September 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:2401-1: critical: Security update for bind
by opensuse-security＠opensuse.org 27 Sep '16

27 Sep '16

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2401-1 Rating: critical References: #1000362 Cross-References: CVE-2016-2776 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. (CVE-2016-2776, bsc#1000362) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1400=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1400=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): bind-doc-9.9.9P1-28.20.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): bind-9.9.9P1-28.20.1 bind-chrootenv-9.9.9P1-28.20.1 bind-debuginfo-9.9.9P1-28.20.1 bind-debugsource-9.9.9P1-28.20.1 bind-libs-32bit-9.9.9P1-28.20.1 bind-libs-9.9.9P1-28.20.1 bind-libs-debuginfo-32bit-9.9.9P1-28.20.1 bind-libs-debuginfo-9.9.9P1-28.20.1 bind-utils-9.9.9P1-28.20.1 bind-utils-debuginfo-9.9.9P1-28.20.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-28.20.1 bind-chrootenv-9.9.9P1-28.20.1 bind-debuginfo-9.9.9P1-28.20.1 bind-debugsource-9.9.9P1-28.20.1 bind-libs-9.9.9P1-28.20.1 bind-libs-debuginfo-9.9.9P1-28.20.1 bind-utils-9.9.9P1-28.20.1 bind-utils-debuginfo-9.9.9P1-28.20.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-28.20.1 bind-libs-debuginfo-32bit-9.9.9P1-28.20.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): bind-doc-9.9.9P1-28.20.1 References: https://www.suse.com/security/cve/CVE-2016-2776.html https://bugzilla.suse.com/1000362 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2399-1: critical: Security update for bind
by opensuse-security＠opensuse.org 27 Sep '16

27 Sep '16

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2399-1 Rating: critical References: #1000362 Cross-References: CVE-2016-2776 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. (CVE-2016-2776, bsc#1000362) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1399=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1399=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1399=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-46.1 bind-debugsource-9.9.9P1-46.1 bind-devel-9.9.9P1-46.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): bind-9.9.9P1-46.1 bind-chrootenv-9.9.9P1-46.1 bind-debuginfo-9.9.9P1-46.1 bind-debugsource-9.9.9P1-46.1 bind-libs-9.9.9P1-46.1 bind-libs-debuginfo-9.9.9P1-46.1 bind-utils-9.9.9P1-46.1 bind-utils-debuginfo-9.9.9P1-46.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): bind-libs-32bit-9.9.9P1-46.1 bind-libs-debuginfo-32bit-9.9.9P1-46.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): bind-doc-9.9.9P1-46.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): bind-debuginfo-9.9.9P1-46.1 bind-debugsource-9.9.9P1-46.1 bind-libs-32bit-9.9.9P1-46.1 bind-libs-9.9.9P1-46.1 bind-libs-debuginfo-32bit-9.9.9P1-46.1 bind-libs-debuginfo-9.9.9P1-46.1 bind-utils-9.9.9P1-46.1 bind-utils-debuginfo-9.9.9P1-46.1 References: https://www.suse.com/security/cve/CVE-2016-2776.html https://bugzilla.suse.com/1000362 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2395-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 27 Sep '16

