June 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:1613-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jun '16

17 Jun '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1613-1 Rating: critical References: #984695 Cross-References: CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 36 vulnerabilities is now available. Description: Adobe flash-player was updated to 11.2.202.626 to fix the following security issues: Security update to 11.2.202.626 (boo#984695): * APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 Please see https://helpx.adobe.com/security/products/flash-player/apsb16-18.html for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-960=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-960=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-960=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-960=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): flash-player-11.2.202.626-133.1 flash-player-gnome-11.2.202.626-133.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): flash-player-11.2.202.626-133.1 flash-player-gnome-11.2.202.626-133.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): flash-player-11.2.202.626-133.1 flash-player-gnome-11.2.202.626-133.1 - SUSE Linux Enterprise Desktop 12 (x86_64): flash-player-11.2.202.626-133.1 flash-player-gnome-11.2.202.626-133.1 References: https://www.suse.com/security/cve/CVE-2016-4122.html https://www.suse.com/security/cve/CVE-2016-4123.html https://www.suse.com/security/cve/CVE-2016-4124.html https://www.suse.com/security/cve/CVE-2016-4125.html https://www.suse.com/security/cve/CVE-2016-4127.html https://www.suse.com/security/cve/CVE-2016-4128.html https://www.suse.com/security/cve/CVE-2016-4129.html https://www.suse.com/security/cve/CVE-2016-4130.html https://www.suse.com/security/cve/CVE-2016-4131.html https://www.suse.com/security/cve/CVE-2016-4132.html https://www.suse.com/security/cve/CVE-2016-4133.html https://www.suse.com/security/cve/CVE-2016-4134.html https://www.suse.com/security/cve/CVE-2016-4135.html https://www.suse.com/security/cve/CVE-2016-4136.html https://www.suse.com/security/cve/CVE-2016-4137.html https://www.suse.com/security/cve/CVE-2016-4138.html https://www.suse.com/security/cve/CVE-2016-4139.html https://www.suse.com/security/cve/CVE-2016-4140.html https://www.suse.com/security/cve/CVE-2016-4141.html https://www.suse.com/security/cve/CVE-2016-4142.html https://www.suse.com/security/cve/CVE-2016-4143.html https://www.suse.com/security/cve/CVE-2016-4144.html https://www.suse.com/security/cve/CVE-2016-4145.html https://www.suse.com/security/cve/CVE-2016-4146.html https://www.suse.com/security/cve/CVE-2016-4147.html https://www.suse.com/security/cve/CVE-2016-4148.html https://www.suse.com/security/cve/CVE-2016-4149.html https://www.suse.com/security/cve/CVE-2016-4150.html https://www.suse.com/security/cve/CVE-2016-4151.html https://www.suse.com/security/cve/CVE-2016-4152.html https://www.suse.com/security/cve/CVE-2016-4153.html https://www.suse.com/security/cve/CVE-2016-4154.html https://www.suse.com/security/cve/CVE-2016-4155.html https://www.suse.com/security/cve/CVE-2016-4156.html https://www.suse.com/security/cve/CVE-2016-4166.html https://www.suse.com/security/cve/CVE-2016-4171.html https://bugzilla.suse.com/984695 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1610-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 17 Jun '16

17 Jun '16

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1610-1 Rating: important References: #982178 Cross-References: CVE-2016-5118 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2016-5118: popen() shell vulnerability via filenames (bsc#982178) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ImageMagick-12618=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ImageMagick-12618=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ImageMagick-12618=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ImageMagick-12618=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ImageMagick-12618=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ImageMagick-12618=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ImageMagick-12618=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ImageMagick-12618=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 libMagickCore1-6.4.3.6-7.40.1 - SUSE Manager Proxy 2.1 (x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 libMagickCore1-6.4.3.6-7.40.1 - SUSE Manager 2.1 (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 libMagickCore1-6.4.3.6-7.40.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-6.4.3.6-7.40.1 ImageMagick-devel-6.4.3.6-7.40.1 libMagick++-devel-6.4.3.6-7.40.1 libMagick++1-6.4.3.6-7.40.1 libMagickWand1-6.4.3.6-7.40.1 perl-PerlMagick-6.4.3.6-7.40.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libMagickWand1-32bit-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libMagickCore1-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libMagickCore1-6.4.3.6-7.40.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.40.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.40.1 ImageMagick-debugsource-6.4.3.6-7.40.1 References: https://www.suse.com/security/cve/CVE-2016-5118.html https://bugzilla.suse.com/982178 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1604-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 17 Jun '16

