May 2017 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] SUSE-SU-2017:1335-1: important: Security update for kdelibs4
by opensuse-security＠opensuse.org 18 May '17

18 May '17

SUSE Security Update: Security update for kdelibs4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1335-1 Rating: important References: #1036244 Cross-References: CVE-2017-8422 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kdelibs4 fixes the following issues: - CVE-2017-8422: This update fixes problem in the DBUS authentication of the kauth framework that could be used to escalate privileges depending on bugs or misimplemented dbus services. (boo#1036244) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-805=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-805=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-805=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-805=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-805=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): kdelibs4-debuginfo-4.12.0-10.1 kdelibs4-debugsource-4.12.0-10.1 libkde4-4.12.0-10.1 libkde4-debuginfo-4.12.0-10.1 libkdecore4-4.12.0-10.1 libkdecore4-debuginfo-4.12.0-10.1 libksuseinstall1-4.12.0-10.1 libksuseinstall1-debuginfo-4.12.0-10.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): kdelibs4-debuginfo-4.12.0-10.1 kdelibs4-debugsource-4.12.0-10.1 libkde4-4.12.0-10.1 libkde4-debuginfo-4.12.0-10.1 libkdecore4-4.12.0-10.1 libkdecore4-debuginfo-4.12.0-10.1 libksuseinstall1-4.12.0-10.1 libksuseinstall1-debuginfo-4.12.0-10.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libkde4-32bit-4.12.0-10.1 libkde4-debuginfo-32bit-4.12.0-10.1 libkdecore4-32bit-4.12.0-10.1 libkdecore4-debuginfo-32bit-4.12.0-10.1 libksuseinstall1-32bit-4.12.0-10.1 libksuseinstall1-debuginfo-32bit-4.12.0-10.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): kdelibs4-debuginfo-4.12.0-10.1 kdelibs4-debugsource-4.12.0-10.1 libkde4-4.12.0-10.1 libkde4-debuginfo-4.12.0-10.1 libkdecore4-4.12.0-10.1 libkdecore4-debuginfo-4.12.0-10.1 libksuseinstall1-4.12.0-10.1 libksuseinstall1-debuginfo-4.12.0-10.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libkde4-32bit-4.12.0-10.1 libkde4-debuginfo-32bit-4.12.0-10.1 libkdecore4-32bit-4.12.0-10.1 libkdecore4-debuginfo-32bit-4.12.0-10.1 libksuseinstall1-32bit-4.12.0-10.1 libksuseinstall1-debuginfo-32bit-4.12.0-10.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): kdelibs4-debuginfo-4.12.0-10.1 kdelibs4-debugsource-4.12.0-10.1 libkde4-32bit-4.12.0-10.1 libkde4-4.12.0-10.1 libkde4-debuginfo-32bit-4.12.0-10.1 libkde4-debuginfo-4.12.0-10.1 libkdecore4-32bit-4.12.0-10.1 libkdecore4-4.12.0-10.1 libkdecore4-debuginfo-32bit-4.12.0-10.1 libkdecore4-debuginfo-4.12.0-10.1 libksuseinstall1-32bit-4.12.0-10.1 libksuseinstall1-4.12.0-10.1 libksuseinstall1-debuginfo-32bit-4.12.0-10.1 libksuseinstall1-debuginfo-4.12.0-10.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): kdelibs4-debuginfo-4.12.0-10.1 kdelibs4-debugsource-4.12.0-10.1 libkde4-32bit-4.12.0-10.1 libkde4-4.12.0-10.1 libkde4-debuginfo-32bit-4.12.0-10.1 libkde4-debuginfo-4.12.0-10.1 libkdecore4-32bit-4.12.0-10.1 libkdecore4-4.12.0-10.1 libkdecore4-debuginfo-32bit-4.12.0-10.1 libkdecore4-debuginfo-4.12.0-10.1 libksuseinstall1-32bit-4.12.0-10.1 libksuseinstall1-4.12.0-10.1 libksuseinstall1-debuginfo-32bit-4.12.0-10.1 libksuseinstall1-debuginfo-4.12.0-10.1 References: https://www.suse.com/security/cve/CVE-2017-8422.html https://bugzilla.suse.com/1036244 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1328-1: important: Security update for rpcbind
by opensuse-security＠opensuse.org 18 May '17

18 May '17

SUSE Security Update: Security update for rpcbind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1328-1 Rating: important References: #1037559 Cross-References: CVE-2017-8779 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rpcbind fixes the following issues: - CVE-2017-8779: A crafted UDP package could lead rcpbind to remote denial-of-service (bsc#1037559) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-803=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-803=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-803=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): rpcbind-0.2.3-23.1 rpcbind-debuginfo-0.2.3-23.1 rpcbind-debugsource-0.2.3-23.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): rpcbind-0.2.3-23.1 rpcbind-debuginfo-0.2.3-23.1 rpcbind-debugsource-0.2.3-23.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): rpcbind-0.2.3-23.1 rpcbind-debuginfo-0.2.3-23.1 rpcbind-debugsource-0.2.3-23.1 References: https://www.suse.com/security/cve/CVE-2017-8779.html https://bugzilla.suse.com/1037559 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE Leap 42.1 has reached end of SUSE support
by Benjamin Brunner 17 May '17

