June 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:1745-1: important: Security update for unrar
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for unrar ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1745-1 Rating: important References: #1045315 Cross-References: CVE-2012-6706 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for unrar fixes the following issues: - CVE-2012-6706: decoding malicious RAR files could have lead to memory corruption or code execution. (bsc#1045315). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1085=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1085=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1085=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1085=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1085=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1085=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libunrar-devel-5.0.14-3.1 libunrar5_0_14-5.0.14-3.1 libunrar5_0_14-debuginfo-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1045315 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1744-1: important: Security update for python-pycrypto
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for python-pycrypto ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1744-1 Rating: important References: #1017420 Cross-References: CVE-2013-7459 Affected Products: SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pycrypto fixes the following issues: - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS: zypper in -t patch slesctsp4-python-pycrypto-13187=1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS: zypper in -t patch slesctsp3-python-pycrypto-13187=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): python-pycrypto-2.6.1-5.1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): python-pycrypto-2.6.1-5.1 References: https://www.suse.com/security/cve/CVE-2013-7459.html https://bugzilla.suse.com/1017420 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1742-1: important: Security update for xen
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1742-1 Rating: important References: #1027519 #1035642 #1037243 #1042160 #1042882 #1042893 #1042915 #1042923 #1042924 #1042931 #1042938 Cross-References: CVE-2017-8309 CVE-2017-9330 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 9 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Missing NULL pointer check in event channel poll allows guests to DoS the host (XSA-221, bsc#1042924) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) - PKRU and BND* leakage between vCPU-s might have leaked information to other guests (XSA-220, bsc#1042923) These non-security issues were fixed: - bsc#1027519: Included various upstream patches - bsc#1035642: Ensure that rpmbuild works Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1087=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1087=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1087=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.2_06-42.1 xen-devel-4.7.2_06-42.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.2_06-42.1 xen-debugsource-4.7.2_06-42.1 xen-doc-html-4.7.2_06-42.1 xen-libs-32bit-4.7.2_06-42.1 xen-libs-4.7.2_06-42.1 xen-libs-debuginfo-32bit-4.7.2_06-42.1 xen-libs-debuginfo-4.7.2_06-42.1 xen-tools-4.7.2_06-42.1 xen-tools-debuginfo-4.7.2_06-42.1 xen-tools-domU-4.7.2_06-42.1 xen-tools-domU-debuginfo-4.7.2_06-42.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.2_06-42.1 xen-debugsource-4.7.2_06-42.1 xen-libs-32bit-4.7.2_06-42.1 xen-libs-4.7.2_06-42.1 xen-libs-debuginfo-32bit-4.7.2_06-42.1 xen-libs-debuginfo-4.7.2_06-42.1 References: https://www.suse.com/security/cve/CVE-2017-8309.html https://www.suse.com/security/cve/CVE-2017-9330.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1035642 https://bugzilla.suse.com/1037243 https://bugzilla.suse.com/1042160 https://bugzilla.suse.com/1042882 https://bugzilla.suse.com/1042893 https://bugzilla.suse.com/1042915 https://bugzilla.suse.com/1042923 https://bugzilla.suse.com/1042924 https://bugzilla.suse.com/1042931 https://bugzilla.suse.com/1042938 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1738-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1738-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1078=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1078=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): bind-doc-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): bind-9.9.9P1-28.37.1 bind-chrootenv-9.9.9P1-28.37.1 bind-debuginfo-9.9.9P1-28.37.1 bind-debugsource-9.9.9P1-28.37.1 bind-devel-9.9.9P1-28.37.1 bind-libs-32bit-9.9.9P1-28.37.1 bind-libs-9.9.9P1-28.37.1 bind-libs-debuginfo-32bit-9.9.9P1-28.37.1 bind-libs-debuginfo-9.9.9P1-28.37.1 bind-utils-9.9.9P1-28.37.1 bind-utils-debuginfo-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-28.37.1 bind-chrootenv-9.9.9P1-28.37.1 bind-debuginfo-9.9.9P1-28.37.1 bind-debugsource-9.9.9P1-28.37.1 bind-devel-9.9.9P1-28.37.1 bind-libs-9.9.9P1-28.37.1 bind-libs-debuginfo-9.9.9P1-28.37.1 bind-utils-9.9.9P1-28.37.1 bind-utils-debuginfo-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-28.37.1 bind-libs-debuginfo-32bit-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): bind-doc-9.9.9P1-28.37.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1737-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1737-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-13185=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-13185=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-bind-13185=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-bind-13185=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-13185=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-13185=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.50.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-devel-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-devel-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.50.1 bind-debugsource-9.9.6P1-0.50.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): bind-debuginfo-9.9.6P1-0.50.1 bind-debugsource-9.9.6P1-0.50.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1736-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1736-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1080=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1080=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1080=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1080=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): bind-doc-9.9.9P1-62.1 - SUSE OpenStack Cloud 6 (x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-32bit-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-32bit-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1735-1: important: Security update for the Linux kernel
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for the Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1735-1 Rating: important References: #1045340 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Linux kernel update for SUSE Linux Enterprise 12 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1077=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1077=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-1077=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): kernel-devel-3.12.61-52.80.1 kernel-macros-3.12.61-52.80.1 kernel-source-3.12.61-52.80.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): kernel-default-3.12.61-52.80.1 kernel-default-base-3.12.61-52.80.1 kernel-default-base-debuginfo-3.12.61-52.80.1 kernel-default-debuginfo-3.12.61-52.80.1 kernel-default-debugsource-3.12.61-52.80.1 kernel-default-devel-3.12.61-52.80.1 kernel-syms-3.12.61-52.80.1 kernel-xen-3.12.61-52.80.1 kernel-xen-base-3.12.61-52.80.1 kernel-xen-base-debuginfo-3.12.61-52.80.1 kernel-xen-debuginfo-3.12.61-52.80.1 kernel-xen-debugsource-3.12.61-52.80.1 kernel-xen-devel-3.12.61-52.80.1 kgraft-patch-3_12_61-52_80-default-1-2.1 kgraft-patch-3_12_61-52_80-xen-1-2.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.61-52.80.1 kernel-default-base-3.12.61-52.80.1 kernel-default-base-debuginfo-3.12.61-52.80.1 kernel-default-debuginfo-3.12.61-52.80.1 kernel-default-debugsource-3.12.61-52.80.1 kernel-default-devel-3.12.61-52.80.1 kernel-syms-3.12.61-52.80.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.61-52.80.1 kernel-macros-3.12.61-52.80.1 kernel-source-3.12.61-52.80.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.61-52.80.1 kernel-xen-base-3.12.61-52.80.1 kernel-xen-base-debuginfo-3.12.61-52.80.1 kernel-xen-debuginfo-3.12.61-52.80.1 kernel-xen-debugsource-3.12.61-52.80.1 kernel-xen-devel-3.12.61-52.80.1 kgraft-patch-3_12_61-52_80-default-1-2.1 kgraft-patch-3_12_61-52_80-xen-1-2.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.61-52.80.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.61-52.80.1 kernel-ec2-debuginfo-3.12.61-52.80.1 kernel-ec2-debugsource-3.12.61-52.80.1 kernel-ec2-devel-3.12.61-52.80.1 kernel-ec2-extra-3.12.61-52.80.1 kernel-ec2-extra-debuginfo-3.12.61-52.80.1 References: https://bugzilla.suse.com/1045340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1718-1: important: Security update for openvpn-openssl1
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for openvpn-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1718-1 Rating: important References: #1038709 #1038711 #1038713 #1044947 #959511 #988522 Cross-References: CVE-2017-7478 CVE-2017-7479 CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for openvpn-openssl1 fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a (quite inefficient) DoS attack on the server. [bsc#1044947, CVE-2017-7521] - The ASN1 parsing code contained a bug that could have resulted in some buffers being free()d twice, and this issue could have potentially been triggered remotely by a VPN peer. [bsc#1044947, CVE-2017-7521] - If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker between client and proxy could cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory was likely to contain the proxy password. If the proxy password had not been reused, this was unlikely to compromise the security of the OpenVPN tunnel itself. Clients who did not use the --http-proxy option with ntlm2 authentication were not affected. [bsc#1044947, CVE-2017-7520] - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] - The installed sample configuration file was updated to comply to FIPS requirements. [bsc#988522] - Remedy large latencies on the openVPN server during authentication process. [bsc#959511] - Fix potential denial-of-service attacks found during independent audits. [bsc#1038713, bsc#1038709, CVE-2017-7478, bsc#1038711, CVE-2017-7479] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openvpn-openssl1-13182=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openvpn-openssl1-2.3.2-0.9.1 openvpn-openssl1-down-root-plugin-2.3.2-0.9.1 References: https://www.suse.com/security/cve/CVE-2017-7478.html https://www.suse.com/security/cve/CVE-2017-7479.html https://www.suse.com/security/cve/CVE-2017-7508.html https://www.suse.com/security/cve/CVE-2017-7520.html https://www.suse.com/security/cve/CVE-2017-7521.html https://bugzilla.suse.com/1038709 https://bugzilla.suse.com/1038711 https://bugzilla.suse.com/1038713 https://bugzilla.suse.com/1044947 https://bugzilla.suse.com/959511 https://bugzilla.suse.com/988522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1716-1: important: Security update for clamav
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1716-1 Rating: important References: #1040662 #1045490 Cross-References: CVE-2012-6706 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490) Non security issues fixed: - Provide and obsolete clamav-nodb to trigger its removal in openSUSE Leap. (bsc#1040662) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1069=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1069=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1069=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1069=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1069=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1069=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1069=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1040662 https://bugzilla.suse.com/1045490 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1715-1: important: Security update for xen
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1715-1 Rating: important References: #1034845 #1037243 #1042160 #1042863 #1042882 #1042893 #1042915 #1042931 #1042938 Cross-References: CVE-2017-8309 CVE-2017-8905 CVE-2017-9330 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for xen fixes the following security issues: - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests (XSA-216, bsc#1042863) - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) - CVE-2017-8905: Xen a failsafe callback, which might have allowed PV guest OS users to execute arbitrary code on the host OS (XSA-215, bsc#1034845). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13181=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13181=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13181=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.102-44.1 xen-libs-4.2.5_21-44.1 xen-tools-domU-4.2.5_21-44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-44.1 xen-doc-html-4.2.5_21-44.1 xen-doc-pdf-4.2.5_21-44.1 xen-libs-32bit-4.2.5_21-44.1 xen-tools-4.2.5_21-44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.102-44.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.102-44.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.102-44.1 xen-libs-4.2.5_21-44.1 xen-tools-domU-4.2.5_21-44.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-44.1 xen-debugsource-4.2.5_21-44.1 References: https://www.suse.com/security/cve/CVE-2017-8309.html https://www.suse.com/security/cve/CVE-2017-8905.html https://www.suse.com/security/cve/CVE-2017-9330.html https://bugzilla.suse.com/1034845 https://bugzilla.suse.com/1037243 https://bugzilla.suse.com/1042160 https://bugzilla.suse.com/1042863 https://bugzilla.suse.com/1042882 https://bugzilla.suse.com/1042893 https://bugzilla.suse.com/1042915 https://bugzilla.suse.com/1042931 https://bugzilla.suse.com/1042938 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1709-1: important: Security update for php53
by opensuse-security＠opensuse.org 28 Jun '17