27 Sep '16

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2395-1 Rating: important References: #949520 #998309 Cross-References: CVE-2016-6662 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed: * CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql (or even root) user. (bsc#998309) * release notes: * https://kb.askmonty.org/en/mariadb-10027-release-notes * changelog: * https://kb.askmonty.org/en/mariadb-10027-changelog Bugs fixed: - Make ORDER BY optimization functions take into account multiple equalities. (bsc#949520) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1394=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1394=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): libmysqlclient-devel-10.0.27-20.13.1 libmysqlclient18-10.0.27-20.13.1 libmysqlclient18-32bit-10.0.27-20.13.1 libmysqlclient18-debuginfo-10.0.27-20.13.1 libmysqlclient18-debuginfo-32bit-10.0.27-20.13.1 libmysqlclient_r18-10.0.27-20.13.1 libmysqld-devel-10.0.27-20.13.1 libmysqld18-10.0.27-20.13.1 libmysqld18-debuginfo-10.0.27-20.13.1 mariadb-10.0.27-20.13.1 mariadb-client-10.0.27-20.13.1 mariadb-client-debuginfo-10.0.27-20.13.1 mariadb-debuginfo-10.0.27-20.13.1 mariadb-debugsource-10.0.27-20.13.1 mariadb-errormessages-10.0.27-20.13.1 mariadb-tools-10.0.27-20.13.1 mariadb-tools-debuginfo-10.0.27-20.13.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libmysqlclient-devel-10.0.27-20.13.1 libmysqlclient18-10.0.27-20.13.1 libmysqlclient18-debuginfo-10.0.27-20.13.1 libmysqlclient_r18-10.0.27-20.13.1 libmysqld-devel-10.0.27-20.13.1 libmysqld18-10.0.27-20.13.1 libmysqld18-debuginfo-10.0.27-20.13.1 mariadb-10.0.27-20.13.1 mariadb-client-10.0.27-20.13.1 mariadb-client-debuginfo-10.0.27-20.13.1 mariadb-debuginfo-10.0.27-20.13.1 mariadb-debugsource-10.0.27-20.13.1 mariadb-errormessages-10.0.27-20.13.1 mariadb-tools-10.0.27-20.13.1 mariadb-tools-debuginfo-10.0.27-20.13.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libmysqlclient18-32bit-10.0.27-20.13.1 libmysqlclient18-debuginfo-32bit-10.0.27-20.13.1 References: https://www.suse.com/security/cve/CVE-2016-6662.html https://bugzilla.suse.com/949520 https://bugzilla.suse.com/998309 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2394-1: important: Security update for openssl
by opensuse-security＠opensuse.org 27 Sep '16

27 Sep '16

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2394-1 Rating: important References: #979475 #982575 #982745 #983249 #988591 #990419 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 6 fixes is now available. Description: This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed: * update expired S/MIME certs (bsc#979475) * improve s390x performance (bsc#982745) * allow >= 64GB AESGCM transfers (bsc#988591) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1393=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1393=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1393=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libopenssl-devel-1.0.1i-52.1 openssl-debuginfo-1.0.1i-52.1 openssl-debugsource-1.0.1i-52.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libopenssl1_0_0-1.0.1i-52.1 libopenssl1_0_0-debuginfo-1.0.1i-52.1 libopenssl1_0_0-hmac-1.0.1i-52.1 openssl-1.0.1i-52.1 openssl-debuginfo-1.0.1i-52.1 openssl-debugsource-1.0.1i-52.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libopenssl1_0_0-32bit-1.0.1i-52.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-52.1 libopenssl1_0_0-hmac-32bit-1.0.1i-52.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): openssl-doc-1.0.1i-52.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libopenssl1_0_0-1.0.1i-52.1 libopenssl1_0_0-32bit-1.0.1i-52.1 libopenssl1_0_0-debuginfo-1.0.1i-52.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-52.1 openssl-1.0.1i-52.1 openssl-debuginfo-1.0.1i-52.1 openssl-debugsource-1.0.1i-52.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2180.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/982745 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/988591 https://bugzilla.suse.com/990419 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2391-1: important: Security update for openssl
by opensuse-security＠opensuse.org 27 Sep '16

27 Sep '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2391-1 Rating: important References: #979475 #982575 #983249 #988591 #990419 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 5 fixes is now available. Description: This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (boo#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (boo#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (boo#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (boo#983249) * DTLS buffered message DoS (CVE-2016-2179) (boo#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (boo#990419) * DTLS replay protection DoS (CVE-2016-2181) (boo#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (boo#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (boo#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (boo#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (boo#995377) * Certificate message OOB reads (CVE-2016-6306) (boo#999668) More information can be found on https://www.openssl.org/news/secadv/20160922.txt * update expired S/MIME certs (boo#979475) * allow >= 64GB AESGCM transfers (boo#988591) * fix crash in print_notice (boo#998190) * resume reading from /dev/urandom when interrupted by a signal (boo#995075) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1130=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.39.1 libopenssl1_0_0-1.0.1k-2.39.1 libopenssl1_0_0-debuginfo-1.0.1k-2.39.1 libopenssl1_0_0-hmac-1.0.1k-2.39.1 openssl-1.0.1k-2.39.1 openssl-debuginfo-1.0.1k-2.39.1 openssl-debugsource-1.0.1k-2.39.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.39.1 libopenssl1_0_0-32bit-1.0.1k-2.39.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.39.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.39.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.39.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2180.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/988591 https://bugzilla.suse.com/990419 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2387-1: important: Security update for openssl
by opensuse-security＠opensuse.org 26 Sep '16

