April 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:1081-1: important: Security update for xen
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1081-1 Rating: important References: #1022555 #1026636 #1027519 #1027570 #1028235 #1028655 #1029827 #1030144 #1030442 Cross-References: CVE-2016-9603 CVE-2017-2633 CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has four fixes is now available. Description: This update for xen fixes the following issues: These security issues were fixed: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144). - CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). - CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636). These non-security issues were fixed: - bsc#1022555: Timeout in "execution of /etc/xen/scripts/block add" - bsc#1029827: Forward port xenstored Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-13069=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-13069=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-13069=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_16-54.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_16_3.0.101_97-54.1 xen-libs-4.4.4_16-54.1 xen-tools-domU-4.4.4_16-54.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_16-54.1 xen-doc-html-4.4.4_16-54.1 xen-libs-32bit-4.4.4_16-54.1 xen-tools-4.4.4_16-54.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_16_3.0.101_97-54.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_16-54.1 xen-debugsource-4.4.4_16-54.1 References: https://www.suse.com/security/cve/CVE-2016-9603.html https://www.suse.com/security/cve/CVE-2017-2633.html https://www.suse.com/security/cve/CVE-2017-6414.html https://www.suse.com/security/cve/CVE-2017-6505.html https://www.suse.com/security/cve/CVE-2017-7228.html https://bugzilla.suse.com/1022555 https://bugzilla.suse.com/1026636 https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1027570 https://bugzilla.suse.com/1028235 https://bugzilla.suse.com/1028655 https://bugzilla.suse.com/1029827 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1030442 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1080-1: important: Security update for xen
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1080-1 Rating: important References: #1022555 #1026636 #1027519 #1027570 #1028235 #1028655 #1029827 #1030144 #1030442 Cross-References: CVE-2016-9603 CVE-2017-2633 CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has four fixes is now available. Description: This update for xen fixes the following issues: These security issues were fixed: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636). - CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655). These non-security issues were fixed: - bsc#1022555: Timeout in "execution of /etc/xen/scripts/block add" - bsc#1029827: Forward port xenstored Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-626=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-626=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): xen-4.4.4_16-22.36.1 xen-debugsource-4.4.4_16-22.36.1 xen-doc-html-4.4.4_16-22.36.1 xen-kmp-default-4.4.4_16_k3.12.61_52.69-22.36.1 xen-kmp-default-debuginfo-4.4.4_16_k3.12.61_52.69-22.36.1 xen-libs-32bit-4.4.4_16-22.36.1 xen-libs-4.4.4_16-22.36.1 xen-libs-debuginfo-32bit-4.4.4_16-22.36.1 xen-libs-debuginfo-4.4.4_16-22.36.1 xen-tools-4.4.4_16-22.36.1 xen-tools-debuginfo-4.4.4_16-22.36.1 xen-tools-domU-4.4.4_16-22.36.1 xen-tools-domU-debuginfo-4.4.4_16-22.36.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): xen-4.4.4_16-22.36.1 xen-debugsource-4.4.4_16-22.36.1 xen-doc-html-4.4.4_16-22.36.1 xen-kmp-default-4.4.4_16_k3.12.61_52.69-22.36.1 xen-kmp-default-debuginfo-4.4.4_16_k3.12.61_52.69-22.36.1 xen-libs-32bit-4.4.4_16-22.36.1 xen-libs-4.4.4_16-22.36.1 xen-libs-debuginfo-32bit-4.4.4_16-22.36.1 xen-libs-debuginfo-4.4.4_16-22.36.1 xen-tools-4.4.4_16-22.36.1 xen-tools-debuginfo-4.4.4_16-22.36.1 xen-tools-domU-4.4.4_16-22.36.1 xen-tools-domU-debuginfo-4.4.4_16-22.36.1 References: https://www.suse.com/security/cve/CVE-2016-9603.html https://www.suse.com/security/cve/CVE-2017-2633.html https://www.suse.com/security/cve/CVE-2017-6414.html https://www.suse.com/security/cve/CVE-2017-6505.html https://www.suse.com/security/cve/CVE-2017-7228.html https://bugzilla.suse.com/1022555 https://bugzilla.suse.com/1026636 https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1027570 https://bugzilla.suse.com/1028235 https://bugzilla.suse.com/1028655 https://bugzilla.suse.com/1029827 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1030442 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1078-1: important: Security update for xen
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1078-1 Rating: important References: #1014136 #1015348 #1022555 #1026236 #1027519 #1028235 #1029128 #1029827 #1030144 #1030442 Cross-References: CVE-2017-6505 CVE-2017-7228 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update for xen to version 4.7.2 fixes the following issues: These security issues were fixed: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). These non-security issues were fixed: - bsc#1015348: libvirtd didn't not start during boot - bsc#1014136: kdump couldn't dump a kernel on SLES12-SP2 with Xen hypervisor. - bsc#1026236: Fixed paravirtualized performance - bsc#1022555: Timeout in "execution of /etc/xen/scripts/block add" - bsc#1029827: Forward port xenstored - bsc#1029128: Make xen to really produce xen.efi with gcc48 This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-492=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.2_02-11.3.1 xen-devel-4.7.2_02-11.3.1 xen-libs-4.7.2_02-11.3.1 xen-libs-debuginfo-4.7.2_02-11.3.1 xen-tools-domU-4.7.2_02-11.3.1 xen-tools-domU-debuginfo-4.7.2_02-11.3.1 - openSUSE Leap 42.2 (x86_64): xen-4.7.2_02-11.3.1 xen-doc-html-4.7.2_02-11.3.1 xen-libs-32bit-4.7.2_02-11.3.1 xen-libs-debuginfo-32bit-4.7.2_02-11.3.1 xen-tools-4.7.2_02-11.3.1 xen-tools-debuginfo-4.7.2_02-11.3.1 References: https://www.suse.com/security/cve/CVE-2017-6505.html https://www.suse.com/security/cve/CVE-2017-7228.html https://bugzilla.suse.com/1014136 https://bugzilla.suse.com/1015348 https://bugzilla.suse.com/1022555 https://bugzilla.suse.com/1026236 https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1028235 https://bugzilla.suse.com/1029128 https://bugzilla.suse.com/1029827 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1030442 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1067-1: important: Security update for ruby2.1
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

