60.65.67.1 perl-Cyrus-SIEVE-managesieve-2.3.11-60.65.67.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): cyrus-imapd-2.3.11-60.65.67.1 perl-Cyrus-IMAP-2.3.11-60.65.67.1 perl-Cyrus-SIEVE-managesieve-2.3.11-60.65.67.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): cyrus-imapd-debuginfo-2.3.11-60.65.67.1 cyrus-imapd-debugsource-2.3.11-60.65.67.1 References: https://www.suse.com/security/cve/CVE-2014-3566.html https://www.suse.com/security/cve/CVE-2015-8076.html https://www.suse.com/security/cve/CVE-2015-8077.html https://www.suse.com/security/cve/CVE-2015-8078.html https://bugzilla.suse.com/860611 https://bugzilla.suse.com/901748 https://bugzilla.suse.com/954200 https://bugzilla.suse.com/954201 https://bugzilla.suse.com/981670 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0