17 Jun '16

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1604-1 Rating: important References: #963963 #965283 #978395 #981040 #981041 #981108 #981109 #981111 #981112 #981114 #981115 #981548 #981549 #981550 Cross-References: CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 CVE-2016-4483 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc#978395]. - CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040]. - CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041]. - CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108]. - CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109]. - CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral [bsc#981111]. - CVE-2016-1838: Fixed a heap-based buffer overread in xmlParserPrintFileContextInternal [bsc#981112]. - CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115]. - CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548]. - CVE-2016-4448: Fixed some format string warnings with possible format string vulnerability [bsc#981549], - CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550]. - CVE-2016-3705: Fixed missing increment of recursion counter. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-libxml2-12616=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-libxml2-12616=1 - SUSE Manager 2.1: zypper in -t patch sleman21-libxml2-12616=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-libxml2-12616=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-libxml2-12616=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-libxml2-12616=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-libxml2-12616=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-libxml2-12616=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-libxml2-12616=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-libxml2-12616=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): libxml2-2.7.6-0.44.1 libxml2-32bit-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Manager Proxy 2.1 (x86_64): libxml2-2.7.6-0.44.1 libxml2-32bit-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Manager 2.1 (s390x x86_64): libxml2-2.7.6-0.44.1 libxml2-32bit-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libxml2-devel-2.7.6-0.44.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libxml2-devel-32bit-2.7.6-0.44.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libxml2-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libxml2-32bit-2.7.6-0.44.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libxml2-x86-2.7.6-0.44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libxml2-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libxml2-32bit-2.7.6-0.44.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): libxml2-2.7.6-0.44.1 libxml2-doc-2.7.6-0.44.1 libxml2-python-2.7.6-0.44.4 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): libxml2-32bit-2.7.6-0.44.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): libxml2-debuginfo-2.7.6-0.44.1 libxml2-debugsource-2.7.6-0.44.1 libxml2-python-debuginfo-2.7.6-0.44.4 libxml2-python-debugsource-2.7.6-0.44.4 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): libxml2-debuginfo-2.7.6-0.44.1 libxml2-debugsource-2.7.6-0.44.1 libxml2-python-debuginfo-2.7.6-0.44.4 libxml2-python-debugsource-2.7.6-0.44.4 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): libxml2-debuginfo-2.7.6-0.44.1 libxml2-debugsource-2.7.6-0.44.1 libxml2-python-debuginfo-2.7.6-0.44.4 libxml2-python-debugsource-2.7.6-0.44.4 References: https://www.suse.com/security/cve/CVE-2015-8806.html https://www.suse.com/security/cve/CVE-2016-1762.html https://www.suse.com/security/cve/CVE-2016-1833.html https://www.suse.com/security/cve/CVE-2016-1834.html https://www.suse.com/security/cve/CVE-2016-1835.html https://www.suse.com/security/cve/CVE-2016-1837.html https://www.suse.com/security/cve/CVE-2016-1838.html https://www.suse.com/security/cve/CVE-2016-1839.html https://www.suse.com/security/cve/CVE-2016-1840.html https://www.suse.com/security/cve/CVE-2016-2073.html https://www.suse.com/security/cve/CVE-2016-3705.html https://www.suse.com/security/cve/CVE-2016-4447.html https://www.suse.com/security/cve/CVE-2016-4448.html https://www.suse.com/security/cve/CVE-2016-4449.html https://www.suse.com/security/cve/CVE-2016-4483.html https://bugzilla.suse.com/963963 https://bugzilla.suse.com/965283 https://bugzilla.suse.com/978395 https://bugzilla.suse.com/981040 https://bugzilla.suse.com/981041 https://bugzilla.suse.com/981108 https://bugzilla.suse.com/981109 https://bugzilla.suse.com/981111 https://bugzilla.suse.com/981112 https://bugzilla.suse.com/981114 https://bugzilla.suse.com/981115 https://bugzilla.suse.com/981548 https://bugzilla.suse.com/981549 https://bugzilla.suse.com/981550 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1602-1: important: Security update for ntp
by opensuse-security＠opensuse.org 17 Jun '16