SUSE Security Update: Security update for ruby2.1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1067-1 Rating: important References: #1014863 #1018808 #887877 #909695 #926974 #936032 #959495 #986630 Cross-References: CVE-2014-4975 CVE-2015-1855 CVE-2015-3900 CVE-2015-7551 CVE-2016-2339 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new"initialize" (bsc#1018808) - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495) - CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032) - CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames (bsc#926974) - CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877) Bugfixes: - SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863) - Segmentation fault after pack & ioctl & unpack (bsc#909695) - Ruby:HTTP Header injection in 'net/http' (bsc#986630) ChangeLog: - http://svn.ruby-lang.org/repos/ruby/tags/v2_1_9/ChangeLog Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-624=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-624=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-624=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-624=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-624=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-624=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-624=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-624=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-devel-2.1.9-15.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-devel-2.1.9-15.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): libruby2_1-2_1-2.1.9-15.1 libruby2_1-2_1-debuginfo-2.1.9-15.1 ruby2.1-2.1.9-15.1 ruby2.1-debuginfo-2.1.9-15.1 ruby2.1-debugsource-2.1.9-15.1 ruby2.1-stdlib-2.1.9-15.1 ruby2.1-stdlib-debuginfo-2.1.9-15.1 References: https://www.suse.com/security/cve/CVE-2014-4975.html https://www.suse.com/security/cve/CVE-2015-1855.html https://www.suse.com/security/cve/CVE-2015-3900.html https://www.suse.com/security/cve/CVE-2015-7551.html https://www.suse.com/security/cve/CVE-2016-2339.html https://bugzilla.suse.com/1014863 https://bugzilla.suse.com/1018808 https://bugzilla.suse.com/887877 https://bugzilla.suse.com/909695 https://bugzilla.suse.com/926974 https://bugzilla.suse.com/936032 https://bugzilla.suse.com/959495 https://bugzilla.suse.com/986630 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1064-1: important: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1
by opensuse-security＠opensuse.org 19 Apr '17

19 Apr '17

SUSE Security Update: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1064-1 Rating: important References: #1030467 #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for the Linux Kernel 3.12.59-60_41 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to freeze in rare circumstances Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-621=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_59-60_41-default-10-2.1 kgraft-patch-3_12_59-60_41-xen-10-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030467 https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1063-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Apr '17