28 Jun '17

SUSE Security Update: Security update for php53 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1709-1 Rating: important References: #1031246 #1044976 Cross-References: CVE-2017-7272 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for php53 fixes the following issues: - The fix for CVE-2017-7272 was reverted, as it caused regressions in the mysql server connect module. [bsc#1044976] The security fix tried to avoid a server side request forgery, and will be submitted when a better fix becomes available. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-13179=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-php53-13179=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-php53-13179=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-111.2 php53-imap-5.3.17-111.2 php53-posix-5.3.17-111.2 php53-readline-5.3.17-111.2 php53-sockets-5.3.17-111.2 php53-sqlite-5.3.17-111.2 php53-tidy-5.3.17-111.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-111.2 php53-5.3.17-111.2 php53-bcmath-5.3.17-111.2 php53-bz2-5.3.17-111.2 php53-calendar-5.3.17-111.2 php53-ctype-5.3.17-111.2 php53-curl-5.3.17-111.2 php53-dba-5.3.17-111.2 php53-dom-5.3.17-111.2 php53-exif-5.3.17-111.2 php53-fastcgi-5.3.17-111.2 php53-fileinfo-5.3.17-111.2 php53-ftp-5.3.17-111.2 php53-gd-5.3.17-111.2 php53-gettext-5.3.17-111.2 php53-gmp-5.3.17-111.2 php53-iconv-5.3.17-111.2 php53-intl-5.3.17-111.2 php53-json-5.3.17-111.2 php53-ldap-5.3.17-111.2 php53-mbstring-5.3.17-111.2 php53-mcrypt-5.3.17-111.2 php53-mysql-5.3.17-111.2 php53-odbc-5.3.17-111.2 php53-openssl-5.3.17-111.2 php53-pcntl-5.3.17-111.2 php53-pdo-5.3.17-111.2 php53-pear-5.3.17-111.2 php53-pgsql-5.3.17-111.2 php53-pspell-5.3.17-111.2 php53-shmop-5.3.17-111.2 php53-snmp-5.3.17-111.2 php53-soap-5.3.17-111.2 php53-suhosin-5.3.17-111.2 php53-sysvmsg-5.3.17-111.2 php53-sysvsem-5.3.17-111.2 php53-sysvshm-5.3.17-111.2 php53-tokenizer-5.3.17-111.2 php53-wddx-5.3.17-111.2 php53-xmlreader-5.3.17-111.2 php53-xmlrpc-5.3.17-111.2 php53-xmlwriter-5.3.17-111.2 php53-xsl-5.3.17-111.2 php53-zip-5.3.17-111.2 php53-zlib-5.3.17-111.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-debuginfo-5.3.17-111.2 php53-debugsource-5.3.17-111.2 References: https://www.suse.com/security/cve/CVE-2017-7272.html https://bugzilla.suse.com/1031246 https://bugzilla.suse.com/1044976 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1707-1: important: Security update for the Linux kernel
by opensuse-security＠opensuse.org 28 Jun '17

28 Jun '17

SUSE Security Update: Security update for the Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1707-1 Rating: important References: #1045340 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise High Availability 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Linux kernel update for SUSE Linux Enterprise 12 SP2 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-1058=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1058=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1058=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1058=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-1058=1 - SUSE Linux Enterprise High Availability 12-SP2: zypper in -t patch SUSE-SLE-HA-12-SP2-2017-1058=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1058=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1058=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 kernel-default-extra-4.4.59-92.24.2 kernel-default-extra-debuginfo-4.4.59-92.24.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.59-92.24.2 kernel-obs-build-debugsource-4.4.59-92.24.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): kernel-docs-4.4.59-92.24.5 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): kernel-default-4.4.59-92.24.2 kernel-default-base-4.4.59-92.24.2 kernel-default-base-debuginfo-4.4.59-92.24.2 kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 kernel-default-devel-4.4.59-92.24.2 kernel-syms-4.4.59-92.24.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): kernel-devel-4.4.59-92.24.2 kernel-macros-4.4.59-92.24.2 kernel-source-4.4.59-92.24.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): kernel-default-4.4.59-92.24.2 kernel-default-base-4.4.59-92.24.2 kernel-default-base-debuginfo-4.4.59-92.24.2 kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 kernel-default-devel-4.4.59-92.24.2 kernel-syms-4.4.59-92.24.2 - SUSE Linux Enterprise Server 12-SP2 (noarch): kernel-devel-4.4.59-92.24.2 kernel-macros-4.4.59-92.24.2 kernel-source-4.4.59-92.24.2 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_59-92_24-default-1-2.3 - SUSE Linux Enterprise High Availability 12-SP2 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.59-92.24.2 cluster-md-kmp-default-debuginfo-4.4.59-92.24.2 cluster-network-kmp-default-4.4.59-92.24.2 cluster-network-kmp-default-debuginfo-4.4.59-92.24.2 dlm-kmp-default-4.4.59-92.24.2 dlm-kmp-default-debuginfo-4.4.59-92.24.2 gfs2-kmp-default-4.4.59-92.24.2 gfs2-kmp-default-debuginfo-4.4.59-92.24.2 kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 ocfs2-kmp-default-4.4.59-92.24.2 ocfs2-kmp-default-debuginfo-4.4.59-92.24.2 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): kernel-devel-4.4.59-92.24.2 kernel-macros-4.4.59-92.24.2 kernel-source-4.4.59-92.24.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): kernel-default-4.4.59-92.24.2 kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 kernel-default-devel-4.4.59-92.24.2 kernel-default-extra-4.4.59-92.24.2 kernel-default-extra-debuginfo-4.4.59-92.24.2 kernel-syms-4.4.59-92.24.2 - OpenStack Cloud Magnum Orchestration 7 (x86_64): kernel-default-4.4.59-92.24.2 kernel-default-debuginfo-4.4.59-92.24.2 kernel-default-debugsource-4.4.59-92.24.2 References: https://bugzilla.suse.com/1045340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1706-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 27 Jun '17

27 Jun '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1706-1 Rating: important References: #1045340 #1045406 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340, bsc#1045406] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-kernel-13178=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-13178=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-kernel-13178=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-13178=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.47.105.1 kernel-default-base-3.0.101-0.47.105.1 kernel-default-devel-3.0.101-0.47.105.1 kernel-source-3.0.101-0.47.105.1 kernel-syms-3.0.101-0.47.105.1 kernel-trace-3.0.101-0.47.105.1 kernel-trace-base-3.0.101-0.47.105.1 kernel-trace-devel-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.47.105.1 kernel-ec2-base-3.0.101-0.47.105.1 kernel-ec2-devel-3.0.101-0.47.105.1 kernel-xen-3.0.101-0.47.105.1 kernel-xen-base-3.0.101-0.47.105.1 kernel-xen-devel-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): kernel-bigsmp-3.0.101-0.47.105.1 kernel-bigsmp-base-3.0.101-0.47.105.1 kernel-bigsmp-devel-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x): kernel-default-man-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): kernel-pae-3.0.101-0.47.105.1 kernel-pae-base-3.0.101-0.47.105.1 kernel-pae-devel-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.105.1 kernel-trace-extra-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.105.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.105.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): kernel-default-3.0.101-0.47.105.1 kernel-default-base-3.0.101-0.47.105.1 kernel-default-devel-3.0.101-0.47.105.1 kernel-ec2-3.0.101-0.47.105.1 kernel-ec2-base-3.0.101-0.47.105.1 kernel-ec2-devel-3.0.101-0.47.105.1 kernel-pae-3.0.101-0.47.105.1 kernel-pae-base-3.0.101-0.47.105.1 kernel-pae-devel-3.0.101-0.47.105.1 kernel-source-3.0.101-0.47.105.1 kernel-syms-3.0.101-0.47.105.1 kernel-trace-3.0.101-0.47.105.1 kernel-trace-base-3.0.101-0.47.105.1 kernel-trace-devel-3.0.101-0.47.105.1 kernel-xen-3.0.101-0.47.105.1 kernel-xen-base-3.0.101-0.47.105.1 kernel-xen-devel-3.0.101-0.47.105.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.105.1 kernel-default-debugsource-3.0.101-0.47.105.1 kernel-trace-debuginfo-3.0.101-0.47.105.1 kernel-trace-debugsource-3.0.101-0.47.105.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.105.1 kernel-ec2-debugsource-3.0.101-0.47.105.1 kernel-xen-debuginfo-3.0.101-0.47.105.1 kernel-xen-debugsource-3.0.101-0.47.105.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.105.1 kernel-bigsmp-debugsource-3.0.101-0.47.105.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.105.1 kernel-pae-debugsource-3.0.101-0.47.105.1 References: https://bugzilla.suse.com/1045340 https://bugzilla.suse.com/1045406 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1704-1: important: Security update for the Linux kernel
by opensuse-security＠opensuse.org 27 Jun '17