26 Sep '16

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2387-1 Rating: important References: #979475 #982575 #982745 #983249 #988591 #990419 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 6 fixes is now available. Description: This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed: * update expired S/MIME certs (bsc#979475) * improve s390x performance (bsc#982745) * allow >= 64GB AESGCM transfers (bsc#988591) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1386=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1386=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): libopenssl1_0_0-1.0.1i-27.21.1 libopenssl1_0_0-32bit-1.0.1i-27.21.1 libopenssl1_0_0-debuginfo-1.0.1i-27.21.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.21.1 libopenssl1_0_0-hmac-1.0.1i-27.21.1 libopenssl1_0_0-hmac-32bit-1.0.1i-27.21.1 openssl-1.0.1i-27.21.1 openssl-debuginfo-1.0.1i-27.21.1 openssl-debugsource-1.0.1i-27.21.1 - SUSE Linux Enterprise Server for SAP 12 (noarch): openssl-doc-1.0.1i-27.21.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libopenssl1_0_0-1.0.1i-27.21.1 libopenssl1_0_0-debuginfo-1.0.1i-27.21.1 libopenssl1_0_0-hmac-1.0.1i-27.21.1 openssl-1.0.1i-27.21.1 openssl-debuginfo-1.0.1i-27.21.1 openssl-debugsource-1.0.1i-27.21.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libopenssl1_0_0-32bit-1.0.1i-27.21.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.21.1 libopenssl1_0_0-hmac-32bit-1.0.1i-27.21.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): openssl-doc-1.0.1i-27.21.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2180.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/982745 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/988591 https://bugzilla.suse.com/990419 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2386-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 26 Sep '16

