January 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:0084-1: important: Security update for jasper
by opensuse-security＠opensuse.org 08 Jan '17

08 Jan '17

SUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0084-1 Rating: important References: #1010977 #1010979 #1011830 #1012530 #1015993 Cross-References: CVE-2016-8654 CVE-2016-9395 CVE-2016-9398 CVE-2016-9560 CVE-2016-9591 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for jasper fixes the following issues: - CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec. (bsc#1012530) - CVE-2016-9395: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010977) - CVE-2016-9398: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010979) - CVE-2016-9560: Stack-based buffer overflow in jpc_tsfb_getbands2. (bsc#1011830) - CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy. (bsc#1015993) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-27=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-27=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-27=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-27=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-27=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-27=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-27=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper-devel-1.900.14-184.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper-devel-1.900.14-184.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 References: https://www.suse.com/security/cve/CVE-2016-8654.html https://www.suse.com/security/cve/CVE-2016-9395.html https://www.suse.com/security/cve/CVE-2016-9398.html https://www.suse.com/security/cve/CVE-2016-9560.html https://www.suse.com/security/cve/CVE-2016-9591.html https://bugzilla.suse.com/1010977 https://bugzilla.suse.com/1010979 https://bugzilla.suse.com/1011830 https://bugzilla.suse.com/1012530 https://bugzilla.suse.com/1015993 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0071-1: important: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 08 Jan '17

08 Jan '17

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0071-1 Rating: important References: #1012102 #1012103 #1012104 #1013653 #1013655 #1013663 Cross-References: CVE-2016-9634 CVE-2016-9635 CVE-2016-9636 CVE-2016-9807 CVE-2016-9808 CVE-2016-9810 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following security issues: - CVE-2016-9807: Flic decoder invalid read could lead to crash. (bsc#1013655) - CVE-2016-9634: Flic out-of-bounds write could lead to code execution. (bsc#1012102) - CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012103) - CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012104) - CVE-2016-9808: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013653) - CVE-2016-9810: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013663) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-65=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gstreamer-plugins-good-1.8.3-3.1 gstreamer-plugins-good-debuginfo-1.8.3-3.1 gstreamer-plugins-good-debugsource-1.8.3-3.1 gstreamer-plugins-good-doc-1.8.3-3.1 gstreamer-plugins-good-extra-1.8.3-3.1 gstreamer-plugins-good-extra-debuginfo-1.8.3-3.1 - openSUSE Leap 42.2 (x86_64): gstreamer-plugins-good-32bit-1.8.3-3.1 gstreamer-plugins-good-debuginfo-32bit-1.8.3-3.1 gstreamer-plugins-good-extra-32bit-1.8.3-3.1 gstreamer-plugins-good-extra-debuginfo-32bit-1.8.3-3.1 - openSUSE Leap 42.2 (noarch): gstreamer-plugins-good-lang-1.8.3-3.1 References: https://www.suse.com/security/cve/CVE-2016-9634.html https://www.suse.com/security/cve/CVE-2016-9635.html https://www.suse.com/security/cve/CVE-2016-9636.html https://www.suse.com/security/cve/CVE-2016-9807.html https://www.suse.com/security/cve/CVE-2016-9808.html https://www.suse.com/security/cve/CVE-2016-9810.html https://bugzilla.suse.com/1012102 https://bugzilla.suse.com/1012103 https://bugzilla.suse.com/1012104 https://bugzilla.suse.com/1013653 https://bugzilla.suse.com/1013655 https://bugzilla.suse.com/1013663 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0023-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 04 Jan '17

04 Jan '17