17 May '17

Hi all, With the release of release-notes-openSUSE on May 17th, 2017 the SUSE sponsored maintenance of openSUSE Leap 42.1 has ended. openSUSE Leap 42.1 is now officially discontinued and out of support by SUSE. The currently maintained stable release is openSUSE Leap 42.2, which will be maintained until the Q2/2018. See https://en.opensuse.org/Lifetime Upgrading is easy. See the links below for instructions: https://doc.opensuse.org/documentation/leap/startup/html/book.opensuse.star… https://en.opensuse.org/SDB:System_upgrade https://en.opensuse.org/SDB:Offline_upgrade openSUSE Leap 42.1 was released on November 4th 2015, making it ca. 18 months of security and bugfix support. It was the first hybrid distribution which used sources from SUSE Linux Enterprise and from our community developers to bridge a gap between matured packages and newer packages found in openSUSE Tumbleweed. Some statistics on the released patches (compared to 13.2): Total updates: 1442 (+98) Updates imported from SUSE Linux Enterprise: 507 Updates provided by community developers: 935 Security: 598 (-109) Recommended: 807 (+182) Optional: 36 (+24) Feature: 1 (1) Fixed CVE-entries: 2434 (-217) Fixed Bugs (overall): 3735 (-170) A huge thanks to our awesome packagers, community, and all involved people, who made the next great release possible! Your maintenance- and security-team -- Benjamin Brunner <bbrunner(a)suse.com>, SUSE MaintenanceSecurity SUSE LINUX GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1322-1: important: Security update for ghostscript-library
by opensuse-security＠opensuse.org 17 May '17

17 May '17

SUSE Security Update: Security update for ghostscript-library ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1322-1 Rating: important References: #1036453 Cross-References: CVE-2017-8291 Affected Products: SUSE OpenStack Cloud 5 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ghostscript fixes the following security vulnerability: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) This update is a reissue including the SUSE Linux Enterprise 11 SP3 product. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-ghostscript-library-13109=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ghostscript-library-13109=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ghostscript-library-13109=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-ghostscript-library-13109=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-ghostscript-library-13109=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ghostscript-library-13109=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-ghostscript-library-13109=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): ghostscript-fonts-other-8.62-32.46.1 ghostscript-fonts-rus-8.62-32.46.1 ghostscript-fonts-std-8.62-32.46.1 ghostscript-library-8.62-32.46.1 ghostscript-omni-8.62-32.46.1 ghostscript-x11-8.62-32.46.1 libgimpprint-4.2.7-32.46.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ghostscript-devel-8.62-32.46.1 ghostscript-ijs-devel-8.62-32.46.1 libgimpprint-devel-4.2.7-32.46.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): ghostscript-fonts-other-8.62-32.46.1 ghostscript-fonts-rus-8.62-32.46.1 ghostscript-fonts-std-8.62-32.46.1 ghostscript-library-8.62-32.46.1 ghostscript-omni-8.62-32.46.1 ghostscript-x11-8.62-32.46.1 libgimpprint-4.2.7-32.46.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): ghostscript-fonts-other-8.62-32.46.1 ghostscript-fonts-rus-8.62-32.46.1 ghostscript-fonts-std-8.62-32.46.1 ghostscript-library-8.62-32.46.1 ghostscript-omni-8.62-32.46.1 ghostscript-x11-8.62-32.46.1 libgimpprint-4.2.7-32.46.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): ghostscript-fonts-other-8.62-32.46.1 ghostscript-fonts-rus-8.62-32.46.1 ghostscript-fonts-std-8.62-32.46.1 ghostscript-library-8.62-32.46.1 ghostscript-omni-8.62-32.46.1 ghostscript-x11-8.62-32.46.1 libgimpprint-4.2.7-32.46.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ghostscript-library-debuginfo-8.62-32.46.1 ghostscript-library-debugsource-8.62-32.46.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): ghostscript-library-debuginfo-8.62-32.46.1 ghostscript-library-debugsource-8.62-32.46.1 References: https://www.suse.com/security/cve/CVE-2017-8291.html https://bugzilla.suse.com/1036453 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1315-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 16 May '17