26 Sep '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2386-1 Rating: important References: #999701 Cross-References: CVE-2016-2827 CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5279 CVE-2016-5280 CVE-2016-5281 CVE-2016-5282 CVE-2016-5283 CVE-2016-5284 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: MozillaFirefox was updated to version 49.0 (boo#999701) - New features * Updated Firefox Login Manager to allow HTTPS pages to use saved HTTP logins. * Added features to Reader Mode that make it easier on the eyes and the ears * Improved video performance for users on systems that support SSE3 without hardware acceleration * Added context menu controls to HTML5 audio and video that let users loops files or play files at 1.25x speed * Improvements in about:memory reports for tracking font memory usage - Security related fixes * MFSA 2016-85 CVE-2016-2827 (bmo#1289085) - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy CVE-2016-5270 (bmo#1291016) - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString CVE-2016-5271 (bmo#1288946) - Out-of-bounds read in PropertyProvider::GetSpacingInternal CVE-2016-5272 (bmo#1297934) - Bad cast in nsImageGeometryMixin CVE-2016-5273 (bmo#1280387) - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset CVE-2016-5276 (bmo#1287721) - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList CVE-2016-5274 (bmo#1282076) - use-after-free in nsFrameManager::CaptureFrameState CVE-2016-5277 (bmo#1291665) - Heap-use-after-free in nsRefreshDriver::Tick CVE-2016-5275 (bmo#1287316) - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions CVE-2016-5278 (bmo#1294677) - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame CVE-2016-5279 (bmo#1249522) - Full local path of files is available to web pages after drag and drop CVE-2016-5280 (bmo#1289970) - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap CVE-2016-5281 (bmo#1284690) - use-after-free in DOMSVGLength CVE-2016-5282 (bmo#932335) - Don't allow content to request favicons from non-whitelisted schemes CVE-2016-5283 (bmo#928187) - <iframe src> fragment timing attack can reveal cross-origin data CVE-2016-5284 (bmo#1303127) - Add-on update site certificate pin expiration CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 - requires NSS 3.25 - Mozilla Firefox 48.0.2: * Mitigate a startup crash issue caused on Windows (bmo#1291738) mozilla-nss was updated to NSS 3.25. New functionality: * Implemented DHE key agreement for TLS 1.3 * Added support for ChaCha with TLS 1.3 * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF * In previous versions, when using client authentication with TLS 1.2, NSS only supported certificate_verify messages that used the same signature hash algorithm as used by the PRF. This limitation has been removed. * Several functions have been added to the public API of the NSS Cryptoki Framework. New functions: * NSSCKFWSlot_GetSlotID * NSSCKFWSession_GetFWSlot * NSSCKFWInstance_DestroySessionHandle * NSSCKFWInstance_FindSessionHandle Notable changes: * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3 * Regression fix: NSS no longer reports a failure if an application attempts to disable the SSLv2 protocol. * The list of trusted CA certificates has been updated to version 2.8 * The following CA certificate was Removed Sonera Class1 CA * The following CA certificates were Added Hellenic Academic and Research Institutions RootCA 2015 Hellenic Academic and Research Institutions ECC RootCA 2015 Certplus Root CA G1 Certplus Root CA G2 OpenTrust Root CA G1 OpenTrust Root CA G2 OpenTrust Root CA G3 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1128=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-49.0.1-125.2 MozillaFirefox-branding-upstream-49.0.1-125.2 MozillaFirefox-buildsymbols-49.0.1-125.2 MozillaFirefox-debuginfo-49.0.1-125.2 MozillaFirefox-debugsource-49.0.1-125.2 MozillaFirefox-devel-49.0.1-125.2 MozillaFirefox-translations-common-49.0.1-125.2 MozillaFirefox-translations-other-49.0.1-125.2 libfreebl3-3.25-91.1 libfreebl3-debuginfo-3.25-91.1 libsoftokn3-3.25-91.1 libsoftokn3-debuginfo-3.25-91.1 mozilla-nss-3.25-91.1 mozilla-nss-certs-3.25-91.1 mozilla-nss-certs-debuginfo-3.25-91.1 mozilla-nss-debuginfo-3.25-91.1 mozilla-nss-debugsource-3.25-91.1 mozilla-nss-devel-3.25-91.1 mozilla-nss-sysinit-3.25-91.1 mozilla-nss-sysinit-debuginfo-3.25-91.1 mozilla-nss-tools-3.25-91.1 mozilla-nss-tools-debuginfo-3.25-91.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.25-91.1 libfreebl3-debuginfo-32bit-3.25-91.1 libsoftokn3-32bit-3.25-91.1 libsoftokn3-debuginfo-32bit-3.25-91.1 mozilla-nss-32bit-3.25-91.1 mozilla-nss-certs-32bit-3.25-91.1 mozilla-nss-certs-debuginfo-32bit-3.25-91.1 mozilla-nss-debuginfo-32bit-3.25-91.1 mozilla-nss-sysinit-32bit-3.25-91.1 mozilla-nss-sysinit-debuginfo-32bit-3.25-91.1 References: https://www.suse.com/security/cve/CVE-2016-2827.html https://www.suse.com/security/cve/CVE-2016-5256.html https://www.suse.com/security/cve/CVE-2016-5257.html https://www.suse.com/security/cve/CVE-2016-5270.html https://www.suse.com/security/cve/CVE-2016-5271.html https://www.suse.com/security/cve/CVE-2016-5272.html https://www.suse.com/security/cve/CVE-2016-5273.html https://www.suse.com/security/cve/CVE-2016-5274.html https://www.suse.com/security/cve/CVE-2016-5275.html https://www.suse.com/security/cve/CVE-2016-5276.html https://www.suse.com/security/cve/CVE-2016-5277.html https://www.suse.com/security/cve/CVE-2016-5278.html https://www.suse.com/security/cve/CVE-2016-5279.html https://www.suse.com/security/cve/CVE-2016-5280.html https://www.suse.com/security/cve/CVE-2016-5281.html https://www.suse.com/security/cve/CVE-2016-5282.html https://www.suse.com/security/cve/CVE-2016-5283.html https://www.suse.com/security/cve/CVE-2016-5284.html https://bugzilla.suse.com/999701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2376-1: important: Recommended update for flash-player
by opensuse-security＠opensuse.org 25 Sep '16