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0023-1 Rating: important References: #1009318 #1011130 #1011136 #1013376 #1014159 Cross-References: CVE-2014-9848 CVE-2016-8707 CVE-2016-8866 CVE-2016-9556 CVE-2016-9559 CVE-2016-9773 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: * CVE-2016-9556 Possible Heap-overflow found by fuzzing [bsc#1011130] * CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136] * CVE-2016-8707 Possible code execution in Tiff conver utility [bsc#1014159] * CVE-2016-8866 Memory allocation failure in AcquireMagickMemory could lead to Heap overflow [bsc#1009318] * CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-14=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 ImageMagick-devel-6.8.8.1-25.1 ImageMagick-extra-6.8.8.1-25.1 ImageMagick-extra-debuginfo-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagick++-devel-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 perl-PerlMagick-6.8.8.1-25.1 perl-PerlMagick-debuginfo-6.8.8.1-25.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-25.1 libMagick++-6_Q16-3-32bit-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-25.1 libMagick++-devel-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-25.1 - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-27.1 ImageMagick-debuginfo-6.8.8.1-27.1 ImageMagick-debugsource-6.8.8.1-27.1 ImageMagick-devel-6.8.8.1-27.1 ImageMagick-extra-6.8.8.1-27.1 ImageMagick-extra-debuginfo-6.8.8.1-27.1 libMagick++-6_Q16-3-6.8.8.1-27.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-27.1 libMagick++-devel-6.8.8.1-27.1 libMagickCore-6_Q16-1-6.8.8.1-27.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-27.1 libMagickWand-6_Q16-1-6.8.8.1-27.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-27.1 perl-PerlMagick-6.8.8.1-27.1 perl-PerlMagick-debuginfo-6.8.8.1-27.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-27.1 libMagick++-6_Q16-3-32bit-6.8.8.1-27.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-27.1 libMagick++-devel-32bit-6.8.8.1-27.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-27.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-27.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-27.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-27.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-27.1 References: https://www.suse.com/security/cve/CVE-2014-9848.html https://www.suse.com/security/cve/CVE-2016-8707.html https://www.suse.com/security/cve/CVE-2016-8866.html https://www.suse.com/security/cve/CVE-2016-9556.html https://www.suse.com/security/cve/CVE-2016-9559.html https://www.suse.com/security/cve/CVE-2016-9773.html https://bugzilla.suse.com/1009318 https://bugzilla.suse.com/1011130 https://bugzilla.suse.com/1011136 https://bugzilla.suse.com/1013376 https://bugzilla.suse.com/1014159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0022-1: important: Security update for libgme
by opensuse-security＠opensuse.org 04 Jan '17

04 Jan '17

openSUSE Security Update: Security update for libgme ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0022-1 Rating: important References: #1015941 Cross-References: CVE-2016-9957 CVE-2016-9958 CVE-2016-9959 CVE-2016-9960 CVE-2016-9961 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgme fixes the following issues: - CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961: Various issues were fixed in the handling of SPC music files that could have been exploited for gaining privileges of desktop users. [bsc#1015941] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-13=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-13=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libgme-debugsource-0.6.0-8.1 libgme-devel-0.6.0-8.1 libgme0-0.6.0-8.1 libgme0-debuginfo-0.6.0-8.1 - openSUSE Leap 42.2 (x86_64): libgme0-32bit-0.6.0-8.1 libgme0-debuginfo-32bit-0.6.0-8.1 - openSUSE Leap 42.1 (i586 x86_64): libgme-debugsource-0.6.0-7.1 libgme-devel-0.6.0-7.1 libgme0-0.6.0-7.1 libgme0-debuginfo-0.6.0-7.1 - openSUSE Leap 42.1 (x86_64): libgme0-32bit-0.6.0-7.1 libgme0-debuginfo-32bit-0.6.0-7.1 References: https://www.suse.com/security/cve/CVE-2016-9957.html https://www.suse.com/security/cve/CVE-2016-9958.html https://www.suse.com/security/cve/CVE-2016-9959.html https://www.suse.com/security/cve/CVE-2016-9960.html https://www.suse.com/security/cve/CVE-2016-9961.html https://bugzilla.suse.com/1015941 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0016-1: important: Security update for dnsmasq