16 May '17

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1315-1 Rating: important References: #1020868 #1020890 #1020976 #1022428 #1034911 #996821 Cross-References: CVE-2017-3302 CVE-2017-3313 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA * notable changes: * XtraDB updated to 5.6.35-80.0 * TokuDB updated to 5.6.35-80.0 * PCRE updated to 8.40 * MDEV-11027: better InnoDB crash recovery progress reporting * MDEV-11520: improvements to how InnoDB data files are extended * Improvements to InnoDB startup/shutdown to make it more robust * MDEV-11233: fix for FULLTEXT index crash * MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename * release notes and changelog: * https://kb.askmonty.org/en/mariadb-10030-release-notes * https://kb.askmonty.org/en/mariadb-10030-changelog * fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428] - set the default umask to 077 in mysql-systemd-helper [bsc#1020976] - [bsc#1034911] - tracker bug * fixes also [bsc#1020868] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-795=1 - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2017-795=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-795=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-795=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-795=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-795=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-795=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-795=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-795=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libmysqlclient_r18-10.0.30-25.1 libmysqlclient_r18-32bit-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): libmysqlclient_r18-10.0.30-25.1 libmysqlclient_r18-32bit-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libmysqlclient-devel-10.0.30-25.1 libmysqlclient_r18-10.0.30-25.1 libmysqld-devel-10.0.30-25.1 libmysqld18-10.0.30-25.1 libmysqld18-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libmysqlclient-devel-10.0.30-25.1 libmysqlclient_r18-10.0.30-25.1 libmysqld-devel-10.0.30-25.1 libmysqld18-10.0.30-25.1 libmysqld18-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libmysqlclient18-10.0.30-25.1 libmysqlclient18-debuginfo-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-client-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 mariadb-tools-10.0.30-25.1 mariadb-tools-debuginfo-10.0.30-25.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libmysqlclient18-10.0.30-25.1 libmysqlclient18-debuginfo-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-client-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 mariadb-tools-10.0.30-25.1 mariadb-tools-debuginfo-10.0.30-25.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libmysqlclient18-32bit-10.0.30-25.1 libmysqlclient18-debuginfo-32bit-10.0.30-25.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libmysqlclient18-10.0.30-25.1 libmysqlclient18-debuginfo-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-client-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 mariadb-tools-10.0.30-25.1 mariadb-tools-debuginfo-10.0.30-25.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libmysqlclient18-32bit-10.0.30-25.1 libmysqlclient18-debuginfo-32bit-10.0.30-25.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libmysqlclient18-10.0.30-25.1 libmysqlclient18-32bit-10.0.30-25.1 libmysqlclient18-debuginfo-10.0.30-25.1 libmysqlclient18-debuginfo-32bit-10.0.30-25.1 libmysqlclient_r18-10.0.30-25.1 libmysqlclient_r18-32bit-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-client-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libmysqlclient18-10.0.30-25.1 libmysqlclient18-32bit-10.0.30-25.1 libmysqlclient18-debuginfo-10.0.30-25.1 libmysqlclient18-debuginfo-32bit-10.0.30-25.1 libmysqlclient_r18-10.0.30-25.1 libmysqlclient_r18-32bit-10.0.30-25.1 mariadb-10.0.30-25.1 mariadb-client-10.0.30-25.1 mariadb-client-debuginfo-10.0.30-25.1 mariadb-debuginfo-10.0.30-25.1 mariadb-debugsource-10.0.30-25.1 mariadb-errormessages-10.0.30-25.1 References: https://www.suse.com/security/cve/CVE-2017-3302.html https://www.suse.com/security/cve/CVE-2017-3313.html https://bugzilla.suse.com/1020868 https://bugzilla.suse.com/1020890 https://bugzilla.suse.com/1020976 https://bugzilla.suse.com/1022428 https://bugzilla.suse.com/1034911 https://bugzilla.suse.com/996821 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1314-1: important: Security update for libtirpc
by opensuse-security＠opensuse.org 16 May '17

16 May '17

SUSE Security Update: Security update for libtirpc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1314-1 Rating: important References: #1037559 Cross-References: CVE-2017-8779 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtirpc fixes the following issues: - CVE-2017-8779: crafted UDP packaged could lead rpcbind to denial-of-service (bsc#1037559) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-796=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-796=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-796=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-796=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libtirpc-debugsource-1.0.1-16.1 libtirpc-devel-1.0.1-16.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libtirpc-debugsource-1.0.1-16.1 libtirpc-netconfig-1.0.1-16.1 libtirpc3-1.0.1-16.1 libtirpc3-debuginfo-1.0.1-16.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): libtirpc-debugsource-1.0.1-16.1 libtirpc-netconfig-1.0.1-16.1 libtirpc3-1.0.1-16.1 libtirpc3-debuginfo-1.0.1-16.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libtirpc3-32bit-1.0.1-16.1 libtirpc3-debuginfo-32bit-1.0.1-16.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libtirpc-debugsource-1.0.1-16.1 libtirpc-netconfig-1.0.1-16.1 libtirpc3-1.0.1-16.1 libtirpc3-32bit-1.0.1-16.1 libtirpc3-debuginfo-1.0.1-16.1 libtirpc3-debuginfo-32bit-1.0.1-16.1 References: https://www.suse.com/security/cve/CVE-2017-8779.html https://bugzilla.suse.com/1037559 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1311-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 16 May '17