17 Jun '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1602-1 Rating: important References: #979302 #981422 #982056 #982064 #982065 #982066 #982067 #982068 Cross-References: CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - Keep the parent process alive until the daemon has finished initialisation, to make sure that the PID file exists when the parent returns. - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ntp-12615=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-ntp-12615=1 - SUSE Manager 2.1: zypper in -t patch sleman21-ntp-12615=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ntp-12615=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-ntp-12615=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ntp-12615=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-ntp-12615=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): ntp-4.2.8p8-47.3 ntp-doc-4.2.8p8-47.3 - SUSE Manager Proxy 2.1 (x86_64): ntp-4.2.8p8-47.3 ntp-doc-4.2.8p8-47.3 - SUSE Manager 2.1 (s390x x86_64): ntp-4.2.8p8-47.3 ntp-doc-4.2.8p8-47.3 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): ntp-4.2.8p8-47.3 ntp-doc-4.2.8p8-47.3 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): ntp-4.2.8p8-47.3 ntp-doc-4.2.8p8-47.3 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ntp-debuginfo-4.2.8p8-47.3 ntp-debugsource-4.2.8p8-47.3 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): ntp-debuginfo-4.2.8p8-47.3 ntp-debugsource-4.2.8p8-47.3 References: https://www.suse.com/security/cve/CVE-2016-4953.html https://www.suse.com/security/cve/CVE-2016-4954.html https://www.suse.com/security/cve/CVE-2016-4955.html https://www.suse.com/security/cve/CVE-2016-4956.html https://www.suse.com/security/cve/CVE-2016-4957.html https://bugzilla.suse.com/979302 https://bugzilla.suse.com/981422 https://bugzilla.suse.com/982056 https://bugzilla.suse.com/982064 https://bugzilla.suse.com/982065 https://bugzilla.suse.com/982066 https://bugzilla.suse.com/982067 https://bugzilla.suse.com/982068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1596-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 16 Jun '16

16 Jun '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1596-1 Rating: important References: #983143 Cross-References: CVE-2016-1583 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The SUSE Linux Enterprise 12 GA kernel was updated to fix one security issue. The following security bug was fixed: - CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils was installed and /sbin/mount.ecryptfs_private was setuid (bsc#983143). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-944=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-944=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-944=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2016-944=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-944=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-944=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.55-52.45.1 kernel-default-debugsource-3.12.55-52.45.1 kernel-default-extra-3.12.55-52.45.1 kernel-default-extra-debuginfo-3.12.55-52.45.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.55-52.45.1 kernel-obs-build-debugsource-3.12.55-52.45.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.55-52.45.4 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.55-52.45.1 kernel-default-base-3.12.55-52.45.1 kernel-default-base-debuginfo-3.12.55-52.45.1 kernel-default-debuginfo-3.12.55-52.45.1 kernel-default-debugsource-3.12.55-52.45.1 kernel-default-devel-3.12.55-52.45.1 kernel-syms-3.12.55-52.45.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.55-52.45.1 kernel-xen-base-3.12.55-52.45.1 kernel-xen-base-debuginfo-3.12.55-52.45.1 kernel-xen-debuginfo-3.12.55-52.45.1 kernel-xen-debugsource-3.12.55-52.45.1 kernel-xen-devel-3.12.55-52.45.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.55-52.45.1 kernel-macros-3.12.55-52.45.1 kernel-source-3.12.55-52.45.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.55-52.45.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.55-52.45.1 kernel-ec2-debuginfo-3.12.55-52.45.1 kernel-ec2-debugsource-3.12.55-52.45.1 kernel-ec2-devel-3.12.55-52.45.1 kernel-ec2-extra-3.12.55-52.45.1 kernel-ec2-extra-debuginfo-3.12.55-52.45.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_55-52_45-default-1-3.1 kgraft-patch-3_12_55-52_45-xen-1-3.1 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.55-52.45.1 kernel-default-debuginfo-3.12.55-52.45.1 kernel-default-debugsource-3.12.55-52.45.1 kernel-default-devel-3.12.55-52.45.1 kernel-default-extra-3.12.55-52.45.1 kernel-default-extra-debuginfo-3.12.55-52.45.1 kernel-syms-3.12.55-52.45.1 kernel-xen-3.12.55-52.45.1 kernel-xen-debuginfo-3.12.55-52.45.1 kernel-xen-debugsource-3.12.55-52.45.1 kernel-xen-devel-3.12.55-52.45.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.55-52.45.1 kernel-macros-3.12.55-52.45.1 kernel-source-3.12.55-52.45.1 References: https://www.suse.com/security/cve/CVE-2016-1583.html https://bugzilla.suse.com/983143 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1595-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 16 Jun '16