by opensuse-security＠opensuse.org 03 Jan '17

03 Jan '17

openSUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0016-1 Rating: important References: #983273 Cross-References: CVE-2015-8899 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dnsmasq fixes the following issues: - CVE-2015-8899: Denial of service between local and remote dns entries (bsc#983273) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-10=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-10=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dnsmasq-2.71-8.1 dnsmasq-debuginfo-2.71-8.1 dnsmasq-debugsource-2.71-8.1 dnsmasq-utils-2.71-8.1 dnsmasq-utils-debuginfo-2.71-8.1 - openSUSE Leap 42.1 (i586 x86_64): dnsmasq-2.71-9.1 dnsmasq-debuginfo-2.71-9.1 dnsmasq-debugsource-2.71-9.1 dnsmasq-utils-2.71-9.1 dnsmasq-utils-debuginfo-2.71-9.1 References: https://www.suse.com/security/cve/CVE-2015-8899.html https://bugzilla.suse.com/983273 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0008-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0008-1 Rating: important References: #1000106 #1000195 #1002496 #1003030 #1003032 #1004016 #1005004 #1005005 #1007157 #1007160 #1009100 #1009103 #1009104 #1009107 #1009109 #1009111 #1011652 #1012651 #1014298 #1016340 #953518 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-8576 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9385 CVE-2016-9386 CVE-2016-9637 CVE-2016-9932 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has two fixes is now available. Description: This updates xen to version 4.4.4_06 to fix the following issues: - An unprivileged user in a guest could gain guest could escalate privilege to that of the guest kernel, if it had could invoke the instruction emulator. Only 64-bit x86 HVM guest were affected. Linux guest have not been vulnerable. (boo#1016340, CVE-2016-10013) - An unprivileged user in a 64 bit x86 guest could gain information from the host, crash the host or gain privilege of the host (boo#1009107, CVE-2016-9383) - An unprivileged guest process could (unintentionally or maliciously) obtain or ocorrupt sensitive information of other programs in the same guest. Only x86 HVM guests have been affected. The attacker needs to be able to trigger the Xen instruction emulator. (boo#1000106, CVE-2016-7777) - A guest on x86 systems could read small parts of hypervisor stack data (boo#1012651, CVE-2016-9932) - A malicious guest kernel could hang or crash the host system (boo#1014298, CVE-2016-10024) - A malicious guest administrator could escalate their privilege to that of the host. Only affects x86 HVM guests using qemu older version 1.6.0 or using the qemu-xen-traditional. (boo#1011652, CVE-2016-9637) - An unprivileged guest user could escalate privilege to that of the guest administrator on x86 HVM guests, especially on Intel CPUs (boo#1009100, CVE-2016-9386) - An unprivileged guest user could escalate privilege to that of the guest administrator (on AMD CPUs) or crash the system (on Intel CPUs) on 32-bit x86 HVM guests. Only guest operating systems that allowed a new task to start in VM86 mode were affected. (boo#1009103, CVE-2016-9382) - A malicious guest administrator could crash the host on x86 PV guests only (boo#1009104, CVE-2016-9385) - A malicious guest administrator could get privilege of the host emulator process on x86 HVM guests. (boo#1009109, CVE-2016-9381) - A vulnerability in pygrub allowed a malicious guest administrator to obtain the contents of sensitive host files, or even delete those files (boo#1009111, CVE-2016-9379, CVE-2016-9380) - A privileged guest user could cause an infinite loop in the RTL8139 ethernet emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007157, CVE-2016-8910) - A privileged guest user could cause an infinite loop in the intel-hda sound emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007160, CVE-2016-8909) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero vulnerability of the JAZZ RC4030 chipset emulation (boo#1005004 CVE-2016-8667) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero issue of the 16550A UART emulation (boo#1005005, CVE-2016-8669) - A privileged