16 May '17

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1311-1 Rating: important References: #1020890 #1020976 #1022428 #1034911 Cross-References: CVE-2017-3302 CVE-2017-3313 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA * notable changes: * XtraDB updated to 5.6.35-80.0 * TokuDB updated to 5.6.35-80.0 * PCRE updated to 8.40 * MDEV-11027: better InnoDB crash recovery progress reporting * MDEV-11520: improvements to how InnoDB data files are extended * Improvements to InnoDB startup/shutdown to make it more robust * MDEV-11233: fix for FULLTEXT index crash * MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename * release notes and changelog: * https://kb.askmonty.org/en/mariadb-10030-release-notes * https://kb.askmonty.org/en/mariadb-10030-changelog * fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428] - set the default umask to 077 in rc.mysql-multi [bsc#1020976] - [bsc#1034911] - tracker bug - increase build disk size from 10 GB to 13 GB in order to fix build for aarch64 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-792=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-792=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): libmysqlclient-devel-10.0.30-20.26.1 libmysqlclient18-10.0.30-20.26.1 libmysqlclient18-32bit-10.0.30-20.26.1 libmysqlclient18-debuginfo-10.0.30-20.26.1 libmysqlclient18-debuginfo-32bit-10.0.30-20.26.1 libmysqlclient_r18-10.0.30-20.26.1 libmysqld-devel-10.0.30-20.26.1 libmysqld18-10.0.30-20.26.1 libmysqld18-debuginfo-10.0.30-20.26.1 mariadb-10.0.30-20.26.1 mariadb-client-10.0.30-20.26.1 mariadb-client-debuginfo-10.0.30-20.26.1 mariadb-debuginfo-10.0.30-20.26.1 mariadb-debugsource-10.0.30-20.26.1 mariadb-errormessages-10.0.30-20.26.1 mariadb-tools-10.0.30-20.26.1 mariadb-tools-debuginfo-10.0.30-20.26.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): libmysqlclient-devel-10.0.30-20.26.1 libmysqlclient18-10.0.30-20.26.1 libmysqlclient18-32bit-10.0.30-20.26.1 libmysqlclient18-debuginfo-10.0.30-20.26.1 libmysqlclient18-debuginfo-32bit-10.0.30-20.26.1 libmysqlclient_r18-10.0.30-20.26.1 libmysqld-devel-10.0.30-20.26.1 libmysqld18-10.0.30-20.26.1 libmysqld18-debuginfo-10.0.30-20.26.1 mariadb-10.0.30-20.26.1 mariadb-client-10.0.30-20.26.1 mariadb-client-debuginfo-10.0.30-20.26.1 mariadb-debuginfo-10.0.30-20.26.1 mariadb-debugsource-10.0.30-20.26.1 mariadb-errormessages-10.0.30-20.26.1 mariadb-tools-10.0.30-20.26.1 mariadb-tools-debuginfo-10.0.30-20.26.1 References: https://www.suse.com/security/cve/CVE-2017-3302.html https://www.suse.com/security/cve/CVE-2017-3313.html https://bugzilla.suse.com/1020890 https://bugzilla.suse.com/1020976 https://bugzilla.suse.com/1022428 https://bugzilla.suse.com/1034911 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1308-1: important: Security update for Linux Kernel Live Patch 6 for SLE 12 SP2
by opensuse-security＠opensuse.org 16 May '17

16 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 6 for SLE 12 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1308-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.49-92_14 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-786=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_14-default-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1306-1: important: Security update for libtirpc
by opensuse-security＠opensuse.org 16 May '17