16 Jun '16

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1595-1 Rating: important References: #963963 #965283 #978395 #981040 #981041 #981108 #981109 #981111 #981112 #981114 #981115 #981548 #981549 #981550 Cross-References: CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 CVE-2016-4483 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc#978395]. - CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040]. - CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041]. - CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108]. - CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109]. - CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral [bsc#981111]. - CVE-2016-1838: Fixed a heap-based buffer overread in xmlParserPrintFileContextInternal [bsc#981112]. - CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115]. - CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548]. - CVE-2016-4448: Fixed some format string warnings with possible format string vulnerability [bsc#981549], - CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550]. - CVE-2016-3705: Fixed missing increment of recursion counter. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-733=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libxml2-2-2.9.1-19.1 libxml2-2-debuginfo-2.9.1-19.1 libxml2-debugsource-2.9.1-19.1 libxml2-devel-2.9.1-19.1 libxml2-tools-2.9.1-19.1 libxml2-tools-debuginfo-2.9.1-19.1 python-libxml2-2.9.1-19.1 python-libxml2-debuginfo-2.9.1-19.1 python-libxml2-debugsource-2.9.1-19.1 - openSUSE Leap 42.1 (x86_64): libxml2-2-32bit-2.9.1-19.1 libxml2-2-debuginfo-32bit-2.9.1-19.1 libxml2-devel-32bit-2.9.1-19.1 - openSUSE Leap 42.1 (noarch): libxml2-doc-2.9.1-19.1 References: https://www.suse.com/security/cve/CVE-2015-8806.html https://www.suse.com/security/cve/CVE-2016-1762.html https://www.suse.com/security/cve/CVE-2016-1833.html https://www.suse.com/security/cve/CVE-2016-1834.html https://www.suse.com/security/cve/CVE-2016-1835.html https://www.suse.com/security/cve/CVE-2016-1837.html https://www.suse.com/security/cve/CVE-2016-1838.html https://www.suse.com/security/cve/CVE-2016-1839.html https://www.suse.com/security/cve/CVE-2016-1840.html https://www.suse.com/security/cve/CVE-2016-2073.html https://www.suse.com/security/cve/CVE-2016-3705.html https://www.suse.com/security/cve/CVE-2016-4447.html https://www.suse.com/security/cve/CVE-2016-4448.html https://www.suse.com/security/cve/CVE-2016-4449.html https://www.suse.com/security/cve/CVE-2016-4483.html https://bugzilla.suse.com/963963 https://bugzilla.suse.com/965283 https://bugzilla.suse.com/978395 https://bugzilla.suse.com/981040 https://bugzilla.suse.com/981041 https://bugzilla.suse.com/981108 https://bugzilla.suse.com/981109 https://bugzilla.suse.com/981111 https://bugzilla.suse.com/981112 https://bugzilla.suse.com/981114 https://bugzilla.suse.com/981115 https://bugzilla.suse.com/981548 https://bugzilla.suse.com/981549 https://bugzilla.suse.com/981550 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1594-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 16 Jun '16

16 Jun '16

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1594-1 Rating: important References: #972335 #975947 #978395 #981040 #981041 #981108 #981109 #981110 #981111 #981112 #981114 #981115 #983288 Cross-References: CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-3627 CVE-2016-3705 CVE-2016-4483 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has one errata is now available. Description: This update brings libxml2 to version 2.9.4. These security issues were fixed: - CVE-2016-3627: The xmlStringGetNodeList function in tree.c, when used in recovery mode, allowed context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document (bsc#972335). - CVE-2016-1833: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981108). - CVE-2016-1835: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document (bsc#981109). - CVE-2016-1837: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981111). - CVE-2016-1836: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981110). - CVE-2016-1839: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1840 (bsc#981114). - CVE-2016-1838: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1839, and CVE-2016-1840 (bsc#981112). - CVE-2016-1840: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1839 (bsc#981115). - CVE-2016-4483: out-of-bounds read parsing an XML using recover mode (bnc#978395). - CVE-2016-1834: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981041). - CVE-2016-3705: The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 did not properly keep track of the recursion depth, which allowed context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references (bsc#975947). - CVE-2016-1762: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document (bsc#981040). This non-security issue was fixed: - bnc#983288: Fix attribute decoding during XML schema validation Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-734=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libxml2-2-2.9.4-7.17.1 libxml2-2-debuginfo-2.9.4-7.17.1 libxml2-debugsource-2.9.4-7.17.1 libxml2-devel-2.9.4-7.17.1 libxml2-tools-2.9.4-7.17.1 libxml2-tools-debuginfo-2.9.4-7.17.1 python-libxml2-2.9.4-7.17.1 python-libxml2-debuginfo-2.9.4-7.17.1 python-libxml2-debugsource-2.9.4-7.17.1 - openSUSE 13.2 (x86_64): libxml2-2-32bit-2.9.4-7.17.1 libxml2-2-debuginfo-32bit-2.9.4-7.17.1 libxml2-devel-32bit-2.9.4-7.17.1 - openSUSE 13.2 (noarch): libxml2-doc-2.9.4-7.17.1 References: https://www.suse.com/security/cve/CVE-2016-1762.html https://www.suse.com/security/cve/CVE-2016-1833.html https://www.suse.com/security/cve/CVE-2016-1834.html https://www.suse.com/security/cve/CVE-2016-1835.html https://www.suse.com/security/cve/CVE-2016-1836.html https://www.suse.com/security/cve/CVE-2016-1837.html https://www.suse.com/security/cve/CVE-2016-1838.html https://www.suse.com/security/cve/CVE-2016-1839.html https://www.suse.com/security/cve/CVE-2016-1840.html https://www.suse.com/security/cve/CVE-2016-3627.html https://www.suse.com/security/cve/CVE-2016-3705.html https://www.suse.com/security/cve/CVE-2016-4483.html https://bugzilla.suse.com/972335 https://bugzilla.suse.com/975947 https://bugzilla.suse.com/978395 https://bugzilla.suse.com/981040 https://bugzilla.suse.com/981041 https://bugzilla.suse.com/981108 https://bugzilla.suse.com/981109 https://bugzilla.suse.com/981110 https://bugzilla.suse.com/981111 https://bugzilla.suse.com/981112 https://bugzilla.suse.com/981114 https://bugzilla.suse.com/981115 https://bugzilla.suse.com/983288 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1584-1: important: Security update for ntp
by opensuse-security＠opensuse.org 15 Jun '16

