March 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:0766-1: important: Security update for Linux Kernel Live Patch 18 for SLE 12
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 18 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0766-1 Rating: important References: #1025013 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.60-52_63 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-424=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-424=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_63-default-3-2.1 kgraft-patch-3_12_60-52_63-xen-3-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_63-default-3-2.1 kgraft-patch-3_12_60-52_63-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0765-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0765-1 Rating: important References: #1029822 Cross-References: CVE-2017-5428 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla Firefox was updated to 52.0.1 to fix one security issue: - CVE-2017-5428: integer overflow in createImageBitmap() (boo#1029822, MFSA 2017-08) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-368=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-368=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.0.1-57.3.1 MozillaFirefox-branding-upstream-52.0.1-57.3.1 MozillaFirefox-buildsymbols-52.0.1-57.3.1 MozillaFirefox-debuginfo-52.0.1-57.3.1 MozillaFirefox-debugsource-52.0.1-57.3.1 MozillaFirefox-devel-52.0.1-57.3.1 MozillaFirefox-translations-common-52.0.1-57.3.1 MozillaFirefox-translations-other-52.0.1-57.3.1 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-52.0.1-58.1 MozillaFirefox-branding-upstream-52.0.1-58.1 MozillaFirefox-buildsymbols-52.0.1-58.1 MozillaFirefox-debuginfo-52.0.1-58.1 MozillaFirefox-debugsource-52.0.1-58.1 MozillaFirefox-devel-52.0.1-58.1 MozillaFirefox-translations-common-52.0.1-58.1 MozillaFirefox-translations-other-52.0.1-58.1 References: https://www.suse.com/security/cve/CVE-2017-5428.html https://bugzilla.suse.com/1029822 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0764-1: important: Security update for Linux Kernel Live Patch 10 for SLE 12 SP1
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 10 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0764-1 Rating: important References: #1025013 #1025254 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for the Linux Kernel 3.12.67-60_64_21 fixes several issues. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). The following non-security bug was fixed: - Fix for a "Data miscompare on a read" which was observed during the rebuilding of degraded MDRAID VDs. (bsc#1025254) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-431=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_67-60_64_21-default-4-2.1 kgraft-patch-3_12_67-60_64_21-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 https://bugzilla.suse.com/1025254 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0763-1: important: Security update for Linux Kernel Live Patch 8 for SLE 12 SP1
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 8 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0763-1 Rating: important References: #1025013 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.62-60_64_8 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-429=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_62-60_64_8-default-6-2.1 kgraft-patch-3_12_62-60_64_8-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0762-1: important: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 5 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0762-1 Rating: important References: #1025013 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.59-60_41 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-426=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_59-60_41-default-8-2.1 kgraft-patch-3_12_59-60_41-xen-8-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0760-1: important: Security update for Linux Kernel Live Patch 7 for SLE 12 SP1
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 7 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0760-1 Rating: important References: #1025013 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.62-60_62 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-428=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_62-60_62-default-7-2.1 kgraft-patch-3_12_62-60_62-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0759-1: important: Security update for Linux Kernel Live Patch 13 for SLE 12
by opensuse-security＠opensuse.org 20 Mar '17

20 Mar '17

SUSE Security Update: Security update for Linux Kernel Live Patch 13 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0759-1 Rating: important References: #1025013 Cross-References: CVE-2017-5970 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.55-52_45 fixes one issue. The following security bug was fixed: - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1025013). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-419=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-419=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_55-52_45-default-7-2.1 kgraft-patch-3_12_55-52_45-xen-7-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_55-52_45-default-7-2.1 kgraft-patch-3_12_55-52_45-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-5970.html https://bugzilla.suse.com/1025013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Advanced discontinuation notice for openSUSE Leap 42.1
by Marcus Meissner 20 Mar '17

20 Mar '17

Hi, With the release of openSUSE Leap 42.2 the SUSE support of openSUSE Leap 42.1 will be ending in 2 months, around May 16th 2017. Please check https://en.opensuse.org/Lifetime for lifetime information. Note that the openSUSE Leap 42 class of distributions is designed to be easily upgradable within minor versions, so Leap 42.1 to Leap 42.2 update should be easy and seemless. Ciao, Marcus for the openSUSE Maintenance Team