16 May '17

SUSE Security Update: Security update for libtirpc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1306-1 Rating: important References: #1037559 Cross-References: CVE-2017-8779 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtirpc fixes the following issues: - CVE-2017-8779: crafted UDP packaged could lead rpcbind to denial-of-service (bsc#1037559) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-788=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-788=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-788=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): libtirpc-debugsource-0.2.3-13.3.1 libtirpc-devel-0.2.3-13.3.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libtirpc-debugsource-0.2.3-13.3.1 libtirpc1-0.2.3-13.3.1 libtirpc1-debuginfo-0.2.3-13.3.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libtirpc1-32bit-0.2.3-13.3.1 libtirpc1-debuginfo-32bit-0.2.3-13.3.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libtirpc-debugsource-0.2.3-13.3.1 libtirpc1-0.2.3-13.3.1 libtirpc1-32bit-0.2.3-13.3.1 libtirpc1-debuginfo-0.2.3-13.3.1 libtirpc1-debuginfo-32bit-0.2.3-13.3.1 References: https://www.suse.com/security/cve/CVE-2017-8779.html https://bugzilla.suse.com/1037559 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1303-1: important: Security update for Linux Kernel Live Patch 0 for SLE 12 SP2
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 0 for SLE 12 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1303-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.21-69 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-784=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_21-69-default-6-17.2 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1302-1: important: Security update for Linux Kernel Live Patch 19 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 19 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1302-1 Rating: important References: #1030575 #1031660 Cross-References: CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for the Linux Kernel 3.12.61-52_66 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-764=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-764=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_61-52_66-default-4-2.1 kgraft-patch-3_12_61-52_66-xen-4-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_66-default-4-2.1 kgraft-patch-3_12_61-52_66-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1301-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1301-1 Rating: important References: #1005651 #1008374 #1008893 #1013018 #1013070 #1013800 #1013862 #1016489 #1017143 #1018263 #1018446 #1019168 #1020229 #1021256 #1021913 #1022971 #1023014 #1023163 #1023888 #1024508 #1024788 #1024938 #1025235 #1025702 #1026024 #1026260 #1026722 #1026914 #1027066 #1027101 #1027178 #1028415 #1028880 #1029212 #1029770 #1030213 #1030573 #1031003 #1031052 #1031440 #1031579 #1032141 #1033336 #1033771 #1033794 #1033804 #1033816 #1034026 #909486 #911105 #931620 #979021 #982783 #983212 #985561 #988065 #989056 #995542 #999245 Cross-References: CVE-2015-3288 CVE-2015-8970 CVE-2016-10200 CVE-2016-5243 CVE-2017-2671 CVE-2017-5669 CVE-2017-5970 CVE-2017-5986 CVE-2017-6074 CVE-2017-6214 CVE-2017-6348 CVE-2017-6353 CVE-2017-7184 CVE-2017-7187 CVE-2017-7261 CVE-2017-7294 CVE-2017-7308 CVE-2017-7616 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 18 vulnerabilities and has 41 fixes is now available. Description: The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. Notable new features: - Toleration of newer crypto hardware for z Systems - USB 2.0 Link power management for Haswell-ULT The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579) - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003) - CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573). - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938). - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440) - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052) - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213) - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178) - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914) - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bsc#979021). - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415) - CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212) - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application (bnc#1027066) - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722) - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024) - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235) - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c (bsc#1008374). The following non-security bugs were fixed: - NFSD: do not risk using duplicate owner/file/delegation ids (bsc#1029212). - RAID1: avoid unnecessary spin locks in I/O barrier code (bsc#982783, bsc#1026260). - SUNRPC: Clean up the slot table allocation (bsc#1013862). - SUNRPC: Initalise the struct xprt upon allocation (bsc#1013862). - USB: cdc-acm: fix broken runtime suspend (bsc#1033771). - USB: cdc-acm: fix open and suspend race (bsc#1033771). - USB: cdc-acm: fix potential urb leak and PM imbalance in write (bsc#1033771). - USB: cdc-acm: fix runtime PM for control messages (bsc#1033771). - USB: cdc-acm: fix runtime PM imbalance at shutdown (bsc#1033771). - USB: cdc-acm: fix shutdown and suspend race (bsc#1033771). - USB: cdc-acm: fix write and resume race (bsc#1033771). - USB: cdc-acm: fix write and suspend race (bsc#1033771). - USB: hub: Fix crash after failure to read BOS descriptor - USB: serial: iuu_phoenix: fix NULL-deref at open (bsc#1033794). - USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256). - USB: serial: mos7720: fix NULL-deref at open (bsc#1033816). - USB: serial: mos7720: fix parallel probe (bsc#1033816). - USB: serial: mos7720: fix parport use-after-free on probe errors (bsc#1033816). - USB: serial: mos7720: fix use-after-free on probe errors (bsc#1033816). - USB: serial: mos7840: fix NULL-deref at open (bsc#1034026). - USB: xhci-mem: use passed in GFP flags instead of GFP_KERNEL (bsc#1023014). - Update metadata for serial fixes (bsc#1013070) - Use PF_LESS_THROTTLE in loop device thread (bsc#1027101). - clocksource: Remove "weak" from clocksource_default_clock() declaration (bnc#1013018). - dlm: backport "fix lvb invalidation conditions" (bsc#1005651). - drm/mgag200: Add support for G200e rev 4 (bnc#995542, comment #81) - enic: set skb->hash type properly (bsc#911105). - ext4: fix mballoc breakage with 64k block size (bsc#1013018). - ext4: fix stack memory corruption with 64k block size (bsc#1013018). - ext4: reject inodes with negative size (bsc#1013018). - fuse: initialize fc->release before calling it (bsc#1013018). - i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx (bsc#985561). - i40e/i40evf: Fix mixed size frags and linearization (bsc#985561). - i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet (bsc#985561). - i40e/i40evf: Rewrite logic for 8 descriptor per packet check (bsc#985561). - i40e: Fix TSO with more than 8 frags per segment issue (bsc#985561). - i40e: Impose a lower limit on gso size (bsc#985561). - i40e: Limit TX descriptor count in cases where frag size is greater than 16K (bsc#985561). - i40e: avoid null pointer dereference (bsc#909486). - jbd: Fix oops in journal_remove_journal_head() (bsc#1017143). - jbd: do not wait (forever) for stale tid caused by wraparound (bsc#1020229). - kABI: mask struct xfs_icdinode change (bsc#1024788). - kabi: Protect xfs_mount and xfs_buftarg (bsc#1024508). - kabi: fix (bsc#1008893). - lockd: use init_utsname for id encoding (bsc#1033804). - lockd: use rpc client's cl_nodename for id encoding (bsc#1033804). - md linear: fix a race between linear_add() and linear_congested() (bsc#1018446). - md/linear: shutup lockdep warnning (bsc#1018446). - mm/mempolicy.c: do not put mempolicy before using its nodemask (bnc#931620). - ocfs2: do not write error flag to user structure we cannot copy from/to (bsc#1013018). - ocfs2: fix crash caused by stale lvb with fsdlm plugin (bsc#1013800). - ocfs2: fix error return code in ocfs2_info_handle_freefrag() (bsc#1013018). - ocfs2: null deref on allocation error (bsc#1013018). - pciback: only check PF if actually dealing with a VF (bsc#999245). - pciback: use pci_physfn() (bsc#999245). - posix-timers: Fix stack info leak in timer_create() (bnc#1013018). - powerpc,cpuidle: Dont toggle CPUIDLE_FLAG_IGNORE while setting smt_snooze_delay (bsc#1023163). - powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971). - powerpc/fadump: Reserve memory at an offset closer to bottom of RAM (bsc#1032141). - powerpc/fadump: Update fadump documentation (bsc#1032141). - powerpc/nvram: Fix an incorrect partition merge (bsc#1016489). - powerpc/vdso64: Use double word compare on pointers (bsc#1016489). - rcu: Call out dangers of expedited RCU primitives (bsc#1008893). - rcu: Direct algorithmic SRCU implementation (bsc#1008893). - rcu: Flip ->completed only once per SRCU grace period (bsc#1008893). - rcu: Implement a variant of Peter's SRCU algorithm (bsc#1008893). - rcu: Increment upper bit only for srcu_read_lock() (bsc#1008893). - rcu: Remove fast check path from __synchronize_srcu() (bsc#1008893). - s390/kmsg: add missing kmsg descriptions (bnc#1025702). - s390/vmlogrdr: fix IUCV buffer allocation (bnc#1025702). - s390/zcrypt: Introduce CEX6 toleration - sched/core: Fix TASK_DEAD race in finish_task_switch() (bnc#1013018). - sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems (bnc#1013018). - scsi: zfcp: do not trace pure benign residual HBA responses at default level (bnc#1025702). - scsi: zfcp: fix rport unblock race with LUN recovery (bnc#1025702). - scsi: zfcp: fix use-after-"free" in FC ingress path after TMF (bnc#1025702). - scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send (bnc#1025702). - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168). - tcp: abort orphan sockets stalling on zero window probes (bsc#1021913). - vfs: split generic splice code from i_mutex locking (bsc#1024788). - virtio_scsi: fix memory leak on full queue condition (bsc#1028880). - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065, bsc#1029770). - xen-blkfront: correct maximum segment accounting (bsc#1018263). - xen-blkfront: do not call talk_to_blkback when already connected to blkback. - xen-blkfront: free resources if xlvbd_alloc_gendisk fails. - xfs: Fix lock ordering in splice write (bsc#1024788). - xfs: Make xfs_icdinode->di_dmstate atomic_t (bsc#1024788). - xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1024508). - xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508). - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056). - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888). - xfs: kill xfs_itruncate_start (bsc#1024788). - xfs: remove the i_new_size field in struct xfs_inode (bsc#1024788). - xfs: remove the i_size field in struct xfs_inode (bsc#1024788). - xfs: remove xfs_itruncate_data (bsc#1024788). - xfs: replace global xfslogd wq with per-mount wq (bsc#1024508). - xfs: split xfs_itruncate_finish (bsc#1024788). - xfs: split xfs_setattr (bsc#1024788). - xfs: track and serialize in-flight async buffers against unmount (bsc#1024508). - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-linux-kernel-13105=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-linux-kernel-13105=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-linux-kernel-13105=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-linux-kernel-13105=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): kernel-docs-3.0.101-100.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-100.1 kernel-default-base-3.0.101-100.1 kernel-default-devel-3.0.101-100.1 kernel-source-3.0.101-100.1 kernel-syms-3.0.101-100.1 kernel-trace-3.0.101-100.1 kernel-trace-base-3.0.101-100.1 kernel-trace-devel-3.0.101-100.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): kernel-ec2-3.0.101-100.1 kernel-ec2-base-3.0.101-100.1 kernel-ec2-devel-3.0.101-100.1 kernel-xen-3.0.101-100.1 kernel-xen-base-3.0.101-100.1 kernel-xen-devel-3.0.101-100.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): kernel-bigmem-3.0.101-100.1 kernel-bigmem-base-3.0.101-100.1 kernel-bigmem-devel-3.0.101-100.1 kernel-ppc64-3.0.101-100.1 kernel-ppc64-base-3.0.101-100.1 kernel-ppc64-devel-3.0.101-100.1 - SUSE Linux Enterprise Server 11-SP4 (s390x): kernel-default-man-3.0.101-100.1 - SUSE Linux Enterprise Server 11-SP4 (i586): kernel-pae-3.0.101-100.1 kernel-pae-base-3.0.101-100.1 kernel-pae-devel-3.0.101-100.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-100.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-100.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-100.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-100.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-100.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-100.1 kernel-default-debugsource-3.0.101-100.1 kernel-trace-debuginfo-3.0.101-100.1 kernel-trace-debugsource-3.0.101-100.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-100.1 kernel-trace-devel-debuginfo-3.0.101-100.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-100.1 kernel-ec2-debugsource-3.0.101-100.1 kernel-xen-debuginfo-3.0.101-100.1 kernel-xen-debugsource-3.0.101-100.1 kernel-xen-devel-debuginfo-3.0.101-100.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-100.1 kernel-bigmem-debugsource-3.0.101-100.1 kernel-ppc64-debuginfo-3.0.101-100.1 kernel-ppc64-debugsource-3.0.101-100.