27 Jun '17

SUSE Security Update: Security update for the Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1704-1 Rating: important References: #1045340 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Linux kernel update for SUSE Linux Enterprise 12 SP1 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1050=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1050=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1050=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-1050=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): kernel-devel-3.12.74-60.64.48.1 kernel-macros-3.12.74-60.64.48.1 kernel-source-3.12.74-60.64.48.1 - SUSE OpenStack Cloud 6 (x86_64): kernel-default-3.12.74-60.64.48.1 kernel-default-base-3.12.74-60.64.48.1 kernel-default-base-debuginfo-3.12.74-60.64.48.1 kernel-default-debuginfo-3.12.74-60.64.48.1 kernel-default-debugsource-3.12.74-60.64.48.1 kernel-default-devel-3.12.74-60.64.48.1 kernel-syms-3.12.74-60.64.48.1 kernel-xen-3.12.74-60.64.48.1 kernel-xen-base-3.12.74-60.64.48.1 kernel-xen-base-debuginfo-3.12.74-60.64.48.1 kernel-xen-debuginfo-3.12.74-60.64.48.1 kernel-xen-debugsource-3.12.74-60.64.48.1 kernel-xen-devel-3.12.74-60.64.48.1 kgraft-patch-3_12_74-60_64_48-default-1-2.1 kgraft-patch-3_12_74-60_64_48-xen-1-2.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): kernel-default-3.12.74-60.64.48.1 kernel-default-base-3.12.74-60.64.48.1 kernel-default-base-debuginfo-3.12.74-60.64.48.1 kernel-default-debuginfo-3.12.74-60.64.48.1 kernel-default-debugsource-3.12.74-60.64.48.1 kernel-default-devel-3.12.74-60.64.48.1 kernel-syms-3.12.74-60.64.48.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): kernel-devel-3.12.74-60.64.48.1 kernel-macros-3.12.74-60.64.48.1 kernel-source-3.12.74-60.64.48.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kernel-xen-3.12.74-60.64.48.1 kernel-xen-base-3.12.74-60.64.48.1 kernel-xen-base-debuginfo-3.12.74-60.64.48.1 kernel-xen-debuginfo-3.12.74-60.64.48.1 kernel-xen-debugsource-3.12.74-60.64.48.1 kernel-xen-devel-3.12.74-60.64.48.1 kgraft-patch-3_12_74-60_64_48-default-1-2.1 kgraft-patch-3_12_74-60_64_48-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): kernel-default-3.12.74-60.64.48.1 kernel-default-base-3.12.74-60.64.48.1 kernel-default-base-debuginfo-3.12.74-60.64.48.1 kernel-default-debuginfo-3.12.74-60.64.48.1 kernel-default-debugsource-3.12.74-60.64.48.1 kernel-default-devel-3.12.74-60.64.48.1 kernel-syms-3.12.74-60.64.48.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): kernel-devel-3.12.74-60.64.48.1 kernel-macros-3.12.74-60.64.48.1 kernel-source-3.12.74-60.64.48.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kernel-xen-3.12.74-60.64.48.1 kernel-xen-base-3.12.74-60.64.48.1 kernel-xen-base-debuginfo-3.12.74-60.64.48.1 kernel-xen-debuginfo-3.12.74-60.64.48.1 kernel-xen-debugsource-3.12.74-60.64.48.1 kernel-xen-devel-3.12.74-60.64.48.1 kgraft-patch-3_12_74-60_64_48-default-1-2.1 kgraft-patch-3_12_74-60_64_48-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x): kernel-default-man-3.12.74-60.64.48.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.74-60.64.48.1 kernel-ec2-debuginfo-3.12.74-60.64.48.1 kernel-ec2-debugsource-3.12.74-60.64.48.1 kernel-ec2-devel-3.12.74-60.64.48.1 kernel-ec2-extra-3.12.74-60.64.48.1 kernel-ec2-extra-debuginfo-3.12.74-60.64.48.1 References: https://bugzilla.suse.com/1045340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1701-1: important: Security update for jakarta-taglibs-standard
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

SUSE Security Update: Security update for jakarta-taglibs-standard ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1701-1 Rating: important References: #920813 Cross-References: CVE-2015-0254 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jakarta-taglibs-standard fixes the following issues: - CVE-2015-0254: Apache Standard Taglibs allowed remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) x:parse or (2) x:transform JSTL XML tag. (bsc#920813) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-jakarta-taglibs-standard-13173=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (noarch): jakarta-taglibs-standard-1.1.1-234.31.1 jakarta-taglibs-standard-javadoc-1.1.1-234.31.1 References: https://www.suse.com/security/cve/CVE-2015-0254.html https://bugzilla.suse.com/920813 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1697-1: important: Security update for sudo
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1697-1 Rating: important References: #1034560 #1042146 Cross-References: CVE-2017-1000368 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sudo fixes the following security issue: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. (bsc#1042146) Also the following non security bug was fixed: - Link the "system_group" plugin with sudo_util library to resolve the missing sudo_dso_findsym symbol (bsc#1034560) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-744=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): sudo-1.8.10p3-9.6.1 sudo-debuginfo-1.8.10p3-9.6.1 sudo-debugsource-1.8.10p3-9.6.1 sudo-devel-1.8.10p3-9.6.1 sudo-test-1.8.10p3-9.6.1 References: https://www.suse.com/security/cve/CVE-2017-1000368.html https://bugzilla.suse.com/1034560 https://bugzilla.suse.com/1042146 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1696-1: important: Security update for kernel-source
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

SUSE Security Update: Security update for kernel-source ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1696-1 Rating: important References: #1045340 #1045406 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Linux kernel update for SUSE Linux Enterprise 11 SP4 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340, bsc#1045406] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-kernel-source-13172=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-kernel-source-13172=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-source-13172=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-kernel-source-13172=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): kernel-docs-3.0.101-107.3 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-107.1 kernel-default-base-3.0.101-107.1 kernel-default-devel-3.0.101-107.1 kernel-source-3.0.101-107.1 kernel-syms-3.0.101-107.1 kernel-trace-3.0.101-107.1 kernel-trace-base-3.0.101-107.1 kernel-trace-devel-3.0.101-107.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): kernel-ec2-3.0.101-107.1 kernel-ec2-base-3.0.101-107.1 kernel-ec2-devel-3.0.101-107.1 kernel-xen-3.0.101-107.1 kernel-xen-base-3.0.101-107.1 kernel-xen-devel-3.0.101-107.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): kernel-bigmem-3.0.101-107.1 kernel-bigmem-base-3.0.101-107.1 kernel-bigmem-devel-3.0.101-107.1 kernel-ppc64-3.0.101-107.1 kernel-ppc64-base-3.0.101-107.1 kernel-ppc64-devel-3.0.101-107.1 - SUSE Linux Enterprise Server 11-SP4 (s390x): kernel-default-man-3.0.101-107.1 - SUSE Linux Enterprise Server 11-SP4 (i586): kernel-pae-3.0.101-107.1 kernel-pae-base-3.0.101-107.1 kernel-pae-devel-3.0.101-107.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-107.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-107.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-107.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-107.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-107.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-107.1 kernel-default-debugsource-3.0.101-107.1 kernel-trace-debuginfo-3.0.101-107.1 kernel-trace-debugsource-3.0.101-107.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-107.1 kernel-trace-devel-debuginfo-3.0.101-107.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-107.1 kernel-ec2-debugsource-3.0.101-107.1 kernel-xen-debuginfo-3.0.101-107.1 kernel-xen-debugsource-3.0.101-107.1 kernel-xen-devel-debuginfo-3.0.101-107.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-107.1 kernel-bigmem-debugsource-3.0.101-107.1 kernel-ppc64-debuginfo-3.0.101-107.1 kernel-ppc64-debugsource-3.0.101-107.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-107.1 kernel-pae-debugsource-3.0.101-107.1 kernel-pae-devel-debuginfo-3.0.101-107.1 References: https://bugzilla.suse.com/1045340 https://bugzilla.suse.com/1045406 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1685-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1685-1 Rating: important References: #1015342 #1022595 #1027101 #1037669 #1039214 #1039348 #1040351 #1040364 #1040567 #1040609 #1042286 #1042863 #1043990 #1044082 #1044120 #1044767 #1044772 #1044880 #1045154 #1045235 #1045286 #1045307 #1045467 #1045568 #966170 #966172 #966191 #990682 Cross-References: CVE-2017-1000364 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has 27 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to 4.4.73 to receive security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010) (bnc#1039348). The previous fix caused some Java applications to crash and has been replaced by the upstream fix. The following non-security bugs were fixed: - md: fix a null dereference (bsc#1040351). - net/mlx5e: Fix timestamping capabilities reporting (bsc#966170, bsc#1015342) - reiserfs: don't preallocate blocks for extended attributes (bsc#990682) - ibmvnic: Fix error handling when registering long-term-mapped buffers (bsc#1045568). - Fix kabi after adding new field to struct mddev (bsc#1040351). - Fix soft lockup in svc_rdma_send (bsc#729329). - IB/addr: Fix setting source address in addr6_resolve() (bsc#1044082). - IB/ipoib: Fix memory leak in create child syscall (bsc#1022595 FATE#322350). - IB/mlx5: Assign DSCP for R-RoCE QPs Address Path (bsc#966170 bsc#966172 bsc#966191). - IB/mlx5: Check supported flow table size (bsc#966170 bsc#966172 bsc#966191). - IB/mlx5: Enlarge autogroup flow table (bsc#966170 bsc#966172 bsc#966191). - IB/mlx5: Fix kernel to user leak prevention logic (bsc#966170 bsc#966172 bsc#966191). - NFSv4: do not let hanging mounts block other mounts (bsc#1040364). - [v2, 2/3] powerpc/fadump: avoid holes in boot memory area when fadump is registered (bsc#1037669). - [v2,1/3] powerpc/fadump: avoid duplicates in crash memory ranges (bsc#1037669). - [v2,3/3] powerpc/fadump: provide a helpful error message (bsc#1037669). - dm: remove dummy dm_table definition (bsc#1045307) - ibmvnic: Activate disabled RX buffer pools on reset (bsc#1044767). - ibmvnic: Client-initiated failover (bsc#1043990). - ibmvnic: Correct return code checking for ibmvnic_init during probe (bsc#1045286). - ibmvnic: Ensure that TX queues are disabled in __ibmvnic_close (bsc#1044767). - ibmvnic: Exit polling routine correctly during adapter reset (bsc#1044767). - ibmvnic: Fix incorrectly defined ibmvnic_request_map_rsp structure (bsc#1045568). - ibmvnic: Remove VNIC_CLOSING check from pending_scrq (bsc#1044767). - ibmvnic: Remove module author mailing address (bsc#1045467). - ibmvnic: Remove netdev notify for failover resets (bsc#1044120). - ibmvnic: Return from ibmvnic_resume if not in VNIC_OPEN state (bsc#1045235). - ibmvnic: Sanitize entire SCRQ buffer on reset (bsc#1044767). - ibmvnic: driver initialization for kdump/kexec (bsc#1044772). - ipv6: release dst on error in ip6_dst_lookup_tail (git-fixes). - jump label: fix passing kbuild_cflags when checking for asm goto support (git-fixes). - kabi workaround for net: ipv6: Fix processing of RAs in presence of VRF (bsc#1042286). - lan78xx: use skb_cow_head() to deal with cloned skbs (bsc#1045154). - loop: Add PF_LESS_THROTTLE to block/loop device thread (bsc#1027101). - md: use a separate bio_set for synchronous IO (bsc#1040351). - mlx4: Fix memory leak after mlx4_en_update_priv() (bsc#966170 bsc#966172 bsc#966191). - mm: fix new crash in unmapped_area_topdown() (bnc#1039348). - net/mlx5: Do not unlock fte while still using it (bsc#966170 bsc#966172 bsc#966191). - net/mlx5: Fix create autogroup prev initializer (bsc#966170 bsc#966172 bsc#966191). - net/mlx5: Prevent setting multicast macs for VFs (bsc#966170 bsc#966172 bsc#966191). - net/mlx5: Release FTE lock in error flow (bsc#966170 bsc#966172 bsc#966191). - net/mlx5e: Modify TIRs hash only when it's needed (bsc#966170 bsc#966172 bsc#966191). - net: icmp_route_lookup should use rt dev to determine L3 domain (bsc#1042286). - net: ipv6: Fix processing of RAs in presence of VRF (bsc#1042286). - net: l3mdev: Add master device lookup by index (bsc#1042286). - net: make netdev_for_each_lower_dev safe for device removal (bsc#1042286). - net: vrf: Create FIB tables on link create (bsc#1042286). - net: vrf: Fix crash when IPv6 is disabled at boot time (bsc#1042286). - net: vrf: Fix dev refcnt leak due to IPv6 prefix route (bsc#1042286). - net: vrf: Fix dst reference counting (bsc#1042286). - net: vrf: Switch dst dev to loopback on device delete (bsc#1042286). - net: vrf: protect changes to private data with rcu (bsc#1042286). - powerpc/fadump: add reschedule point while releasing memory (bsc#1040609). - powerpc/fadump: return error when fadump registration fails (bsc#1040567). - ravb: Fix use-after-free on `ifconfig eth0 down` (git-fixes). - sctp: check af before verify address in sctp_addr_id2transport (git-fixes). - vrf: remove slave queue and private slave struct (bsc#1042286). - xen-blkback: do not leak stack data via response ring (bsc#1042863 XSA-216). - xfrm: Only add l3mdev oif to dst lookups (bsc#1042286). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-734=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.73-18.17.1 kernel-debug-base-4.4.73-18.17.1 kernel-debug-base-debuginfo-4.4.73-18.17.1 kernel-debug-debuginfo-4.4.73-18.17.1 kernel-debug-debugsource-4.4.73-18.17.1 kernel-debug-devel-4.4.73-18.17.1 kernel-debug-devel-debuginfo-4.4.73-18.17.1 kernel-default-4.4.73-18.17.1 kernel-default-base-4.4.73-18.17.1 kernel-default-base-debuginfo-4.4.73-18.17.1 kernel-default-debuginfo-4.4.73-18.17.1 kernel-default-debugsource-4.4.73-18.17.1 kernel-default-devel-4.4.73-18.17.1 kernel-obs-build-4.4.73-18.17.1 kernel-obs-build-debugsource-4.4.73-18.17.1 kernel-obs-qa-4.4.73-18.17.1 kernel-syms-4.4.73-18.17.1 kernel-vanilla-4.4.73-18.17.1 kernel-vanilla-base-4.4.73-18.17.1 kernel-vanilla-base-debuginfo-4.4.73-18.17.1 kernel-vanilla-debuginfo-4.4.73-18.17.1 kernel-vanilla-debugsource-4.4.73-18.17.1 kernel-vanilla-devel-4.4.73-18.17.1 - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.73-18.17.1 kernel-docs-4.4.73-18.17.2 kernel-docs-html-4.4.73-18.17.2 kernel-docs-pdf-4.4.73-18.17.2 kernel-macros-4.4.73-18.17.1 kernel-source-4.4.73-18.17.1 kernel-source-vanilla-4.4.73-18.17.1 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://bugzilla.suse.com/1015342 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1027101 https://bugzilla.suse.com/1037669 https://bugzilla.suse.com/1039214 https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1040351 https://bugzilla.suse.com/1040364 https://bugzilla.suse.com/1040567 https://bugzilla.suse.com/1040609 https://bugzilla.suse.com/1042286 https://bugzilla.suse.com/1042863 https://bugzilla.suse.com/1043990 https://bugzilla.suse.com/1044082 https://bugzilla.suse.com/1044120 https://bugzilla.suse.com/1044767 https://bugzilla.suse.com/1044772 https://bugzilla.suse.com/1044880 https://bugzilla.suse.com/1045154 https://bugzilla.suse.com/1045235 https://bugzilla.suse.com/1045286 https://bugzilla.suse.com/1045307 https://bugzilla.suse.com/1045467 https://bugzilla.suse.com/1045568 https://bugzilla.suse.com/966170 https://bugzilla.suse.com/966172 https://bugzilla.suse.com/966191 https://bugzilla.suse.com/990682 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1680-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1680-1 Rating: important References: #1044947 Cross-References: CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openvpn fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a (quite inefficient) DoS attack on the server. [bsc#1044947, CVE-2017-7521] - The ASN1 parsing code contained a bug that could have resulted in some buffers being free()d twice, and this issue could have potentially been triggered remotely by a VPN peer. [bsc#1044947, CVE-2017-7521] - If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker between client and proxy could cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory was likely to contain the proxy password. If the proxy password had not been reused, this was unlikely to compromise the security of the OpenVPN tunnel itself. Clients who did not use the --http-proxy option with ntlm2 authentication were not affected. [bsc#1044947, CVE-2017-7520] - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-730=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): openvpn-2.3.8-8.10.1 openvpn-auth-pam-plugin-2.3.8-8.10.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-8.10.1 openvpn-debuginfo-2.3.8-8.10.1 openvpn-debugsource-2.3.8-8.10.1 openvpn-devel-2.3.8-8.10.1 openvpn-down-root-plugin-2.3.8-8.10.1 openvpn-down-root-plugin-debuginfo-2.3.8-8.10.1 References: https://www.suse.com/security/cve/CVE-2017-7508.html https://www.suse.com/security/cve/CVE-2017-7520.html https://www.suse.com/security/cve/CVE-2017-7521.html https://bugzilla.suse.com/1044947 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1669-1: important: Security update for MozillaFirefox, MozillaFirefox-branding-SLE
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