guest user could cause an infinite loop in the USB xHCI emulation, causing a DoS situation on the host (boo#1004016, CVE-2016-8576) - A privileged guest user could cause an infinite loop in the ColdFire Fash Ethernet Controller emulation, causing a DoS situation on the host (boo#1003030, CVE-2016-7908) - A privileged guest user could cause an infinite loop in the AMD PC-Net II emulation, causing a DoS situation on the host (boo#1003032, CVE-2016-7909) - Cause a reload of clvm in the block-dmmd script to avoid a blocking lvchange call (boo#1002496) - Also unplug SCSI disks in qemu-xen-traditional for upstream unplug protocol. Before a single SCSI storage devices added to HVM guests could appear multiple times in the guest. (boo#953518) - Fix a kernel panic / black screen when trying to boot a XEN kernel on some UEFI firmwares (boo#1000195) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2017-5=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.4_06-58.1 xen-devel-4.4.4_06-58.1 xen-libs-4.4.4_06-58.1 xen-libs-debuginfo-4.4.4_06-58.1 xen-tools-domU-4.4.4_06-58.1 xen-tools-domU-debuginfo-4.4.4_06-58.1 - openSUSE 13.2 (x86_64): xen-4.4.4_06-58.1 xen-doc-html-4.4.4_06-58.1 xen-kmp-default-4.4.4_06_k3.16.7_53-58.1 xen-kmp-default-debuginfo-4.4.4_06_k3.16.7_53-58.1 xen-kmp-desktop-4.4.4_06_k3.16.7_53-58.1 xen-kmp-desktop-debuginfo-4.4.4_06_k3.16.7_53-58.1 xen-libs-32bit-4.4.4_06-58.1 xen-libs-debuginfo-32bit-4.4.4_06-58.1 xen-tools-4.4.4_06-58.1 xen-tools-debuginfo-4.4.4_06-58.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-7777.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9379.html https://www.suse.com/security/cve/CVE-2016-9380.html https://www.suse.com/security/cve/CVE-2016-9381.html https://www.suse.com/security/cve/CVE-2016-9382.html https://www.suse.com/security/cve/CVE-2016-9383.html https://www.suse.com/security/cve/CVE-2016-9385.html https://www.suse.com/security/cve/CVE-2016-9386.html https://www.suse.com/security/cve/CVE-2016-9637.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1000106 https://bugzilla.suse.com/1000195 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1003030 https://bugzilla.suse.com/1003032 https://bugzilla.suse.com/1004016 https://bugzilla.suse.com/1005004 https://bugzilla.suse.com/1005005 https://bugzilla.suse.com/1007157 https://bugzilla.suse.com/1007160 https://bugzilla.suse.com/1009100 https://bugzilla.suse.com/1009103 https://bugzilla.suse.com/1009104 https://bugzilla.suse.com/1009107 https://bugzilla.suse.com/1009109 https://bugzilla.suse.com/1009111 https://bugzilla.suse.com/1011652 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 https://bugzilla.suse.com/953518 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0007-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0007-1 Rating: important References: #1000106 #1002496 #1003030 #1003032 #1003870 #1004016 #1005004 #1005005 #1007157 #1007160 #1009100 #1009103 #1009104 #1009107 #1009108 #1009109 #1009111 #1011652 #1012651 #1013657 #1013668 #1014298 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-7995 CVE-2016-8576 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9377 CVE-2016-9378 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9385 CVE-2016-9386 CVE-2016-9637 CVE-2016-9776 CVE-2016-9932 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This updates xen to version 4.5.5 to fix the following issues: - An unprivileged user in a guest could gain guest could escalate privilege to that of the guest kernel, if it had could invoke the instruction emulator. Only 64-bit x86 HVM guest were affected. Linux guest have not been vulnerable. (boo#1016340, CVE-2016-10013) - An unprivileged user in a 64 bit x86 guest could gain information from the host, crash the host or gain privilege of the host (boo#1009107, CVE-2016-9383) - An unprivileged guest process could (unintentionally or maliciously) obtain or ocorrupt sensitive information of other programs in the same guest. Only x86 HVM guests have been affected. The attacker needs to be able to trigger the Xen instruction emulator. (boo#1000106, CVE-2016-7777) - A guest on x86 systems could read small parts of hypervisor stack data (boo#1012651, CVE-2016-9932) - A malicious guest kernel could hang or crash the