15 Jun '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1584-1 Rating: important References: #979302 #981422 #982056 #982064 #982065 #982066 #982067 #982068 Cross-References: CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - Keep the parent process alive until the daemon has finished initialisation, to make sure that the PID file exists when the parent returns. - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ntp-12612=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ntp-12612=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-4.2.8p8-14.1 ntp-doc-4.2.8p8-14.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-debuginfo-4.2.8p8-14.1 ntp-debugsource-4.2.8p8-14.1 References: https://www.suse.com/security/cve/CVE-2016-4953.html https://www.suse.com/security/cve/CVE-2016-4954.html https://www.suse.com/security/cve/CVE-2016-4955.html https://www.suse.com/security/cve/CVE-2016-4956.html https://www.suse.com/security/cve/CVE-2016-4957.html https://bugzilla.suse.com/979302 https://bugzilla.suse.com/981422 https://bugzilla.suse.com/982056 https://bugzilla.suse.com/982064 https://bugzilla.suse.com/982065 https://bugzilla.suse.com/982066 https://bugzilla.suse.com/982067 https://bugzilla.suse.com/982068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1583-1: important: Security update for ntp
by opensuse-security＠opensuse.org 15 Jun '16

15 Jun '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1583-1 Rating: important References: #979302 #979981 #981422 #982056 #982064 #982065 #982066 #982067 #982068 Cross-References: CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has four fixes is now available. Description: ntp was updated to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-727=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ntp-4.2.8p8-25.18.1 ntp-debuginfo-4.2.8p8-25.18.1 ntp-debugsource-4.2.8p8-25.18.1 ntp-doc-4.2.8p8-25.18.1 References: https://www.suse.com/security/cve/CVE-2016-4953.html https://www.suse.com/security/cve/CVE-2016-4954.html https://www.suse.com/security/cve/CVE-2016-4955.html https://www.suse.com/security/cve/CVE-2016-4956.html https://www.suse.com/security/cve/CVE-2016-4957.html https://bugzilla.suse.com/979302 https://bugzilla.suse.com/979981 https://bugzilla.suse.com/981422 https://bugzilla.suse.com/982056 https://bugzilla.suse.com/982064 https://bugzilla.suse.com/982065 https://bugzilla.suse.com/982066 https://bugzilla.suse.com/982067 https://bugzilla.suse.com/982068 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1581-1: important: Security update for php53
by opensuse-security＠opensuse.org 14 Jun '16