19 Apr '17

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1063-1 Rating: important References: #1020983 #1033466 #1033467 #1033468 #987866 #989528 Cross-References: CVE-2016-2775 CVE-2016-6170 CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for bind fixes the following issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol. One additional non-security bug was fixed: The default umask was changed to 077. (bsc#1020983) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-491=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-491=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bind-9.9.9P1-48.3.1 bind-chrootenv-9.9.9P1-48.3.1 bind-debuginfo-9.9.9P1-48.3.1 bind-debugsource-9.9.9P1-48.3.1 bind-devel-9.9.9P1-48.3.1 bind-libs-9.9.9P1-48.3.1 bind-libs-debuginfo-9.9.9P1-48.3.1 bind-lwresd-9.9.9P1-48.3.1 bind-lwresd-debuginfo-9.9.9P1-48.3.1 bind-utils-9.9.9P1-48.3.1 bind-utils-debuginfo-9.9.9P1-48.3.1 - openSUSE Leap 42.2 (x86_64): bind-libs-32bit-9.9.9P1-48.3.1 bind-libs-debuginfo-32bit-9.9.9P1-48.3.1 - openSUSE Leap 42.2 (noarch): bind-doc-9.9.9P1-48.3.1 - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.9P1-51.1 bind-chrootenv-9.9.9P1-51.1 bind-debuginfo-9.9.9P1-51.1 bind-debugsource-9.9.9P1-51.1 bind-devel-9.9.9P1-51.1 bind-libs-9.9.9P1-51.1 bind-libs-debuginfo-9.9.9P1-51.1 bind-lwresd-9.9.9P1-51.1 bind-lwresd-debuginfo-9.9.9P1-51.1 bind-utils-9.9.9P1-51.1 bind-utils-debuginfo-9.9.9P1-51.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.9P1-51.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.9P1-51.1 bind-libs-debuginfo-32bit-9.9.9P1-51.1 References: https://www.suse.com/security/cve/CVE-2016-2775.html https://www.suse.com/security/cve/CVE-2016-6170.html https://www.suse.com/security/cve/CVE-2017-3136.html https://www.suse.com/security/cve/CVE-2017-3137.html https://www.suse.com/security/cve/CVE-2017-3138.html https://bugzilla.suse.com/1020983 https://bugzilla.suse.com/1033466 https://bugzilla.suse.com/1033467 https://bugzilla.suse.com/1033468 https://bugzilla.suse.com/987866 https://bugzilla.suse.com/989528 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1059-1: important: Security update for Linux Kernel Live Patch 14 for SLE 12 SP1
by opensuse-security＠opensuse.org 19 Apr '17

19 Apr '17

SUSE Security Update: Security update for Linux Kernel Live Patch 14 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1059-1 Rating: important References: #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 3.12.69-60_64_35 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-618=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_69-60_64_35-default-2-2.1 kgraft-patch-3_12_69-60_64_35-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1058-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Apr '17

19 Apr '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1058-1 Rating: important References: #1027570 #1028235 #1030442 Cross-References: CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xen fixes the following security issues: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-xen-13067=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-xen-13067=1 - SUSE Manager 2.1: zypper in -t patch sleman21-xen-13067=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13067=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13067=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13067=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): xen-4.2.5_21-38.1 xen-doc-html-4.2.5_21-38.1 xen-doc-pdf-4.2.5_21-38.1 xen-kmp-default-4.2.5_21_3.0.101_0.47.99-38.1 xen-libs-32bit-4.2.5_21-38.1 xen-libs-4.2.5_21-38.1 xen-tools-4.2.5_21-38.1 xen-tools-domU-4.2.5_21-38.1 - SUSE Manager Proxy 2.1 (x86_64): xen-4.2.5_21-38.1 xen-doc-html-4.2.5_21-38.1 xen-doc-pdf-4.2.5_21-38.1 xen-kmp-default-4.2.5_21_3.0.101_0.47.99-38.1 xen-libs-32bit-4.2.5_21-38.1 xen-libs-4.2.5_21-38.1 xen-tools-4.2.5_21-38.1 xen-tools-domU-4.2.5_21-38.1 - SUSE Manager 2.1 (x86_64): xen-4.2.5_21-38.1 xen-doc-html-4.2.5_21-38.1 xen-doc-pdf-4.2.5_21-38.1 xen-kmp-default-4.2.5_21_3.0.101_0.47.99-38.1 xen-libs-32bit-4.2.5_21-38.1 xen-libs-4.2.5_21-38.1 xen-tools-4.2.5_21-38.1 xen-tools-domU-4.2.5_21-38.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.99-38.1 xen-libs-4.2.5_21-38.1 xen-tools-domU-4.2.5_21-38.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-38.1 xen-doc-html-4.2.5_21-38.1 xen-doc-pdf-4.2.5_21-38.1 xen-libs-32bit-4.2.5_21-38.1 xen-tools-4.2.5_21-38.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.99-38.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.99-38.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.99-38.1 xen-libs-4.2.5_21-38.1 xen-tools-domU-4.2.5_21-38.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-38.1 xen-debugsource-4.2.5_21-38.1 References: https://www.suse.com/security/cve/CVE-2017-6414.html https://www.suse.com/security/cve/CVE-2017-6505.html https://www.suse.com/security/cve/CVE-2017-7228.html https://bugzilla.suse.com/1027570 https://bugzilla.suse.com/1028235 https://bugzilla.suse.com/1030442 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1044-1: important: Security update for tiff
by opensuse-security＠opensuse.org 18 Apr '17