1 0

[security-announce] openSUSE-SU-2017:0740-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0740-1 Rating: important References: #1028848 Cross-References: CVE-2017-5029 CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5033 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5038 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5042 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 57.0.2987.98 to fix security issues and bugs. The following vulnerabilities were fixed (bsc#1028848): - CVE-2017-5030: Memory corruption in V8 - CVE-2017-5031: Use after free in ANGLE - CVE-2017-5032: Out of bounds write in PDFium - CVE-2017-5029: Integer overflow in libxslt - CVE-2017-5034: Use after free in PDFium - CVE-2017-5035: Incorrect security UI in Omnibox - CVE-2017-5036: Use after free in PDFium - CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer - CVE-2017-5039: Use after free in PDFium - CVE-2017-5040: Information disclosure in V8 - CVE-2017-5041: Address spoofing in Omnibox - CVE-2017-5033: Bypass of Content Security Policy in Blink - CVE-2017-5042: Incorrect handling of cookies in Cast - CVE-2017-5038: Use after free in GuestView - CVE-2017-5043: Use after free in GuestView - CVE-2017-5044: Heap overflow in Skia - CVE-2017-5045: Information disclosure in XSS Auditor - CVE-2017-5046: Information disclosure in Blink The following non-security changes are included: - Address broken rendering on non-intel cards Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-353=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-57.0.2987.98-8.1 chromedriver-debuginfo-57.0.2987.98-8.1 chromium-57.0.2987.98-8.1 chromium-debuginfo-57.0.2987.98-8.1 chromium-debugsource-57.0.2987.98-8.1 References: https://www.suse.com/security/cve/CVE-2017-5029.html https://www.suse.com/security/cve/CVE-2017-5030.html https://www.suse.com/security/cve/CVE-2017-5031.html https://www.suse.com/security/cve/CVE-2017-5032.html https://www.suse.com/security/cve/CVE-2017-5033.html https://www.suse.com/security/cve/CVE-2017-5034.html https://www.suse.com/security/cve/CVE-2017-5035.html https://www.suse.com/security/cve/CVE-2017-5036.html https://www.suse.com/security/cve/CVE-2017-5037.html https://www.suse.com/security/cve/CVE-2017-5038.html https://www.suse.com/security/cve/CVE-2017-5039.html https://www.suse.com/security/cve/CVE-2017-5040.html https://www.suse.com/security/cve/CVE-2017-5041.html https://www.suse.com/security/cve/CVE-2017-5042.html https://www.suse.com/security/cve/CVE-2017-5043.html https://www.suse.com/security/cve/CVE-2017-5044.html https://www.suse.com/security/cve/CVE-2017-5045.html https://www.suse.com/security/cve/CVE-2017-5046.html https://bugzilla.suse.com/1028848 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0738-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0738-1 Rating: important References: #1028848 Cross-References: CVE-2017-5029 CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5033 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5038 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5042 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 57.0.2987.98 to fix security issues and bugs. The following vulnerabilities were fixed (bsc#1028848): - CVE-2017-5030: Memory corruption in V8 - CVE-2017-5031: Use after free in ANGLE - CVE-2017-5032: Out of bounds write in PDFium - CVE-2017-5029: Integer overflow in libxslt - CVE-2017-5034: Use after free in PDFium - CVE-2017-5035: Incorrect security UI in Omnibox - CVE-2017-5036: Use after free in PDFium - CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer - CVE-2017-5039: Use after free in PDFium - CVE-2017-5040: Information disclosure in V8 - CVE-2017-5041: Address spoofing in Omnibox - CVE-2017-5033: Bypass of Content Security Policy in Blink - CVE-2017-5042: Incorrect handling of cookies in Cast - CVE-2017-5038: Use after free in GuestView - CVE-2017-5043: Use after free in GuestView - CVE-2017-5044: Heap overflow in Skia - CVE-2017-5045: Information disclosure in XSS Auditor - CVE-2017-5046: Information disclosure in Blink The following non-security changes are included: - Address broken rendering on non-intel cards Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-353=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-353=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-57.0.2987.98-105.2 chromedriver-debuginfo-57.0.2987.98-105.2 chromium-57.0.2987.98-105.2 chromium-debuginfo-57.0.2987.98-105.2 chromium-debugsource-57.0.2987.98-105.2 - openSUSE Leap 42.1 (x86_64): chromedriver-57.0.2987.98-105.2 chromedriver-debuginfo-57.0.2987.98-105.2 chromium-57.0.2987.98-105.2 chromium-debuginfo-57.0.2987.98-105.2 chromium-debugsource-57.0.2987.98-105.2 References: https://www.suse.com/security/cve/CVE-2017-5029.html https://www.suse.com/security/cve/CVE-2017-5030.html https://www.suse.com/security/cve/CVE-2017-5031.html https://www.suse.com/security/cve/CVE-2017-5032.html https://www.suse.com/security/cve/CVE-2017-5033.html https://www.suse.com/security/cve/CVE-2017-5034.html https://www.suse.com/security/cve/CVE-2017-5035.html https://www.suse.com/security/cve/CVE-2017-5036.html https://www.suse.com/security/cve/CVE-2017-5037.html https://www.suse.com/security/cve/CVE-2017-5038.html https://www.suse.com/security/cve/CVE-2017-5039.html https://www.suse.com/security/cve/CVE-2017-5040.html https://www.suse.com/security/cve/CVE-2017-5041.html https://www.suse.com/security/cve/CVE-2017-5042.html https://www.suse.com/security/cve/CVE-2017-5043.html https://www.suse.com/security/cve/CVE-2017-5044.html https://www.suse.com/security/cve/CVE-2017-5045.html https://www.suse.com/security/cve/CVE-2017-5046.html https://bugzilla.suse.com/1028848 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0