SUSE Security Update: Security update for MozillaFirefox, MozillaFirefox-branding-SLE ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1669-1 Rating: important References: #1035082 #1043960 Cross-References: CVE-2016-10196 CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5451 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5469 CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7761 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7768 CVE-2017-7778 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 50 vulnerabilities is now available. Description: The MozillaFirefox was updated to the new ESR 52.2 release, which fixes the following issues (bsc#1043960): * MFSA 2017-16/CVE-2017-7758 Out-of-bounds read in Opus encoder * MFSA 2017-16/CVE-2017-7749 Use-after-free during docshell reloading * MFSA 2017-16/CVE-2017-7751 Use-after-free with content viewer listeners * MFSA 2017-16/CVE-2017-5472 Use-after-free using destroyed node when regenerating trees * MFSA 2017-16/CVE-2017-5470 Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 * MFSA 2017-16/CVE-2017-7752 Use-after-free with IME input * MFSA 2017-16/CVE-2017-7750 Use-after-free with track elements * MFSA 2017-16/CVE-2017-7768 32 byte arbitrary file read through Mozilla Maintenance Service * MFSA 2017-16/CVE-2017-7778 Vulnerabilities in the Graphite 2 library * MFSA 2017-16/CVE-2017-7754 Out-of-bounds read in WebGL with ImageInfo object * MFSA 2017-16/CVE-2017-7755 Privilege escalation through Firefox Installer with same directory DLL files * MFSA 2017-16/CVE-2017-7756 Use-after-free and use-after-scope logging XHR header errors * MFSA 2017-16/CVE-2017-7757 Use-after-free in IndexedDB * MFSA 2017-16/CVE-2017-7761 File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application * MFSA 2017-16/CVE-2017-7763 Mac fonts render some unicode characters as spaces * MFSA 2017-16/CVE-2017-7765 Mark of the Web bypass when saving executable files * MFSA 2017-16/CVE-2017-7764 (bmo#1364283, bmo#http://www.unicode.org/reports/tr31/tr31-26 .html#Aspirational_Use_Scripts) Domain spoofing with combination of Canadian Syllabics and other unicode blocks - update to Firefox ESR 52.1 (bsc#1035082) * MFSA 2017-12/CVE-2016-10196 Vulnerabilities in Libevent library * MFSA 2017-12/CVE-2017-5443 Out-of-bounds write during BinHex decoding * MFSA 2017-12/CVE-2017-5429 Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 * MFSA 2017-12/CVE-2017-5464 Memory corruption with accessibility and DOM manipulation * MFSA 2017-12/CVE-2017-5465 Out-of-bounds read in ConvolvePixel * MFSA 2017-12/CVE-2017-5466 Origin confusion when reloading isolated data:text/html URL * MFSA 2017-12/CVE-2017-5467 Memory corruption when drawing Skia content * MFSA 2017-12/CVE-2017-5460 Use-after-free in frame selection * MFSA 2017-12/CVE-2017-5461 Out-of-bounds write in Base64 encoding in NSS * MFSA 2017-12/CVE-2017-5448 Out-of-bounds write in ClearKeyDecryptor * MFSA 2017-12/CVE-2017-5449 Crash during bidirectional unicode manipulation with animation * MFSA 2017-12/CVE-2017-5446 Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data * MFSA 2017-12/CVE-2017-5447 Out-of-bounds read during glyph processing * MFSA 2017-12/CVE-2017-5444 Buffer overflow while parsing application/http-index-format content * MFSA 2017-12/CVE-2017-5445 Uninitialized values used while parsing application/http- index-format content * MFSA 2017-12/CVE-2017-5442 Use-after-free during style changes * MFSA 2017-12/CVE-2017-5469 Potential Buffer overflow in flex-generated code * MFSA 2017-12/CVE-2017-5440 Use-after-free in txExecutionState destructor during XSLT processing * MFSA 2017-12/CVE-2017-5441 Use-after-free with selection during scroll events * MFSA 2017-12/CVE-2017-5439 Use-after-free in nsTArray Length() during XSLT processing * MFSA 2017-12/CVE-2017-5438 Use-after-free in nsAutoPtr during XSLT processing * MFSA 2017-12/CVE-2017-5436 Out-of-bounds write with malicious font in Graphite 2 * MFSA 2017-12/CVE-2017-5435 Use-after-free during transaction processing in the editor * MFSA 2017-12/CVE-2017-5434 Use-after-free during focus handling * MFSA 2017-12/CVE-2017-5433 Use-after-free in SMIL animation functions * MFSA 2017-12/CVE-2017-5432 Use-after-free in text input selection * MFSA 2017-12/CVE-2017-5430 Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 * MFSA 2017-12/CVE-2017-5459 Buffer overflow in WebGL * MFSA 2017-12/CVE-2017-5462 DRBG flaw in NSS * MFSA 2017-12/CVE-2017-5455 Sandbox escape through internal feed reader APIs * MFSA 2017-12/CVE-2017-5454 Sandbox escape allowing file system read access through file picker * MFSA 2017-12/CVE-2017-5456 Sandbox escape allowing local file system access * MFSA 2017-12/CVE-2017-5451 Addressbar spoofing with onblur event Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1035=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1035=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1035=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1035=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1035=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1035=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1035=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1035=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1035=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Server for SAP 12 (x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-devel-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-52.2.0esr-108.3 MozillaFirefox-branding-SLE-52-31.1 MozillaFirefox-debuginfo-52.2.0esr-108.3 MozillaFirefox-debugsource-52.2.0esr-108.3 MozillaFirefox-translations-52.2.0esr-108.3 References: https://www.suse.com/security/cve/CVE-2016-10196.html https://www.suse.com/security/cve/CVE-2017-5429.html https://www.suse.com/security/cve/CVE-2017-5430.html https://www.suse.com/security/cve/CVE-2017-5432.html https://www.suse.com/security/cve/CVE-2017-5433.html https://www.suse.com/security/cve/CVE-2017-5434.html https://www.suse.com/security/cve/CVE-2017-5435.html https://www.suse.com/security/cve/CVE-2017-5436.html https://www.suse.com/security/cve/CVE-2017-5438.html https://www.suse.com/security/cve/CVE-2017-5439.html https://www.suse.com/security/cve/CVE-2017-5440.html https://www.suse.com/security/cve/CVE-2017-5441.html https://www.suse.com/security/cve/CVE-2017-5442.html https://www.suse.com/security/cve/CVE-2017-5443.html https://www.suse.com/security/cve/CVE-2017-5444.html https://www.suse.com/security/cve/CVE-2017-5445.html https://www.suse.com/security/cve/CVE-2017-5446.html https://www.suse.com/security/cve/CVE-2017-5447.html https://www.suse.com/security/cve/CVE-2017-5448.html https://www.suse.com/security/cve/CVE-2017-5449.html https://www.suse.com/security/cve/CVE-2017-5451.html https://www.suse.com/security/cve/CVE-2017-5454.html https://www.suse.com/security/cve/CVE-2017-5455.html https://www.suse.com/security/cve/CVE-2017-5456.html https://www.suse.com/security/cve/CVE-2017-5459.html https://www.suse.com/security/cve/CVE-2017-5460.html https://www.suse.com/security/cve/CVE-2017-5461.html https://www.suse.com/security/cve/CVE-2017-5462.html https://www.suse.com/security/cve/CVE-2017-5464.html https://www.suse.com/security/cve/CVE-2017-5465.html https://www.suse.com/security/cve/CVE-2017-5466.html https://www.suse.com/security/cve/CVE-2017-5467.html https://www.suse.com/security/cve/CVE-2017-5469.html https://www.suse.com/security/cve/CVE-2017-5470.html https://www.suse.com/security/cve/CVE-2017-5472.html https://www.suse.com/security/cve/CVE-2017-7749.html https://www.suse.com/security/cve/CVE-2017-7750.html https://www.suse.com/security/cve/CVE-2017-7751.html https://www.suse.com/security/cve/CVE-2017-7752.html https://www.suse.com/security/cve/CVE-2017-7754.html https://www.suse.com/security/cve/CVE-2017-7755.html https://www.suse.com/security/cve/CVE-2017-7756.html https://www.suse.com/security/cve/CVE-2017-7757.html https://www.suse.com/security/cve/CVE-2017-7758.html https://www.suse.com/security/cve/CVE-2017-7761.html https://www.suse.com/security/cve/CVE-2017-7763.html https://www.suse.com/security/cve/CVE-2017-7764.html https://www.suse.com/security/cve/CVE-2017-7765.html https://www.suse.com/security/cve/CVE-2017-7768.html https://www.suse.com/security/cve/CVE-2017-7778.html https://bugzilla.suse.com/1035082 https://bugzilla.suse.com/1043960 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1660-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 23 Jun '17