host system (boo#1014298, CVE-2016-10024) - The epro100 emulated network device caused a memory leak in the host when unplugged in the guest. A privileged user in the guest could use this to cause a DoS on the host or potentially crash the guest process on the host (boo#1013668, CVE-2016-9101) - The ColdFire Fast Ethernet Controller was vulnerable to an infinite loop that could be trigged by a privileged user in the guest, leading to DoS (boo#1013657, CVE-2016-9776) - A malicious guest administrator could escalate their privilege to that of the host. Only affects x86 HVM guests using qemu older version 1.6.0 or using the qemu-xen-traditional. (boo#1011652, CVE-2016-9637) - An unprivileged guest user could escalate privilege to that of the guest administrator on x86 HVM guests, especially on Intel CPUs (boo#1009100, CVE-2016-9386) - An unprivileged guest user could escalate privilege to that of the guest administrator (on AMD CPUs) or crash the system (on Intel CPUs) on 32-bit x86 HVM guests. Only guest operating systems that allowed a new task to start in VM86 mode were affected. (boo#1009103, CVE-2016-9382) - A malicious guest administrator could crash the host on x86 PV guests only (boo#1009104, CVE-2016-9385) - An unprivileged guest user was able to crash the guest. (boo#1009108, CVE-2016-9377, CVE-2016-9378) - A malicious guest administrator could get privilege of the host emulator process on x86 HVM guests. (boo#1009109, CVE-2016-9381) - A vulnerability in pygrub allowed a malicious guest administrator to obtain the contents of sensitive host files, or even delete those files (boo#1009111, CVE-2016-9379, CVE-2016-9380) - A privileged guest user could cause an infinite loop in the RTL8139 ethernet emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007157, CVE-2016-8910) - A privileged guest user could cause an infinite loop in the intel-hda sound emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007160, CVE-2016-8909) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero vulnerability of the JAZZ RC4030 chipset emulation (boo#1005004 CVE-2016-8667) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero issue of the 16550A UART emulation (boo#1005005, CVE-2016-8669) - A privileged guest user could cause a memory leak in the USB EHCI emulation, causing a DoS situation on the host (boo#1003870, CVE-2016-7995) - A privileged guest user could cause an infinite loop in the USB xHCI emulation, causing a DoS situation on the host (boo#1004016, CVE-2016-8576) - A privileged guest user could cause an infinite loop in the ColdFire Fash Ethernet Controller emulation, causing a DoS situation on the host (boo#1003030, CVE-2016-7908) - A privileged guest user could cause an infinite loop in the AMD PC-Net II emulation, causing a DoS situation on the host (boo#1003032, CVE-2016-7909) - Cause a reload of clvm in the block-dmmd script to avoid a blocking lvchange call (boo#1002496) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-4=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xen-debugsource-4.5.5_06-18.1 xen-devel-4.5.5_06-18.1 xen-libs-4.5.5_06-18.1 xen-libs-debuginfo-4.5.5_06-18.1 xen-tools-domU-4.5.5_06-18.1 xen-tools-domU-debuginfo-4.5.5_06-18.1 - openSUSE Leap 42.1 (x86_64): xen-4.5.5_06-18.1 xen-doc-html-4.5.5_06-18.1 xen-kmp-default-4.5.5_06_k4.1.36_41-18.1 xen-kmp-default-debuginfo-4.5.5_06_k4.1.36_41-18.1 xen-libs-32bit-4.5.5_06-18.1 xen-libs-debuginfo-32bit-4.5.5_06-18.1 xen-tools-4.5.5_06-18.1 xen-tools-debuginfo-4.5.5_06-18.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-7777.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-7995.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9377.html https://www.suse.com/security/cve/CVE-2016-9378.html https://www.suse.com/security/cve/CVE-2016-9379.html https://www.suse.com/security/cve/CVE-2016-9380.html https://www.suse.com/security/cve/CVE-2016-9381.html https://www.suse.com/security/cve/CVE-2016-9382.html https://www.suse.com/security/cve/CVE-2016-9383.html https://www.suse.com/security/cve/CVE-2016-9385.html https://www.suse.com/security/cve/CVE-2016-9386.html https://www.suse.com/security/cve/CVE-2016-9637.html https://www.suse.com/security/cve/CVE-2016-9776.