14 Jun '16

SUSE Security Update: Security update for php53 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1581-1 Rating: important References: #949961 #968284 #969821 #971611 #971612 #971912 #973351 #973792 #976996 #976997 #977003 #977005 #977991 #977994 #978827 #978828 #978829 #978830 #980366 #980373 #980375 #981050 #982010 #982011 #982012 #982013 #982162 Cross-References: CVE-2014-9767 CVE-2015-4116 CVE-2015-7803 CVE-2015-8835 CVE-2015-8838 CVE-2015-8866 CVE-2015-8867 CVE-2015-8873 CVE-2015-8874 CVE-2015-8879 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 CVE-2016-4070 CVE-2016-4073 CVE-2016-4342 CVE-2016-4346 CVE-2016-4537 CVE-2016-4538 CVE-2016-4539 CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 CVE-2016-5114 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: This update for php53 fixes the following issues: - CVE-2016-5093: A get_icu_value_internal out-of-bounds read could crash the php interpreter (bsc#982010) - CVE-2016-5094,CVE-2016-5095: Don't allow creating strings with lengths outside int range, avoids overflows (bsc#982011,bsc#982012) - CVE-2016-5096: A int/size_t confusion in fread could corrupt memory (bsc#982013) - CVE-2016-5114: A fpm_log.c memory leak and buffer overflow could leak information out of the php process or overwrite a buffer by 1 byte (bsc#982162) - CVE-2016-4346: A heap overflow was fixed in ext/standard/string.c (bsc#977994) - CVE-2016-4342: A heap corruption was fixed in tar/zip/phar parser (bsc#977991) - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative scale causing heap buffer overflow corrupting _one_ definition (bsc#978827) - CVE-2016-4539: Malformed input causes segmentation fault in xml_parse_into_struct() function (bsc#978828) - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read in zif_grapheme_stripos when given negative offset (bsc#978829) - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544: Out-of-bounds heap memory read in exif_read_data() caused by malformed input (bsc#978830) - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function (bsc#980366) - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c (bsc#980373) - CVE-2015-8874: Stack consumption vulnerability in GD (bsc#980375) - CVE-2015-8879: odbc_bindcols function in ext/odbc/php_odbc.c mishandles driver behavior for SQL_WVARCHAR (bsc#981050) Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] - CVE-2015-7803: A Stack overflow vulnerability when decompressing tar phar archives could potentially lead to code execution. [bsc#949961] - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-php53-12611=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-php53-12611=1 - SUSE Manager 2.1: zypper in -t patch sleman21-php53-12611=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-12611=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-php53-12611=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-php53-12611=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-php53-12611=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-php53-12611=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): apache2-mod_php53-5.3.17-71.1 php53-5.3.17-71.1 php53-bcmath-5.3.17-71.1 php53-bz2-5.3.17-71.1 php53-calendar-5.3.17-71.1 php53-ctype-5.3.17-71.1 php53-curl-5.3.17-71.1 php53-dba-5.3.17-71.1 php53-dom-5.3.17-71.1 php53-exif-5.3.17-71.1 php53-fastcgi-5.3.17-71.1 php53-fileinfo-5.3.17-71.1 php53-ftp-5.3.17-71.1 php53-gd-5.3.17-71.1 php53-gettext-5.3.17-71.1 php53-gmp-5.3.17-71.1 php53-iconv-5.3.17-71.1 php53-intl-5.3.17-71.1 php53-json-5.3.17-71.1 php53-ldap-5.3.17-71.1 php53-mbstring-5.3.17-71.1 php53-mcrypt-5.3.17-71.1 php53-mysql-5.3.17-71.1 php53-odbc-5.3.17-71.1 php53-openssl-5.3.17-71.1 php53-pcntl-5.3.17-71.1 php53-pdo-5.3.17-71.1 php53-pear-5.3.17-71.1 php53-pgsql-5.3.17-71.1 php53-pspell-5.3.17-71.1 php53-shmop-5.3.17-71.1 php53-snmp-5.3.17-71.1 php53-soap-5.3.17-71.1 php53-suhosin-5.3.17-71.1 