23 Jun '17

SUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1660-1 Rating: important References: #1007853 #1007854 #1007855 #1007857 #1007858 #1011805 #1011812 #1015119 #1033447 #1033448 #986359 #988489 Cross-References: CVE-2016-0762 CVE-2016-3092 CVE-2016-5018 CVE-2016-5388 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 CVE-2017-5647 CVE-2017-5648 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: Tomcat was updated to version 7.0.78, fixing various bugs and security issues. For full details see https://tomcat.apache.org/tomcat-7.0-doc/changelog.html Security issues fixed: - CVE-2016-0762: A realm timing attack in tomcat was fixed which could disclose existence of users (bsc#1007854) - CVE-2016-3092: Usage of vulnerable FileUpload package could have resulted in denial of service (bsc#986359) - CVE-2016-5018: A security manager bypass via a Tomcat utility method that was accessible to web applications was fixed. (bsc#1007855) - CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header (bsc#988489) - CVE-2016-6794: A tomcat system property disclosure was fixed. (bsc#1007857) - CVE-2016-6796: A tomcat security manager bypass via manipulation of the configuration parameters for the JSP Servlet. (bsc#1007858) - CVE-2016-6797: A tomcat unrestricted access to global resources via ResourceLinkFactory was fixed. (bsc#1007853) - CVE-2016-6816: A HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests was fixed. (bsc#1011812) - CVE-2016-8735: A Remote code execution vulnerability in JmxRemoteLifecycleListener was fixed (bsc#1011805) - CVE-2016-8745: A Tomcat Information Disclosure in the error handling of send file code for the NIO HTTP connector was fixed. (bsc#1015119) - CVE-2017-5647: A tomcat information disclosure in pipelined request processing was fixed. (bsc#1033448) - CVE-2017-5648: A tomcat information disclosure due to using incorrect facade objects was fixed (bsc#1033447) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1027=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1027=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): tomcat-7.0.78-7.13.4 tomcat-admin-webapps-7.0.78-7.13.4 tomcat-docs-webapp-7.0.78-7.13.4 tomcat-el-2_2-api-7.0.78-7.13.4 tomcat-javadoc-7.0.78-7.13.4 tomcat-jsp-2_2-api-7.0.78-7.13.4 tomcat-lib-7.0.78-7.13.4 tomcat-servlet-3_0-api-7.0.78-7.13.4 tomcat-webapps-7.0.78-7.13.4 - SUSE Linux Enterprise Server 12-LTSS (noarch): tomcat-7.0.78-7.13.4 tomcat-admin-webapps-7.0.78-7.13.4 tomcat-docs-webapp-7.0.78-7.13.4 tomcat-el-2_2-api-7.0.78-7.13.4 tomcat-javadoc-7.0.78-7.13.4 tomcat-jsp-2_2-api-7.0.78-7.13.4 tomcat-lib-7.0.78-7.13.4 tomcat-servlet-3_0-api-7.0.78-7.13.4 tomcat-webapps-7.0.78-7.13.4 References: https://www.suse.com/security/cve/CVE-2016-0762.html https://www.suse.com/security/cve/CVE-2016-3092.html https://www.suse.com/security/cve/CVE-2016-5018.html https://www.suse.com/security/cve/CVE-2016-5388.html https://www.suse.com/security/cve/CVE-2016-6794.html https://www.suse.com/security/cve/CVE-2016-6796.html https://www.suse.com/security/cve/CVE-2016-6797.html https://www.suse.com/security/cve/CVE-2016-6816.html https://www.suse.com/security/cve/CVE-2016-8735.html https://www.suse.com/security/cve/CVE-2016-8745.html https://www.suse.com/security/cve/CVE-2017-5647.html https://www.suse.com/security/cve/CVE-2017-5648.html https://bugzilla.suse.com/1007853 https://bugzilla.suse.com/1007854 https://bugzilla.suse.com/1007855 https://bugzilla.suse.com/1007857 https://bugzilla.suse.com/1007858 https://bugzilla.suse.com/1011805 https://bugzilla.suse.com/1011812 https://bugzilla.suse.com/1015119 https://bugzilla.suse.com/1033447 https://bugzilla.suse.com/1033448 https://bugzilla.suse.com/986359 https://bugzilla.suse.com/988489 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1642-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

SUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1642-1 Rating: important References: #1044947 Cross-References: CVE-2017-7508 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn fixes the following issues: - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openvpn-13166=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-openvpn-13166=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-openvpn-13166=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openvpn-13166=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openvpn-13166=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): openvpn-2.0.9-143.46.1 openvpn-auth-pam-plugin-2.0.9-143.46.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): openvpn-2.0.9-143.46.1 openvpn-auth-pam-plugin-2.0.9-143.46.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): openvpn-2.0.9-143.46.1 openvpn-auth-pam-plugin-2.0.9-143.46.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openvpn-debuginfo-2.0.9-143.46.1 openvpn-debugsource-2.0.9-143.46.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): openvpn-debuginfo-2.0.9-143.46.1 openvpn-debugsource-2.0.9-143.46.1 References: https://www.suse.com/security/cve/CVE-2017-7508.html https://bugzilla.suse.com/1044947 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1635-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

SUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1635-1 Rating: important References: #1044947 Cross-References: CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for openvpn fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a (quite inefficient) DoS attack on the server. [bsc#1044947, CVE-2017-7521] - The ASN1 parsing code contained a bug that could have resulted in some buffers being free()d twice, and this issue could have potentially been triggered remotely by a VPN peer. [bsc#1044947, CVE-2017-7521] - If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker between client and proxy could cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory was likely to contain the proxy password. If the proxy password had not been reused, this was unlikely to compromise the security of the OpenVPN tunnel itself. Clients who did not use the --http-proxy option with ntlm2 authentication were not affected. [bsc#1044947, CVE-2017-7520] - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1011=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1011=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1011=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1011=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1011=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1011=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1011=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1011=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): openvpn-2.3.8-16.17.1 openvpn-auth-pam-plugin-2.3.8-16.17.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): openvpn-2.3.8-16.17.1 openvpn-debuginfo-2.3.8-16.17.1 openvpn-debugsource-2.3.8-16.17.1 References: https://www.suse.com/security/cve/CVE-2017-7508.html https://www.suse.com/security/cve/CVE-2017-7520.html https://www.suse.com/security/cve/CVE-2017-7521.html https://bugzilla.suse.com/1044947 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1633-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1633-1 Rating: important References: #1012060 #1012382 #1012422 #1012829 #1015452 #1022595 #1031796 #1032339 #1036638 #1037840 #1038085 #1039348 #1039900 #1040855 #1041242 #1041431 #1041810 #1042286 #1042356 #1042421 #1042517 #1042535 #1042536 #1042886 #1043014 #1043231 #1043236 #1043371 #1043467 #1043598 #1043935 #1044015 #1044125 #1044532 #863764 #966321 #966339 #971975 #995542 Cross-References: CVE-2017-1000364 CVE-2017-1000380 CVE-2017-7346 CVE-2017-9242 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 35 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to 4.4.72 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010) (bnc#1039348). - CVE-2017-1000380: sound/core/timer.c in the Linux kernel is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time (bnc#1044125). - CVE-2017-7346: The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate certain levels data, which allowed local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031796). - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel is too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bnc#1041431). The following non-security bugs were fixed: - ASoC: Intel: Skylake: Uninitialized variable in probe_codec() (bsc#1043231). - IB/core: Fix kernel crash during fail to initialize device (bsc#1022595 FATE#322350). - IB/core: For multicast functions, verify that LIDs are multicast LIDs (bsc#1022595 FATE#322350). - IB/core: If the MGID/MLID pair is not on the list return an error (bsc#1022595 FATE#322350). - IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow (bsc#1022595 FATE#322350). - Make __xfs_xattr_put_listen preperly report errors (bsc#1041242). - NFS: Fix an LOCK/OPEN race when unlinking an open file (git-fixes). - NFSv4: Fix the underestimation of delegation XDR space reservation (git-fixes). - NFSv4: fix a reference leak caused WARNING messages (git-fixes). - PM / QoS: Fix memory leak on resume_latency.notifiers (bsc#1043231). - SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use (git-fixes). - SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() (git-fixes). - Update patches.fixes/xen-silence-efi-error-messge.patch (bnc#1039900). - [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' (bsc#1043231). - bcache: fix calling ida_simple_remove() with incorrect minor (bsc#1038085). - bna: add missing per queue ethtool stat (bsc#966321 FATE#320156). - bna: integer overflow bug in debugfs (bsc#966321 FATE#320156). - bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal (bsc#1042286). - bonding: do not use stale speed and duplex information (bsc#1042286). - bonding: prevent out of bound accesses (bsc#1042286). - brcmfmac: add fallback for devices that do not report per-chain values (bsc#1043231). - brcmfmac: avoid writing channel out of allocated array (bsc#1043231). - ceph: fix potential use-after-free (bsc#1043371). - ceph: memory leak in ceph_direct_read_write callback (bsc#1041810). - cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode (bsc#1012829). - cgroup: remove redundant cleanup in css_create (bsc#1012829). - cifs: small underflow in cnvrtDosUnixTm() (bnc#1043935). - drm/mgag200: Fix to always set HiPri for G200e4 (bsc#1015452, bsc#995542). - drm/nouveau/tmr: fully separate alarm execution/pending lists (bsc#1043467). - efi: Do not issue error message when booted under Xen (bnc#1036638). - ext4: fix data corruption for mmap writes (bsc#1012829). - ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO (bsc#1012829). - fuse: fix clearing suid, sgid for chown() (bsc#1012829). - ibmvnic: Check adapter state during ibmvnic_poll (fate#322021, bsc#1040855). - ibmvnic: Deactivate RX pool buffer replenishment on H_CLOSED (fate#322021, bsc#1040855). - ibmvnic: Fix cleanup of SKB's on driver close (fate#322021, bsc#1040855). - ibmvnic: Halt TX and report carrier off on H_CLOSED return code (fate#322021, bsc#1040855). - ibmvnic: Handle failover after failed init crq (fate#322021, bsc#1040855). - ibmvnic: Non-fatal error handling (fate#322021, bsc#1040855). - ibmvnic: Reset sub-crqs during driver reset (fate#322021, bsc#1040855). - ibmvnic: Reset the CRQ queue during driver reset (fate#322021, bsc#1040855). - ibmvnic: Reset tx/rx pools on driver reset (fate#322021, bsc#1040855). - ibmvnic: Return failure on attempted mtu change (bsc#1043236). - ibmvnic: Send gratuitous arp on reset (fate#322021, bsc#1040855). - ibmvnic: Track state of adapter napis (fate#322021, bsc#1040855). - ipv6: Do not use ufo handling on later transformed packets (bsc#1042286). - ipv6: fix endianness error in icmpv6_err (bsc#1042286). - kABI: protect struct fib_info (kabi). - kABI: protect struct pglist_data (kabi). - kABI: protect struct xlog (bsc#1043598). - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422) - l2tp: fix race in l2tp_recv_common() (bsc#1042286). - libceph: NULL deref on crush_decode() error path (bsc#1044015). - md: allow creation of mdNNN arrays via md_mod/parameters/new_array (bsc#1032339). - md: support disabling of create-on-open semantics (bsc#1032339). - mm/hugetlb: check for reserved hugepages during memory offline (bnc#971975 VM -- git fixes). - mm/hugetlb: fix incorrect hugepages count during mem hotplug (bnc#971975 VM -- git fixes). - mmc: Downgrade error level (bsc#1042536). - module: fix memory leak on early load_module() failures (bsc#1043014). - net: bridge: start hello timer only if device is up (bnc#1012382). - net: fix compile error in skb_orphan_partial() (bnc#1012382). - net: ipv6: set route type for anycast routes (bsc#1042286). - netfilter: nf_conntrack_sip: extend request line validation (bsc#1042286). - netfilter: nf_ct_expect: remove the redundant slash when policy name is empty (bsc#1042286). - netfilter: nf_dup_ipv6: set again FLOWI_FLAG_KNOWN_NH at flowi6_flags (bsc#1042286). - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register (bsc#1042286). - netfilter: nfnetlink_queue: reject verdict request from different portid (bsc#1042286). - netfilter: restart search if moved to other chain (bsc#1042286). - netfilter: use fwmark_reflect in nf_send_reset (bsc#1042286). - netxen_nic: set rcode to the return status from the call to netxen_issue_cmd (bsc#966339 FATE#320150). - nfs: Fix "Do not increment lock sequence ID after NFS4ERR_MOVED" (git-fixes). - nsfs: mark dentry with DCACHE_RCUACCESS (bsc#1012829). - nvme: submit nvme_admin_activate_fw to admin queue (bsc#1044532). - percpu: remove unused chunk_alloc parameter from pcpu_get_pages() (bnc#971975 VM -- git fixes). - perf/x86/intel/rapl: Make Knights Landings support functional (bsc#1042517). - powerpc/64: Fix flush_(d|i)cache_range() called from modules (bnc#863764 fate#315275, LTC#103998). - quota: fill in Q_XGETQSTAT inode information for inactive quotas (bsc#1042356). - radix-tree: fix radix_tree_iter_retry() for tagged iterators (bsc#1012829). - rpm/kernel-binary.spec: remove superfluous flags This should make build logs more readable and people adding more flags should have easier time finding a place to add them in the spec file. - rpm/kernel-spec-macros: Fix the check if there is no rebuild counter (bsc#1012060) - rtnl: reset calcit fptr in rtnl_unregister() (bsc#1042286). - series.conf: remove silly comment - tcp: account for ts offset only if tsecr not zero (bsc#1042286). - tcp: fastopen: accept data/FIN present in SYNACK message (bsc#1042286). - tcp: fastopen: avoid negative sk_forward_alloc (bsc#1042286). - tcp: fastopen: call tcp_fin() if FIN present in SYNACK (bsc#1042286). - tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data (bsc#1042286). - tpm: Downgrade error level (bsc#1042535). - udp: avoid ufo handling on IP payload compression packets (bsc#1042286). - udplite: call proper backlog handlers (bsc#1042286). - x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs (bsc#9048891). - xen/mce: do not issue error message for failed /dev/mcelog registration (bnc#1036638). - xen: add sysfs node for guest type (bnc#1037840). - xfrm: Fix memory leak of aead algorithm name (bsc#1042286). - xfs: add missing include dependencies to xfs_dir2.h (bsc#1042421). - xfs: do not warn on buffers not being recovered due to LSN (bsc#1043598). - xfs: fix xfs_mode_to_ftype() prototype (bsc#1043598). - xfs: log recovery tracepoints to track current lsn and buffer submission (bsc#1043598). - xfs: pass current lsn to log recovery buffer validation (bsc#1043598). - xfs: refactor log record unpack and data processing (bsc#1043598). - xfs: replace xfs_mode_to_ftype table with switch statement (bsc#1042421). - xfs: rework log recovery to submit buffers on LSN boundaries (bsc#1043598). - xfs: rework the inline directory verifiers (bsc#1042421). - xfs: sanity check directory inode di_size (bsc#1042421). - xfs: sanity check inode di_mode (bsc#1042421). - xfs: update metadata LSN in buffers during log recovery (bsc#1043598). - xfs: verify inline directory data forks (bsc#1042421). - zswap: do not param_set_charp while holding spinlock (VM Functionality, bsc#1042886). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-716=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.72-18.12.1 kernel-docs-4.4.72-18.12.3 kernel-docs-html-4.4.72-18.12.3 kernel-docs-pdf-4.4.72-18.12.3 kernel-macros-4.4.72-18.12.1 kernel-source-4.4.72-18.12.1 kernel-source-vanilla-4.4.72-18.12.1 - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.72-18.12.2 kernel-debug-base-4.4.72-18.12.2 kernel-debug-base-debuginfo-4.4.72-18.12.2 kernel-debug-debuginfo-4.4.72-18.12.2 kernel-debug-debugsource-4.4.72-18.12.2 kernel-debug-devel-4.4.72-18.12.2 kernel-debug-devel-debuginfo-4.4.72-18.12.2 kernel-default-4.4.72-18.12.2 kernel-default-base-4.4.72-18.12.2 kernel-default-base-debuginfo-4.4.72-18.12.2 kernel-default-debuginfo-4.4.72-18.12.2 kernel-default-debugsource-4.4.72-18.12.2 kernel-default-devel-4.4.72-18.12.2 kernel-obs-build-4.4.72-18.12.2 kernel-obs-build-debugsource-4.4.72-18.12.2 kernel-obs-qa-4.4.72-18.12.1 kernel-syms-4.4.72-18.12.1 kernel-vanilla-4.4.72-18.12.2 kernel-vanilla-base-4.4.72-18.12.2 kernel-vanilla-base-debuginfo-4.4.72-18.12.2 kernel-vanilla-debuginfo-4.4.72-18.12.2 kernel-vanilla-debugsource-4.4.72-18.12.2 kernel-vanilla-devel-4.4.72-18.12.2 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://www.suse.com/security/cve/CVE-2017-1000380.html https://www.suse.com/security/cve/CVE-2017-7346.html https://www.suse.com/security/cve/CVE-2017-9242.html https://bugzilla.suse.com/1012060 https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1012422 https://bugzilla.suse.com/1012829 https://bugzilla.suse.com/1015452 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1031796 https://bugzilla.suse.com/1032339 https://bugzilla.suse.com/1036638 https://bugzilla.suse.com/1037840 https://bugzilla.suse.com/1038085 https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1039900 https://bugzilla.suse.com/1040855 https://bugzilla.suse.com/1041242 https://bugzilla.suse.com/1041431 https://bugzilla.suse.com/1041810 https://bugzilla.suse.com/1042286 https://bugzilla.suse.com/1042356 https://bugzilla.suse.com/1042421 https://bugzilla.suse.com/1042517 https://bugzilla.suse.com/1042535 https://bugzilla.suse.com/1042536 https://bugzilla.suse.com/1042886 https://bugzilla.suse.com/1043014 https://bugzilla.suse.com/1043231 https://bugzilla.suse.com/1043236 https://bugzilla.suse.com/1043371 https://bugzilla.suse.com/1043467 https://bugzilla.suse.com/1043598 https://bugzilla.suse.com/1043935 https://bugzilla.suse.com/1044015 https://bugzilla.suse.com/1044125 https://bugzilla.suse.com/1044532 https://bugzilla.suse.com/863764 https://bugzilla.suse.com/966321 https://bugzilla.suse.com/966339 https://bugzilla.suse.com/971975 https://bugzilla.suse.com/995542 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1632-1: important: Security update for tomcat6
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