25 Sep '16

openSUSE Security Update: Recommended update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2376-1 Rating: important References: #977664 #998589 Cross-References: CVE-2016-4182 CVE-2016-4237 CVE-2016-4238 CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for flash-player fixes the following security issues (APSB16-29, boo#998589): * integer overflow vulnerability that could lead to code execution (CVE-2016-4287). * use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932) * security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278) * memory corruption vulnerabilities that could lead to code execution (CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924) The package description was update to reflex that the stand-alone Flash is no longer provided on x86_64 architectures (boo#977664). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-1123=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.635-171.1 flash-player-gnome-11.2.202.635-171.1 flash-player-kde4-11.2.202.635-171.1 References: https://www.suse.com/security/cve/CVE-2016-4182.html https://www.suse.com/security/cve/CVE-2016-4237.html https://www.suse.com/security/cve/CVE-2016-4238.html https://www.suse.com/security/cve/CVE-2016-4271.html https://www.suse.com/security/cve/CVE-2016-4272.html https://www.suse.com/security/cve/CVE-2016-4274.html https://www.suse.com/security/cve/CVE-2016-4275.html https://www.suse.com/security/cve/CVE-2016-4276.html https://www.suse.com/security/cve/CVE-2016-4277.html https://www.suse.com/security/cve/CVE-2016-4278.html https://www.suse.com/security/cve/CVE-2016-4279.html https://www.suse.com/security/cve/CVE-2016-4280.html https://www.suse.com/security/cve/CVE-2016-4281.html https://www.suse.com/security/cve/CVE-2016-4282.html https://www.suse.com/security/cve/CVE-2016-4283.html https://www.suse.com/security/cve/CVE-2016-4284.html https://www.suse.com/security/cve/CVE-2016-4285.html https://www.suse.com/security/cve/CVE-2016-4287.html https://www.suse.com/security/cve/CVE-2016-6921.html https://www.suse.com/security/cve/CVE-2016-6922.html https://www.suse.com/security/cve/CVE-2016-6923.html https://www.suse.com/security/cve/CVE-2016-6924.html https://www.suse.com/security/cve/CVE-2016-6925.html https://www.suse.com/security/cve/CVE-2016-6926.html https://www.suse.com/security/cve/CVE-2016-6927.html https://www.suse.com/security/cve/CVE-2016-6929.html https://www.suse.com/security/cve/CVE-2016-6930.html https://www.suse.com/security/cve/CVE-2016-6931.html https://www.suse.com/security/cve/CVE-2016-6932.html https://bugzilla.suse.com/977664 https://bugzilla.suse.com/998589 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:2368-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 24 Sep '16