php53-sysvmsg-5.3.17-71.1 php53-sysvsem-5.3.17-71.1 php53-sysvshm-5.3.17-71.1 php53-tokenizer-5.3.17-71.1 php53-wddx-5.3.17-71.1 php53-xmlreader-5.3.17-71.1 php53-xmlrpc-5.3.17-71.1 php53-xmlwriter-5.3.17-71.1 php53-xsl-5.3.17-71.1 php53-zip-5.3.17-71.1 php53-zlib-5.3.17-71.1 - SUSE Manager Proxy 2.1 (x86_64): apache2-mod_php53-5.3.17-71.1 php53-5.3.17-71.1 php53-bcmath-5.3.17-71.1 php53-bz2-5.3.17-71.1 php53-calendar-5.3.17-71.1 php53-ctype-5.3.17-71.1 php53-curl-5.3.17-71.1 php53-dba-5.3.17-71.1 php53-dom-5.3.17-71.1 php53-exif-5.3.17-71.1 php53-fastcgi-5.3.17-71.1 php53-fileinfo-5.3.17-71.1 php53-ftp-5.3.17-71.1 php53-gd-5.3.17-71.1 php53-gettext-5.3.17-71.1 php53-gmp-5.3.17-71.1 php53-iconv-5.3.17-71.1 php53-intl-5.3.17-71.1 php53-json-5.3.17-71.1 php53-ldap-5.3.17-71.1 php53-mbstring-5.3.17-71.1 php53-mcrypt-5.3.17-71.1 php53-mysql-5.3.17-71.1 php53-odbc-5.3.17-71.1 php53-openssl-5.3.17-71.1 php53-pcntl-5.3.17-71.1 php53-pdo-5.3.17-71.1 php53-pear-5.3.17-71.1 php53-pgsql-5.3.17-71.1 php53-pspell-5.3.17-71.1 php53-shmop-5.3.17-71.1 php53-snmp-5.3.17-71.1 php53-soap-5.3.17-71.1 php53-suhosin-5.3.17-71.1 php53-sysvmsg-5.3.17-71.1 php53-sysvsem-5.3.17-71.1 php53-sysvshm-5.3.17-71.1 php53-tokenizer-5.3.17-71.1 php53-wddx-5.3.17-71.1 php53-xmlreader-5.3.17-71.1 php53-xmlrpc-5.3.17-71.1 php53-xmlwriter-5.3.17-71.1 php53-xsl-5.3.17-71.1 php53-zip-5.3.17-71.1 php53-zlib-5.3.17-71.1 - SUSE Manager 2.1 (s390x x86_64): apache2-mod_php53-5.3.17-71.1 php53-5.3.17-71.1 php53-bcmath-5.3.17-71.1 php53-bz2-5.3.17-71.1 php53-calendar-5.3.17-71.1 php53-ctype-5.3.17-71.1 php53-curl-5.3.17-71.1 php53-dba-5.3.17-71.1 php53-dom-5.3.17-71.1 php53-exif-5.3.17-71.1 php53-fastcgi-5.3.17-71.1 php53-fileinfo-5.3.17-71.1 php53-ftp-5.3.17-71.1 php53-gd-5.3.17-71.1 php53-gettext-5.3.17-71.1 php53-gmp-5.3.17-71.1 php53-iconv-5.3.17-71.1 php53-intl-5.3.17-71.1 php53-json-5.3.17-71.1 php53-ldap-5.3.17-71.1 php53-mbstring-5.3.17-71.1 php53-mcrypt-5.3.17-71.1 php53-mysql-5.3.17-71.1 php53-odbc-5.3.17-71.1 php53-openssl-5.3.17-71.1 php53-pcntl-5.3.17-71.1 php53-pdo-5.3.17-71.1 php53-pear-5.3.17-71.1 php53-pgsql-5.3.17-71.1 php53-pspell-5.3.17-71.1 php53-shmop-5.3.17-71.1 php53-snmp-5.3.17-71.1 php53-soap-5.3.17-71.1 php53-suhosin-5.3.17-71.1 php53-sysvmsg-5.3.17-71.1 php53-sysvsem-5.3.17-71.1 php53-sysvshm-5.3.17-71.1 php53-tokenizer-5.3.17-71.1 php53-wddx-5.3.17-71.1 php53-xmlreader-5.3.17-71.1 php53-xmlrpc-5.3.17-71.1 php53-xmlwriter-5.3.17-71.1 php53-xsl-5.3.17-71.1 php53-zip-5.3.17-71.1 php53-zlib-5.3.17-71.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-71.1 php53-imap-5.3.17-71.1 php53-posix-5.3.17-71.1 php53-readline-5.3.17-71.1 php53-sockets-5.3.17-71.1 php53-sqlite-5.3.17-71.1 php53-tidy-5.3.17-71.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-71.1 php53-5.3.17-71.1 php53-bcmath-5.3.17-71.1 php53-bz2-5.3.17-71.1 php53-calendar-5.3.17-71.1 php53-ctype-5.3.17-71.1 php53-curl-5.3.17-71.1 php53-dba-5.3.17-71.1 php53-dom-5.3.17-71.1 php53-exif-5.3.17-71.1 php53-fastcgi-5.3.17-71.1 php53-fileinfo-5.3.17-71.1 php53-ftp-5.3.17-71.1 php53-gd-5.3.17-71.1 php53-gettext-5.3.17-71.1 php53-gmp-5.3.17-71.1 php53-iconv-5.3.17-71.1 php53-intl-5.3.17-71.1 php53-json-5.3.17-71.1 php53-ldap-5.3.17-71.1 php53-mbstring-5.3.17-71.1 php53-mcrypt-5.3.17-71.1 php53-mysql-5.3.17-71.1 php53-odbc-5.3.17-71.1 php53-openssl-5.3.17-71.1 php53-pcntl-5.3.17-71.1 php53-pdo-5.3.17-71.1 php53-pear-5.3.17-71.1 php53-pgsql-5.3.17-71.1 php53-pspell-5.3.17-71.1 php53-shmop-5.3.17-71.1 php53-snmp-5.3.17-71.1 php53-soap-5.3.17-71.1 php53-suhosin-5.3.17-71.1 php53-sysvmsg-5.3.17-71.1 php53-sysvsem-5.3.17-71.1 php53-sysvshm-5.3.17-71.1 php53-tokenizer-5.3.17-71.1 php53-wddx-5.3.17-71.1 php53-xmlreader-5.3.17-71.1 php53-xmlrpc-5.3.17-71.1 php53-xmlwriter-5.3.17-71.1 php53-xsl-5.3.17-71.1 php53-zip-5.3.17-71.1 php53-zlib-5.3.17-71.