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-100.1 kernel-pae-debugsource-3.0.101-100.1 kernel-pae-devel-debuginfo-3.0.101-100.1 References: https://www.suse.com/security/cve/CVE-2015-3288.html https://www.suse.com/security/cve/CVE-2015-8970.html https://www.suse.com/security/cve/CVE-2016-10200.html https://www.suse.com/security/cve/CVE-2016-5243.html https://www.suse.com/security/cve/CVE-2017-2671.html https://www.suse.com/security/cve/CVE-2017-5669.html https://www.suse.com/security/cve/CVE-2017-5970.html https://www.suse.com/security/cve/CVE-2017-5986.html https://www.suse.com/security/cve/CVE-2017-6074.html https://www.suse.com/security/cve/CVE-2017-6214.html https://www.suse.com/security/cve/CVE-2017-6348.html https://www.suse.com/security/cve/CVE-2017-6353.html https://www.suse.com/security/cve/CVE-2017-7184.html https://www.suse.com/security/cve/CVE-2017-7187.html https://www.suse.com/security/cve/CVE-2017-7261.html https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://www.suse.com/security/cve/CVE-2017-7616.html https://bugzilla.suse.com/1005651 https://bugzilla.suse.com/1008374 https://bugzilla.suse.com/1008893 https://bugzilla.suse.com/1013018 https://bugzilla.suse.com/1013070 https://bugzilla.suse.com/1013800 https://bugzilla.suse.com/1013862 https://bugzilla.suse.com/1016489 https://bugzilla.suse.com/1017143 https://bugzilla.suse.com/1018263 https://bugzilla.suse.com/1018446 https://bugzilla.suse.com/1019168 https://bugzilla.suse.com/1020229 https://bugzilla.suse.com/1021256 https://bugzilla.suse.com/1021913 https://bugzilla.suse.com/1022971 https://bugzilla.suse.com/1023014 https://bugzilla.suse.com/1023163 https://bugzilla.suse.com/1023888 https://bugzilla.suse.com/1024508 https://bugzilla.suse.com/1024788 https://bugzilla.suse.com/1024938 https://bugzilla.suse.com/1025235 https://bugzilla.suse.com/1025702 https://bugzilla.suse.com/1026024 https://bugzilla.suse.com/1026260 https://bugzilla.suse.com/1026722 https://bugzilla.suse.com/1026914 https://bugzilla.suse.com/1027066 https://bugzilla.suse.com/1027101 https://bugzilla.suse.com/1027178 https://bugzilla.suse.com/1028415 https://bugzilla.suse.com/1028880 https://bugzilla.suse.com/1029212 https://bugzilla.suse.com/1029770 https://bugzilla.suse.com/1030213 https://bugzilla.suse.com/1030573 https://bugzilla.suse.com/1031003 https://bugzilla.suse.com/1031052 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031579 https://bugzilla.suse.com/1032141 https://bugzilla.suse.com/1033336 https://bugzilla.suse.com/1033771 https://bugzilla.suse.com/1033794 https://bugzilla.suse.com/1033804 https://bugzilla.suse.com/1033816 https://bugzilla.suse.com/1034026 https://bugzilla.suse.com/909486 https://bugzilla.suse.com/911105 https://bugzilla.suse.com/931620 https://bugzilla.suse.com/979021 https://bugzilla.suse.com/982783 https://bugzilla.suse.com/983212 https://bugzilla.suse.com/985561 https://bugzilla.suse.com/988065 https://bugzilla.suse.com/989056 https://bugzilla.suse.com/995542 https://bugzilla.suse.com/999245 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1300-1: important: Security update for Linux Kernel Live Patch 15 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 15 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1300-1 Rating: important References: #1030467 #1030575 #1031660 Cross-References: CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for the Linux Kernel 3.12.60-52_54 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to freeze in rare circumstances Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-768=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-768=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_54-default-9-2.1 kgraft-patch-3_12_60-52_54-xen-9-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_54-default-9-2.1 kgraft-patch-3_12_60-52_54-xen-9-2.1 References: https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030467 https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1299-1: important: Security update for Linux Kernel Live Patch 13 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 13 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1299-1 Rating: important References: #1030467 #1030575 #1031660 Cross-References: CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for the Linux Kernel 3.12.55-52_45 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to freeze in rare circumstances Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-782=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-782=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_55-52_45-default-9-2.1 kgraft-patch-3_12_55-52_45-xen-9-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_55-52_45-default-9-2.1 kgraft-patch-3_12_55-52_45-xen-9-2.1 References: https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030467 https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1297-1: important: Security update for Linux Kernel Live Patch 9 for SLE 12 SP1
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 9 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1297-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 3.12.67-60_64_18 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-777=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_67-60_64_18-default-7-2.1 kgraft-patch-3_12_67-60_64_18-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1295-1: important: Security update for Linux Kernel Live Patch 4 for SLE 12 SP2
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 4 for SLE 12 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1295-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.38-93 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-770=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_38-93-default-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1294-1: important: Security update for Linux Kernel Live Patch 12 for SLE 12 SP1
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 12 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1294-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 3.12.69-60_64_29 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-774=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_69-60_64_29-default-4-2.1 kgraft-patch-3_12_69-60_64_29-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1293-1: important: Security update for Linux Kernel Live Patch 6 for SLE 12 SP1
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 6 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1293-1 Rating: important References: #1030467 #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for the Linux Kernel 3.12.59-60_45 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). - bsc#1030467: Updated Dirty COW fix. The former patch caused some apps to freeze in rare circumstances Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-780=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_59-60_45-default-10-2.1 kgraft-patch-3_12_59-60_45-xen-10-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030467 https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1292-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 15 May '17