24 Sep '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2368-1 Rating: important References: #999701 Cross-References: CVE-2016-2827 CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5279 CVE-2016-5280 CVE-2016-5281 CVE-2016-5282 CVE-2016-5283 CVE-2016-5284 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update for MozillaFirefox and mozilla-nss fixes the following issues: MozillaFirefox was updated to version 49.0 (boo#999701) - New features * Updated Firefox Login Manager to allow HTTPS pages to use saved HTTP logins. * Added features to Reader Mode that make it easier on the eyes and the ears * Improved video performance for users on systems that support SSE3 without hardware acceleration * Added context menu controls to HTML5 audio and video that let users loops files or play files at 1.25x speed * Improvements in about:memory reports for tracking font memory usage - Security related fixes * MFSA 2016-85 CVE-2016-2827 (bmo#1289085) - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy CVE-2016-5270 (bmo#1291016) - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString CVE-2016-5271 (bmo#1288946) - Out-of-bounds read in PropertyProvider::GetSpacingInternal CVE-2016-5272 (bmo#1297934) - Bad cast in nsImageGeometryMixin CVE-2016-5273 (bmo#1280387) - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset CVE-2016-5276 (bmo#1287721) - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList CVE-2016-5274 (bmo#1282076) - use-after-free in nsFrameManager::CaptureFrameState CVE-2016-5277 (bmo#1291665) - Heap-use-after-free in nsRefreshDriver::Tick CVE-2016-5275 (bmo#1287316) - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions CVE-2016-5278 (bmo#1294677) - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame CVE-2016-5279 (bmo#1249522) - Full local path of files is available to web pages after drag and drop CVE-2016-5280 (bmo#1289970) - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap CVE-2016-5281 (bmo#1284690) - use-after-free in DOMSVGLength CVE-2016-5282 (bmo#932335) - Don't allow content to request favicons from non-whitelisted schemes CVE-2016-5283 (bmo#928187) - <iframe src> fragment timing attack can reveal cross-origin data CVE-2016-5284 (bmo#1303127) - Add-on update site certificate pin expiration CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 - requires NSS 3.25 - Mozilla Firefox 48.0.2: * Mitigate a startup crash issue caused on Windows (bmo#1291738) mozilla-nss was updated to NSS 3.25. New functionality: * Implemented DHE key agreement for TLS 1.3 * Added support for ChaCha with TLS 1.3 * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF * In previous versions, when using client authentication with TLS 1.2, NSS only supported certificate_verify messages that used the same signature hash algorithm as used by the PRF. This limitation has been removed. * Several functions have been added to the public API of the NSS Cryptoki Framework. New functions: * NSSCKFWSlot_GetSlotID * NSSCKFWSession_GetFWSlot * NSSCKFWInstance_DestroySessionHandle * NSSCKFWInstance_FindSessionHandle Notable changes: * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3 * Regression fix: NSS no longer reports a failure if an application attempts to disable the SSLv2 protocol. * The list of trusted CA certificates has been updated to version 2.8 * The following CA certificate was Removed Sonera Class1 CA * The following CA certificates were Added Hellenic Academic and Research Institutions RootCA 2015 Hellenic Academic and Research Institutions ECC RootCA 2015 Certplus Root CA G1 Certplus Root CA G2 OpenTrust Root CA G1 OpenTrust Root CA G2 OpenTrust Root CA G3 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1119=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-49.0-33.1 MozillaFirefox-branding-upstream-49.0-33.1 MozillaFirefox-buildsymbols-49.0-33.1 MozillaFirefox-debuginfo-49.0-33.1 MozillaFirefox-debugsource-49.0-33.1 MozillaFirefox-devel-49.0-33.1 MozillaFirefox-translations-common-49.0-33.1 MozillaFirefox-translations-other-49.0-33.1 libfreebl3-3.25-29.1 libfreebl3-debuginfo-3.25-29.1 libsoftokn3-3.25-29.1 libsoftokn3-debuginfo-3.25-29.1 mozilla-nss-3.25-29.1 mozilla-nss-certs-3.25-29.1 mozilla-nss-certs-debuginfo-3.25-29.1 mozilla-nss-debuginfo-3.25-29.1 mozilla-nss-debugsource-3.25-29.1 mozilla-nss-devel-3.25-29.1 mozilla-nss-sysinit-3.25-29.1 mozilla-nss-sysinit-debuginfo-3.25-29.1 mozilla-nss-tools-3.25-29.1 mozilla-nss-tools-debuginfo-3.25-29.