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1000106 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1003030 https://bugzilla.suse.com/1003032 https://bugzilla.suse.com/1003870 https://bugzilla.suse.com/1004016 https://bugzilla.suse.com/1005004 https://bugzilla.suse.com/1005005 https://bugzilla.suse.com/1007157 https://bugzilla.suse.com/1007160 https://bugzilla.suse.com/1009100 https://bugzilla.suse.com/1009103 https://bugzilla.suse.com/1009104 https://bugzilla.suse.com/1009107 https://bugzilla.suse.com/1009108 https://bugzilla.suse.com/1009109 https://bugzilla.suse.com/1009111 https://bugzilla.suse.com/1011652 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1013657 https://bugzilla.suse.com/1013668 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0005-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0005-1 Rating: important References: #1012651 #1014298 #1014300 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-10025 CVE-2016-9932 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) - A missing NULL pointer check in VMFUNC emulation could lead to a hypervisor crash leading to a Denial of Servce. (XSA-203, bsc#1014300, CVE-2016-10025) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-2=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.1_04-6.1 xen-devel-4.7.1_04-6.1 xen-libs-4.7.1_04-6.1 xen-libs-debuginfo-4.7.1_04-6.1 xen-tools-domU-4.7.1_04-6.1 xen-tools-domU-debuginfo-4.7.1_04-6.1 - openSUSE Leap 42.2 (x86_64): xen-4.7.1_04-6.1 xen-doc-html-4.7.1_04-6.1 xen-libs-32bit-4.7.1_04-6.1 xen-libs-debuginfo-32bit-4.7.1_04-6.1 xen-tools-4.7.1_04-6.1 xen-tools-debuginfo-4.7.1_04-6.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-10025.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1014300 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0002-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0002-1 Rating: important References: #1013038 #1014943 Cross-References: CVE-2016-9756 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The openSUSE 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-9756: KVM: x86: drop error recovery in em_jmp_far and em_ret_far (bsc#1013038). The following non-security bugs were fixed: - scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression (bsc#1014943). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-1=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.36-44.1 kernel-default-base-4.1.36-44.1 kernel-default-base-debuginfo-4.1.36-44.1 kernel-default-debuginfo-4.1.36-44.1 kernel-default-debugsource-4.1.36-44.1 kernel-default-devel-4.1.36-44.1 kernel-obs-build-4.1.36-44.3 kernel-obs-build-debugsource-4.1.36-44.3 kernel-obs-qa-4.1.36-44.1 kernel-syms-4.1.36-44.1 - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.36-44.1 kernel-debug-base-4.1.36-44.1 kernel-debug-base-debuginfo-4.1.36-44.1 kernel-debug-debuginfo-4.1.36-44.1 kernel-debug-debugsource-4.1.36-44.1 kernel-debug-devel-4.1.36-44.1 kernel-debug-devel-debuginfo-4.1.36-44.1 kernel-ec2-4.1.36-44.1 kernel-ec2-base-4.1.36-44.1 kernel-ec2-base-debuginfo-4.1.36-44.1 kernel-ec2-debuginfo-4.1.36-44.1 kernel-ec2-debugsource-4.1.36-44.1 kernel-ec2-devel-4.1.36-44.1 kernel-pv-4.1.36-44.1 kernel-pv-base-4.1.36-44.1 kernel-pv-base-debuginfo-4.1.36-44.1 kernel-pv-debuginfo-4.1.36-44.1 kernel-pv-debugsource-4.1.36-44.1 kernel-pv-devel-4.1.36-44.1 kernel-vanilla-4.1.36-44.1 kernel-vanilla-debuginfo-4.1.36-44.1 kernel-vanilla-debugsource-4.1.36-44.1 kernel-vanilla-devel-4.1.36-44.1 kernel-xen-4.1.36-44.1 kernel-xen-base-4.1.36-44.1 kernel-xen-base-debuginfo-4.1.36-44.1 kernel-xen-debuginfo-4.1.36-44.1 kernel-xen-debugsource-4.1.36-44.1 kernel-xen-devel-4.1.36-44.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.36-44.1 kernel-docs-4.1.36-44.2 kernel-docs-html-4.1.36-44.2 kernel-docs-pdf-4.1.36-44.2 kernel-macros-4.1.36-44.1 kernel-source-4.1.36-44.1 kernel-source-vanilla-4.1.36-44.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.36-44.1 kernel-pae-base-4.1.36-44.1 kernel-pae-base-debuginfo-4.1.36-44.1 kernel-pae-debuginfo-4.1.36-44.1 kernel-pae-debugsource-4.1.36-44.1 kernel-pae-devel-4.1.36-44.1 References: https://www.suse.com/security/cve/CVE-2016-9756.html https://bugzilla.suse.com/1013038 https://bugzilla.suse.com/1014943 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0