18 Apr '17

SUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1044-1 Rating: important References: #1031247 #1031249 #1031250 #1031254 #1031255 #1031262 #1031263 Cross-References: CVE-2016-10266 CVE-2016-10267 CVE-2016-10268 CVE-2016-10269 CVE-2016-10270 CVE-2016-10271 CVE-2016-10272 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10272: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9 (bsc#1031247). - CVE-2016-10271: tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13 (bsc#1031249). - CVE-2016-10270: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22 (bsc#1031250). - CVE-2016-10269: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2 (bsc#1031254). - CVE-2016-10268: tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23 (bsc#1031255). - CVE-2016-10267: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8 (bsc#1031262). - CVE-2016-10266: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. (bsc#1031263). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-610=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-610=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-610=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-610=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-610=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-610=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-610=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libtiff-devel-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libtiff5-4.0.7-43.1 libtiff5-debuginfo-4.0.7-43.1 tiff-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libtiff5-4.0.7-43.1 libtiff5-debuginfo-4.0.7-43.1 tiff-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libtiff5-32bit-4.0.7-43.1 libtiff5-debuginfo-32bit-4.0.7-43.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libtiff5-4.0.7-43.1 libtiff5-debuginfo-4.0.7-43.1 tiff-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libtiff5-32bit-4.0.7-43.1 libtiff5-debuginfo-32bit-4.0.7-43.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libtiff5-32bit-4.0.7-43.1 libtiff5-4.0.7-43.1 libtiff5-debuginfo-32bit-4.0.7-43.1 libtiff5-debuginfo-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libtiff5-32bit-4.0.7-43.1 libtiff5-4.0.7-43.1 libtiff5-debuginfo-32bit-4.0.7-43.1 libtiff5-debuginfo-4.0.7-43.1 tiff-debuginfo-4.0.7-43.1 tiff-debugsource-4.0.7-43.1 References: https://www.suse.com/security/cve/CVE-2016-10266.html https://www.suse.com/security/cve/CVE-2016-10267.html https://www.suse.com/security/cve/CVE-2016-10268.html https://www.suse.com/security/cve/CVE-2016-10269.html https://www.suse.com/security/cve/CVE-2016-10270.html https://www.suse.com/security/cve/CVE-2016-10271.html https://www.suse.com/security/cve/CVE-2016-10272.html https://bugzilla.suse.com/1031247 https://bugzilla.suse.com/1031249 https://bugzilla.suse.com/1031250 https://bugzilla.suse.com/1031254 https://bugzilla.suse.com/1031255 https://bugzilla.suse.com/1031262 https://bugzilla.suse.com/1031263 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1027-1: important: Security update for bind
by opensuse-security＠opensuse.org 18 Apr '17

18 Apr '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1027-1 Rating: important References: #1034162 Cross-References: CVE-2017-3137 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - A regression in the fix for CVE-2017-3137 caused an assert in name.c (bsc#1034162) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-bind-13063=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-bind-13063=1 - SUSE Manager 2.1: zypper in -t patch sleman21-bind-13063=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-13063=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-13063=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-bind-13063=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-bind-13063=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-13063=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-13063=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-devel-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-32bit-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Manager Proxy 2.1 (x86_64): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-devel-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-32bit-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Manager 2.1 (s390x x86_64): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-devel-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-32bit-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.47.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.47.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.47.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.47.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-devel-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.47.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): bind-9.9.6P1-0.47.1 bind-chrootenv-9.9.6P1-0.47.1 bind-devel-9.9.6P1-0.47.1 bind-doc-9.9.6P1-0.47.1 bind-libs-9.9.6P1-0.47.1 bind-utils-9.9.6P1-0.47.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.47.1 bind-debugsource-9.9.6P1-0.47.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): bind-debuginfo-9.9.6P1-0.47.1 bind-debugsource-9.9.6P1-0.47.1 References: https://www.suse.com/security/cve/CVE-2017-3137.html https://bugzilla.suse.com/1034162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0