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.25-29.1 libfreebl3-debuginfo-32bit-3.25-29.1 libsoftokn3-32bit-3.25-29.1 libsoftokn3-debuginfo-32bit-3.25-29.1 mozilla-nss-32bit-3.25-29.1 mozilla-nss-certs-32bit-3.25-29.1 mozilla-nss-certs-debuginfo-32bit-3.25-29.1 mozilla-nss-debuginfo-32bit-3.25-29.1 mozilla-nss-sysinit-32bit-3.25-29.1 mozilla-nss-sysinit-debuginfo-32bit-3.25-29.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-49.0-80.1 MozillaFirefox-branding-upstream-49.0-80.1 MozillaFirefox-buildsymbols-49.0-80.1 MozillaFirefox-debuginfo-49.0-80.1 MozillaFirefox-debugsource-49.0-80.1 MozillaFirefox-devel-49.0-80.1 MozillaFirefox-translations-common-49.0-80.1 MozillaFirefox-translations-other-49.0-80.1 libfreebl3-3.25-46.1 libfreebl3-debuginfo-3.25-46.1 libsoftokn3-3.25-46.1 libsoftokn3-debuginfo-3.25-46.1 mozilla-nss-3.25-46.1 mozilla-nss-certs-3.25-46.1 mozilla-nss-certs-debuginfo-3.25-46.1 mozilla-nss-debuginfo-3.25-46.1 mozilla-nss-debugsource-3.25-46.1 mozilla-nss-devel-3.25-46.1 mozilla-nss-sysinit-3.25-46.1 mozilla-nss-sysinit-debuginfo-3.25-46.1 mozilla-nss-tools-3.25-46.1 mozilla-nss-tools-debuginfo-3.25-46.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.25-46.1 libfreebl3-debuginfo-32bit-3.25-46.1 libsoftokn3-32bit-3.25-46.1 libsoftokn3-debuginfo-32bit-3.25-46.1 mozilla-nss-32bit-3.25-46.1 mozilla-nss-certs-32bit-3.25-46.1 mozilla-nss-certs-debuginfo-32bit-3.25-46.1 mozilla-nss-debuginfo-32bit-3.25-46.1 mozilla-nss-sysinit-32bit-3.25-46.1 mozilla-nss-sysinit-debuginfo-32bit-3.25-46.1 References: https://www.suse.com/security/cve/CVE-2016-2827.html https://www.suse.com/security/cve/CVE-2016-5256.html https://www.suse.com/security/cve/CVE-2016-5257.html https://www.suse.com/security/cve/CVE-2016-5270.html https://www.suse.com/security/cve/CVE-2016-5271.html https://www.suse.com/security/cve/CVE-2016-5272.html https://www.suse.com/security/cve/CVE-2016-5273.html https://www.suse.com/security/cve/CVE-2016-5274.html https://www.suse.com/security/cve/CVE-2016-5275.html https://www.suse.com/security/cve/CVE-2016-5276.html https://www.suse.com/security/cve/CVE-2016-5277.html https://www.suse.com/security/cve/CVE-2016-5278.html https://www.suse.com/security/cve/CVE-2016-5279.html https://www.suse.com/security/cve/CVE-2016-5280.html https://www.suse.com/security/cve/CVE-2016-5281.html https://www.suse.com/security/cve/CVE-2016-5282.html https://www.suse.com/security/cve/CVE-2016-5283.html https://www.suse.com/security/cve/CVE-2016-5284.html https://bugzilla.suse.com/999701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:2348-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 21 Sep '16

21 Sep '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2348-1 Rating: important References: #992537 Cross-References: CVE-2016-3485 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: IBM Java 6 was updated to version 6.0-16.30. Following security issue was fixed: CVE-2016-3485 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-java-1_6_0-ibm-12754=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-java-1_6_0-ibm-12754=1 - SUSE Manager 2.1: zypper in -t patch sleman21-java-1_6_0-ibm-12754=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_6_0-ibm-12754=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-java-1_6_0-ibm-12754=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-java-1_6_0-ibm-12754=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 - SUSE Manager Proxy 2.1 (x86_64): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 - SUSE Manager 2.1 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 - SUSE Manager 2.1 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.30-75.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): java-1_6_0-ibm-1.6.0_sr16.30-75.1 java-1_6_0-ibm-alsa-1.6.0_sr16.30-75.1 java-1_6_0-ibm-devel-1.6.0_sr16.30-75.1 java-1_6_0-ibm-fonts-1.6.0_sr16.30-75.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.30-75.1 java-1_6_0-ibm-plugin-1.6.0_sr16.30-75.1 References: https://www.suse.com/security/cve/CVE-2016-3485.html https://bugzilla.suse.com/992537 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0