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): apache2-mod_php53-5.3.17-71.1 php53-5.3.17-71.1 php53-bcmath-5.3.17-71.1 php53-bz2-5.3.17-71.1 php53-calendar-5.3.17-71.1 php53-ctype-5.3.17-71.1 php53-curl-5.3.17-71.1 php53-dba-5.3.17-71.1 php53-dom-5.3.17-71.1 php53-exif-5.3.17-71.1 php53-fastcgi-5.3.17-71.1 php53-fileinfo-5.3.17-71.1 php53-ftp-5.3.17-71.1 php53-gd-5.3.17-71.1 php53-gettext-5.3.17-71.1 php53-gmp-5.3.17-71.1 php53-iconv-5.3.17-71.1 php53-intl-5.3.17-71.1 php53-json-5.3.17-71.1 php53-ldap-5.3.17-71.1 php53-mbstring-5.3.17-71.1 php53-mcrypt-5.3.17-71.1 php53-mysql-5.3.17-71.1 php53-odbc-5.3.17-71.1 php53-openssl-5.3.17-71.1 php53-pcntl-5.3.17-71.1 php53-pdo-5.3.17-71.1 php53-pear-5.3.17-71.1 php53-pgsql-5.3.17-71.1 php53-pspell-5.3.17-71.1 php53-shmop-5.3.17-71.1 php53-snmp-5.3.17-71.1 php53-soap-5.3.17-71.1 php53-suhosin-5.3.17-71.1 php53-sysvmsg-5.3.17-71.1 php53-sysvsem-5.3.17-71.1 php53-sysvshm-5.3.17-71.1 php53-tokenizer-5.3.17-71.1 php53-wddx-5.3.17-71.1 php53-xmlreader-5.3.17-71.1 php53-xmlrpc-5.3.17-71.1 php53-xmlwriter-5.3.17-71.1 php53-xsl-5.3.17-71.1 php53-zip-5.3.17-71.1 php53-zlib-5.3.17-71.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-debuginfo-5.3.17-71.1 php53-debugsource-5.3.17-71.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): php53-debuginfo-5.3.17-71.1 php53-debugsource-5.3.17-71.1 References: https://www.suse.com/security/cve/CVE-2014-9767.html https://www.suse.com/security/cve/CVE-2015-4116.html https://www.suse.com/security/cve/CVE-2015-7803.html https://www.suse.com/security/cve/CVE-2015-8835.html https://www.suse.com/security/cve/CVE-2015-8838.html https://www.suse.com/security/cve/CVE-2015-8866.html https://www.suse.com/security/cve/CVE-2015-8867.html https://www.suse.com/security/cve/CVE-2015-8873.html https://www.suse.com/security/cve/CVE-2015-8874.html https://www.suse.com/security/cve/CVE-2015-8879.html https://www.suse.com/security/cve/CVE-2016-2554.html https://www.suse.com/security/cve/CVE-2016-3141.html https://www.suse.com/security/cve/CVE-2016-3142.html https://www.suse.com/security/cve/CVE-2016-3185.html https://www.suse.com/security/cve/CVE-2016-4070.html https://www.suse.com/security/cve/CVE-2016-4073.html https://www.suse.com/security/cve/CVE-2016-4342.html https://www.suse.com/security/cve/CVE-2016-4346.html https://www.suse.com/security/cve/CVE-2016-4537.html https://www.suse.com/security/cve/CVE-2016-4538.html https://www.suse.com/security/cve/CVE-2016-4539.html https://www.suse.com/security/cve/CVE-2016-4540.html https://www.suse.com/security/cve/CVE-2016-4541.html https://www.suse.com/security/cve/CVE-2016-4542.html https://www.suse.com/security/cve/CVE-2016-4543.html https://www.suse.com/security/cve/CVE-2016-4544.html https://www.suse.com/security/cve/CVE-2016-5093.html https://www.suse.com/security/cve/CVE-2016-5094.html https://www.suse.com/security/cve/CVE-2016-5095.html https://www.suse.com/security/cve/CVE-2016-5096.html https://www.suse.com/security/cve/CVE-2016-5114.html https://bugzilla.suse.com/949961 https://bugzilla.suse.com/968284 https://bugzilla.suse.com/969821 https://bugzilla.suse.com/971611 https://bugzilla.suse.com/971612 https://bugzilla.suse.com/971912 https://bugzilla.suse.com/973351 https://bugzilla.suse.com/973792 https://bugzilla.suse.com/976996 https://bugzilla.suse.com/976997 https://bugzilla.suse.com/977003 https://bugzilla.suse.com/977005 https://bugzilla.suse.com/977991 https://bugzilla.suse.com/977994 https://bugzilla.suse.com/978827 https://bugzilla.suse.com/978828 https://bugzilla.suse.com/978829 https://bugzilla.suse.com/978830 https://bugzilla.suse.com/980366 https://bugzilla.suse.com/980373 https://bugzilla.suse.com/980375 https://bugzilla.suse.com/981050 https://bugzilla.suse.com/982010 https://bugzilla.suse.com/982011 https://bugzilla.suse.com/982012 https://bugzilla.suse.com/982013 https://bugzilla.suse.com/982162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0