15 May '17

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1292-1 Rating: important References: #1015119 #1033447 #1033448 Cross-References: CVE-2016-8745 CVE-2017-5647 CVE-2017-5648 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for tomcat fixes the following issues: - CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448) - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447) - CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119) This update was imported from the SUSE:SLE-12-SP1:Update and SUSE:SLE-12-SP2:Update update projects. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-586=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-586=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): tomcat-8.0.43-6.7.1 tomcat-admin-webapps-8.0.43-6.7.1 tomcat-docs-webapp-8.0.43-6.7.1 tomcat-el-3_0-api-8.0.43-6.7.1 tomcat-embed-8.0.43-6.7.1 tomcat-javadoc-8.0.43-6.7.1 tomcat-jsp-2_3-api-8.0.43-6.7.1 tomcat-jsvc-8.0.43-6.7.1 tomcat-lib-8.0.43-6.7.1 tomcat-servlet-3_1-api-8.0.43-6.7.1 tomcat-webapps-8.0.43-6.7.1 - openSUSE Leap 42.1 (noarch): tomcat-8.0.43-17.1 tomcat-admin-webapps-8.0.43-17.1 tomcat-docs-webapp-8.0.43-17.1 tomcat-el-3_0-api-8.0.43-17.1 tomcat-embed-8.0.43-17.1 tomcat-javadoc-8.0.43-17.1 tomcat-jsp-2_3-api-8.0.43-17.1 tomcat-jsvc-8.0.43-17.1 tomcat-lib-8.0.43-17.1 tomcat-servlet-3_1-api-8.0.43-17.1 tomcat-webapps-8.0.43-17.1 References: https://www.suse.com/security/cve/CVE-2016-8745.html https://www.suse.com/security/cve/CVE-2017-5647.html https://www.suse.com/security/cve/CVE-2017-5648.html https://bugzilla.suse.com/1015119 https://bugzilla.suse.com/1033447 https://bugzilla.suse.com/1033448 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1291-1: important: Security update for Linux Kernel Live Patch 16 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 16 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1291-1 Rating: important References: #1030575 #1031660 Cross-References: CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for the Linux Kernel 3.12.60-52_57 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-767=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-767=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_57-default-6-2.1 kgraft-patch-3_12_60-52_57-xen-6-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_57-default-6-2.1 kgraft-patch-3_12_60-52_57-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1290-1: important: Security update for Linux Kernel Live Patch 11 for SLE 12 SP1
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 11 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1290-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 3.12.67-60_64_24 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-775=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_67-60_64_24-default-5-2.1 kgraft-patch-3_12_67-60_64_24-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1289-1: important: Security update for Linux Kernel Live Patch 10 for SLE 12 SP1
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 10 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1289-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 3.12.67-60_64_21 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-776=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_67-60_64_21-default-6-2.1 kgraft-patch-3_12_67-60_64_21-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1287-1: important: Security update for Linux Kernel Live Patch 18 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 18 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1287-1 Rating: important References: #1030575 #1031660 Cross-References: CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for the Linux Kernel 3.12.60-52_63 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-765=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-765=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_63-default-5-2.1 kgraft-patch-3_12_60-52_63-xen-5-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_63-default-5-2.1 kgraft-patch-3_12_60-52_63-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1283-1: important: Security update for Linux Kernel Live Patch 5 for SLE 12 SP2
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 5 for SLE 12 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1283-1 Rating: important References: #1030575 #1031440 #1031481 #1031660 Cross-References: CVE-2017-7294 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.49-92_11 fixes several issues. The following security bugs were fixed: - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bsc#1031440, bsc#1031481). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-769=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_11-default-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031481 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1281-1: important: Security update for Linux Kernel Live Patch 20 for SLE 12
by opensuse-security＠opensuse.org 15 May '17

15 May '17

SUSE Security Update: Security update for Linux Kernel Live Patch 20 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1281-1 Rating: important References: #1025013 #1030575 #1031660 Cross-References: CVE-2017-5970 CVE-2017-7308 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update the for Linux Kernel 3.12.61-52.69 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bsc#1030575, bsc#1031660). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-763=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-763=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_61-52_69-default-2-4.1 kgraft-patch-3_12_61-52_69-xen-2-4.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_69-default-2-4.1 kgraft-patch-3_12_61-52_69-xen-2-4.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://www.suse.com/security/cve/CVE-2017-7308.html https://bugzilla.suse.com/1025013 https://bugzilla.suse.com/1030575 https://bugzilla.suse.com/1031660 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0