SUSE Security Update: Security update for tomcat6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1632-1 Rating: important References: #1007853 #1007854 #1007855 #1007857 #1007858 #1011805 #1011812 #1015119 #1033448 #1036642 #988489 Cross-References: CVE-2016-0762 CVE-2016-5018 CVE-2016-5388 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 CVE-2017-5647 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has one errata is now available. Description: This update for tomcat6 fixes the following issues: Tomcat was updated to version 6.0.53: The full changelog is: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html Security issues fixed: - CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure (bsc#1036642) - CVE-2016-8745: Regression in the error handling methods could lead to information disclosure (bsc#1015119) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow remote attackers to redirect outbound HTTP traffic (bsc#988489) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-tomcat6-13162=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-tomcat6-13162=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-tomcat6-13162=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (noarch): tomcat6-6.0.53-0.56.1 tomcat6-admin-webapps-6.0.53-0.56.1 tomcat6-docs-webapp-6.0.53-0.56.1 tomcat6-javadoc-6.0.53-0.56.1 tomcat6-jsp-2_1-api-6.0.53-0.56.1 tomcat6-lib-6.0.53-0.56.1 tomcat6-servlet-2_5-api-6.0.53-0.56.1 tomcat6-webapps-6.0.53-0.56.1 References: https://www.suse.com/security/cve/CVE-2016-0762.html https://www.suse.com/security/cve/CVE-2016-5018.html https://www.suse.com/security/cve/CVE-2016-5388.html https://www.suse.com/security/cve/CVE-2016-6794.html https://www.suse.com/security/cve/CVE-2016-6796.html https://www.suse.com/security/cve/CVE-2016-6797.html https://www.suse.com/security/cve/CVE-2016-6816.html https://www.suse.com/security/cve/CVE-2016-8735.html https://www.suse.com/security/cve/CVE-2016-8745.html https://www.suse.com/security/cve/CVE-2017-5647.html https://bugzilla.suse.com/1007853 https://bugzilla.suse.com/1007854 https://bugzilla.suse.com/1007855 https://bugzilla.suse.com/1007857 https://bugzilla.suse.com/1007858 https://bugzilla.suse.com/1011805 https://bugzilla.suse.com/1011812 https://bugzilla.suse.com/1015119 https://bugzilla.suse.com/1033448 https://bugzilla.suse.com/1036642 https://bugzilla.suse.com/988489 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1629-1: important: Security update for glibc
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1629-1 Rating: important References: #1039357 #1040043 Cross-References: CVE-2017-1000366 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] - A bug in glibc that could result in deadlocks between malloc() and fork() has been fixed. [bsc#1040043] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-715=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 i686 x86_64): glibc-2.22-4.9.1 glibc-debuginfo-2.22-4.9.1 glibc-debugsource-2.22-4.9.1 glibc-devel-2.22-4.9.1 glibc-devel-debuginfo-2.22-4.9.1 glibc-devel-static-2.22-4.9.1 glibc-locale-2.22-4.9.1 glibc-locale-debuginfo-2.22-4.9.1 glibc-profile-2.22-4.9.1 - openSUSE Leap 42.2 (i586 x86_64): glibc-extra-2.22-4.9.1 glibc-extra-debuginfo-2.22-4.9.1 glibc-utils-2.22-4.9.1 glibc-utils-debuginfo-2.22-4.9.1 glibc-utils-debugsource-2.22-4.9.1 nscd-2.22-4.9.1 nscd-debuginfo-2.22-4.9.1 - openSUSE Leap 42.2 (x86_64): glibc-32bit-2.22-4.9.1 glibc-debuginfo-32bit-2.22-4.9.1 glibc-devel-32bit-2.22-4.9.1 glibc-devel-debuginfo-32bit-2.22-4.9.1 glibc-devel-static-32bit-2.22-4.9.1 glibc-locale-32bit-2.22-4.9.1 glibc-locale-debuginfo-32bit-2.22-4.9.1 glibc-profile-32bit-2.22-4.9.1 glibc-utils-32bit-2.22-4.9.1 glibc-utils-debuginfo-32bit-2.22-4.9.1 - openSUSE Leap 42.2 (noarch): glibc-html-2.22-4.9.1 glibc-i18ndata-2.22-4.9.1 glibc-info-2.22-4.9.1 - openSUSE Leap 42.2 (i586): glibc-obsolete-2.22-4.9.1 glibc-obsolete-debuginfo-2.22-4.9.1 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1039357 https://bugzilla.suse.com/1040043 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1628-1: critical: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1628-1 Rating: critical References: #1018074 #1035920 #1039348 #1042921 #1043234 Cross-References: CVE-2017-1000364 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be "jumped over" by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) The following non-security bugs were fixed: - fnic now returns 'DID_IMM_RETRY' if rport is not ready (bsc#1035920). - fnic is now using rport->dd_data to check if rport is online instead of rport_lookup (bsc#1035920). - The rport check location in fnic_queuecommand_lck was corrected (bsc#1035920). - xfs: remove patches that caused regression (bsc#1043234). - mm: enlarge stack guard gap (bnc#1039348, CVE-2017-1000364, bnc#1042921). - PCI: Allow access to VPD attributes with size 0 (bsc#1018074). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-kernel-13160=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-kernel-13160=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-13160=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-kernel-13160=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): kernel-docs-3.0.101-104.7 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-104.2 kernel-default-base-3.0.101-104.2 kernel-default-devel-3.0.101-104.2 kernel-source-3.0.101-104.2 kernel-syms-3.0.101-104.2 kernel-trace-3.0.101-104.2 kernel-trace-base-3.0.101-104.2 kernel-trace-devel-3.0.101-104.2 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): kernel-ec2-3.0.101-104.2 kernel-ec2-base-3.0.101-104.2 kernel-ec2-devel-3.0.101-104.2 kernel-xen-3.0.101-104.2 kernel-xen-base-3.0.101-104.2 kernel-xen-devel-3.0.101-104.2 - SUSE Linux Enterprise Server 11-SP4 (s390x): kernel-default-man-3.0.101-104.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64): kernel-bigmem-3.0.101-104.2 kernel-bigmem-base-3.0.101-104.2 kernel-bigmem-devel-3.0.101-104.2 kernel-ppc64-3.0.101-104.2 kernel-ppc64-base-3.0.101-104.2 kernel-ppc64-devel-3.0.101-104.2 - SUSE Linux Enterprise Server 11-SP4 (i586): kernel-pae-3.0.101-104.2 kernel-pae-base-3.0.101-104.2 kernel-pae-devel-3.0.101-104.2 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-104.2 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-104.2 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-104.2 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-104.2 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-104.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-104.2 kernel-default-debugsource-3.0.101-104.2 kernel-trace-debuginfo-3.0.101-104.2 kernel-trace-debugsource-3.0.101-104.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-104.2 kernel-trace-devel-debuginfo-3.0.101-104.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-104.2 kernel-ec2-debugsource-3.0.101-104.2 kernel-xen-debuginfo-3.0.101-104.2 kernel-xen-debugsource-3.0.101-104.2 kernel-xen-devel-debuginfo-3.0.101-104.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-104.2 kernel-bigmem-debugsource-3.0.101-104.2 kernel-ppc64-debuginfo-3.0.101-104.2 kernel-ppc64-debugsource-3.0.101-104.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-104.2 kernel-pae-debugsource-3.0.101-104.2 kernel-pae-devel-debuginfo-3.0.101-104.2 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://bugzilla.suse.com/1018074 https://bugzilla.suse.com/1035920 https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1042921 https://bugzilla.suse.com/1043234 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1627-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1627-1 Rating: important References: #1034560 #1042146 Cross-References: CVE-2017-1000368 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sudo fixes the following issues: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. (bsc#1042146) Also the following non security bug was fixed: - Link the "system_group" plugin with sudo_util library to resolve the missing sudo_dso_findsym symbol (bsc#1034560) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1001=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1001=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1001=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1001=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): sudo-1.8.10p3-2.16.1 sudo-debuginfo-1.8.10p3-2.16.1 sudo-debugsource-1.8.10p3-2.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): sudo-1.8.10p3-2.16.1 sudo-debuginfo-1.8.10p3-2.16.1 sudo-debugsource-1.8.10p3-2.16.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): sudo-1.8.10p3-2.16.1 sudo-debuginfo-1.8.10p3-2.16.1 sudo-debugsource-1.8.10p3-2.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): sudo-1.8.10p3-2.16.1 sudo-debuginfo-1.8.10p3-2.16.1 sudo-debugsource-1.8.10p3-2.16.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): sudo-1.8.10p3-2.16.1 sudo-debuginfo-1.8.10p3-2.16.1 sudo-debugsource-1.8.10p3-2.16.1 References: https://www.suse.com/security/cve/CVE-2017-1000368.html https://bugzilla.suse.com/1034560 https://bugzilla.suse.com/1042146 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1626-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1626-1 Rating: important References: #1034560 #1042146 Cross-References: CVE-2017-1000368 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for sudo fixes the following security issue: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. (bsc#1042146) Also the following non security bug was fixed: - Link the "system_group" plugin with sudo_util library to resolve the missing sudo_dso_findsym symbol (bsc#1034560) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1002=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1002=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1002=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1002=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1002=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): sudo-debuginfo-1.8.10p3-10.10.2 sudo-debugsource-1.8.10p3-10.10.2 sudo-devel-1.8.10p3-10.10.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): sudo-1.8.10p3-10.10.2 sudo-debuginfo-1.8.10p3-10.10.2 sudo-debugsource-1.8.10p3-10.10.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): sudo-1.8.10p3-10.10.2 sudo-debuginfo-1.8.10p3-10.10.2 sudo-debugsource-1.8.10p3-10.10.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): sudo-1.8.10p3-10.10.2 sudo-debuginfo-1.8.10p3-10.10.2 sudo-debugsource-1.8.10p3-10.10.2 - OpenStack Cloud Magnum Orchestration 7 (x86_64): sudo-1.8.10p3-10.10.2 sudo-debuginfo-1.8.10p3-10.10.2 sudo-debugsource-1.8.10p3-10.10.2 References: https://www.suse.com/security/cve/CVE-2017-1000368.html https://bugzilla.suse.com/1034560 https://bugzilla.suse.com/1042146 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1625-1: important: Security update for exim
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1625-1 Rating: important References: #1044692 Cross-References: CVE-2017-1000369 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exim fixes the following issues: - CVE-2017-1000369: Fixed a memory leak in exim commandline handling, which could be used to exhaust memory and make "stack crash" attacks likely. (boo#1044692) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-714=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): exim-4.86.2-10.3.1 exim-debuginfo-4.86.2-10.3.1 exim-debugsource-4.86.2-10.3.1 eximon-4.86.2-10.3.1 eximon-debuginfo-4.86.2-10.3.1 eximstats-html-4.86.2-10.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000369.html https://bugzilla.suse.com/1044692 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1622-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

SUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1622-1 Rating: important References: #1038709 #1038711 #1038713 #995374 Cross-References: CVE-2016-6329 CVE-2017-7478 CVE-2017-7479 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for openvpn fixes the following issues: - CVE-2016-6329: Show which ciphers should no longer be used in openvpn --show-ciphers (bsc#995374) - CVE-2017-7478: openvpn: Authenticated user can DoS server by using a big payload in P_CONTROL (bsc#1038709) - CVE-2017-7479: openvpn: Denial of Service due to Exhaustion of Packet-ID counter (bsc#1038711) - Hardening measures found by internal audit (bsc#1038713) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-998=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-998=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-998=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): openvpn-2.3.8-16.14.1 openvpn-auth-pam-plugin-2.3.8-16.14.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.14.1 openvpn-debuginfo-2.3.8-16.14.1 openvpn-debugsource-2.3.8-16.14.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): openvpn-2.3.8-16.14.1 openvpn-auth-pam-plugin-2.3.8-16.14.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-16.14.1 openvpn-debuginfo-2.3.8-16.14.1 openvpn-debugsource-2.3.8-16.14.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): openvpn-2.3.8-16.14.1 openvpn-debuginfo-2.3.8-16.14.1 openvpn-debugsource-2.3.8-16.14.1 References: https://www.suse.com/security/cve/CVE-2016-6329.html https://www.suse.com/security/cve/CVE-2017-7478.html https://www.suse.com/security/cve/CVE-2017-7479.html https://bugzilla.suse.com/1038709 https://bugzilla.suse.com/1038711 https://bugzilla.suse.com/1038713 https://bugzilla.suse.com/995374 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1621-1: important: Security update for glibc
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1621-1 Rating: important References: #1039357 Cross-References: CVE-2017-1000366 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-glibc-13158=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-glibc-13158=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-glibc-13158=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-glibc-13158=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-glibc-13158=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-glibc-13158=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): glibc-html-2.11.3-17.109.1 glibc-info-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP4 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.109.1 glibc-devel-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.109.1 glibc-i18ndata-2.11.3-17.109.1 glibc-info-2.11.3-17.109.1 glibc-locale-2.11.3-17.109.1 glibc-profile-2.11.3-17.109.1 nscd-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.109.1 glibc-devel-32bit-2.11.3-17.109.1 glibc-locale-32bit-2.11.3-17.109.1 glibc-profile-32bit-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): glibc-locale-x86-2.11.3-17.109.1 glibc-profile-x86-2.11.3-17.109.1 glibc-x86-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 i686 s390x x86_64): glibc-2.11.3-17.109.1 glibc-devel-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): glibc-html-2.11.3-17.109.1 glibc-i18ndata-2.11.3-17.109.1 glibc-info-2.11.3-17.109.1 glibc-locale-2.11.3-17.109.1 glibc-profile-2.11.3-17.109.1 nscd-2.11.3-17.109.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): glibc-32bit-2.11.3-17.109.1 glibc-devel-32bit-2.11.3-17.109.1 glibc-locale-32bit-2.11.3-17.109.1 glibc-profile-32bit-2.11.3-17.109.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586 i686): glibc-2.11.3-17.109.1 glibc-devel-2.11.3-17.109.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): glibc-html-2.11.3-17.109.1 glibc-i18ndata-2.11.3-17.109.1 glibc-info-2.11.3-17.109.1 glibc-locale-2.11.3-17.109.1 glibc-profile-2.11.3-17.109.1 nscd-2.11.3-17.109.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 i686 ia64 ppc64 s390x x86_64): glibc-debuginfo-2.11.3-17.109.1 glibc-debugsource-2.11.3-17.109.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64): glibc-debuginfo-32bit-2.11.3-17.109.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64): glibc-debuginfo-x86-2.11.3-17.109.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 i686 s390x x86_64): glibc-debuginfo-2.11.3-17.109.1 glibc-debugsource-2.11.3-17.109.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (s390x x86_64): glibc-debuginfo-32bit-2.11.3-17.109.1 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1039357 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1620-1: important: Security update for Mozilla based packages
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for Mozilla based packages ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1620-1 Rating: important References: #1040105 #1043960 Cross-References: CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7760 CVE-2017-7761 CVE-2017-7764 CVE-2017-7765 CVE-2017-7766 CVE-2017-7767 CVE-2017-7768 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for Mozilla Firefox, Thunderbird, and NSS fixes the following issues: Mozilla Firefox was updated to 52.2esr (boo#1043960) MFSA 2017-16: * CVE-2017-5472 (bmo#1365602) Use-after-free using destroyed node when regenerating trees * CVE-2017-7749 (bmo#1355039) Use-after-free during docshell reloading * CVE-2017-7750 (bmo#1356558) Use-after-free with track elements * CVE-2017-7751 (bmo#1363396) Use-after-free with content viewer listeners * CVE-2017-7752 (bmo#1359547) Use-after-free with IME input * CVE-2017-7754 (bmo#1357090) Out-of-bounds read in WebGL with ImageInfo object * CVE-2017-7755 (bmo#1361326) Privilege escalation through Firefox Installer with same directory DLL files (Windows only) * CVE-2017-7756 (bmo#1366595) Use-after-free and use-after-scope logging XHR header errors * CVE-2017-7757 (bmo#1356824) Use-after-free in IndexedDB * CVE-2017-7778, CVE-2017-7778, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777 Vulnerabilities in the Graphite 2 library * CVE-2017-7758 (bmo#1368490) Out-of-bounds read in Opus encoder * CVE-2017-7760 (bmo#1348645) File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service (Windows only) * CVE-2017-7761 (bmo#1215648) File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application (Windows only) * CVE-2017-7764 (bmo#1364283) Domain spoofing with combination of Canadian Syllabics and other unicode blocks * CVE-2017-7765 (bmo#1273265) Mark of the Web bypass when saving executable files (Windows only) * CVE-2017-7766 (bmo#1342742) File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service (Windows only) * CVE-2017-7767 (bmo#1336964) Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service (Windows only) * CVE-2017-7768 (bmo#1336979) 32 byte arbitrary file read through Mozilla Maintenance Service (Windows only) * CVE-2017-5470 Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 - remove -fno-inline-small-functions and explicitely optimize with -O2 for openSUSE > 13.2/Leap 42 to work with gcc7 (boo#1040105) Mozilla NSS was updated to NSS 3.28.5 * Implemented domain name constraints for CA: TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1. (bmo#1350859) * March 2017 batch of root CA changes (bmo#1350859) (version 2.14) CA certificates removed: O = Japanese Government, OU = ApplicationCA CN = WellsSecure Public Root Certificate Authority CN = TURKTRUST Elektronik Sertifika Hizmet H6 CN = Microsec e-Szigno Root CA certificates added: CN = D-TRUST Root CA 3 2013 CN = TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 java-1_8_0-openjdk was rebuild against NSS 3.28.5 to satisfy a runtime dependency. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-712=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.2-57.12.2 MozillaFirefox-branding-upstream-52.2-57.12.2 MozillaFirefox-buildsymbols-52.2-57.12.2 MozillaFirefox-debuginfo-52.2-57.12.2 MozillaFirefox-debugsource-52.2-57.12.2 MozillaFirefox-devel-52.2-57.12.2 MozillaFirefox-translations-common-52.2-57.12.2 MozillaFirefox-translations-other-52.2-57.12.2 MozillaThunderbird-52.2-41.9.2 MozillaThunderbird-buildsymbols-52.2-41.9.2 MozillaThunderbird-debuginfo-52.2-41.9.2 MozillaThunderbird-debugsource-52.2-41.9.2 MozillaThunderbird-devel-52.2-41.9.2 MozillaThunderbird-translations-common-52.2-41.9.2 MozillaThunderbird-translations-other-52.2-41.9.2 java-1_8_0-openjdk-1.8.0.131-10.10.3 java-1_8_0-openjdk-accessibility-1.8.0.131-10.10.3 java-1_8_0-openjdk-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-debugsource-1.8.0.131-10.10.3 java-1_8_0-openjdk-demo-1.8.0.131-10.10.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-devel-1.8.0.131-10.10.3 java-1_8_0-openjdk-devel-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-headless-1.8.0.131-10.10.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-src-1.8.0.131-10.10.3 libfreebl3-3.28.5-40.6.1 libfreebl3-debuginfo-3.28.5-40.6.1 libsoftokn3-3.28.5-40.6.1 libsoftokn3-debuginfo-3.28.5-40.6.1 mozilla-nss-3.28.5-40.6.1 mozilla-nss-certs-3.28.5-40.6.1 mozilla-nss-certs-debuginfo-3.28.5-40.6.1 mozilla-nss-debuginfo-3.28.5-40.6.1 mozilla-nss-debugsource-3.28.5-40.6.1 mozilla-nss-devel-3.28.5-40.6.1 mozilla-nss-sysinit-3.28.5-40.6.1 mozilla-nss-sysinit-debuginfo-3.28.5-40.6.1 mozilla-nss-tools-3.28.5-40.6.1 mozilla-nss-tools-debuginfo-3.28.5-40.6.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.131-10.10.3 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.5-40.6.1 libfreebl3-debuginfo-32bit-3.28.5-40.6.1 libsoftokn3-32bit-3.28.5-40.6.1 libsoftokn3-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-32bit-3.28.5-40.6.1 mozilla-nss-certs-32bit-3.28.5-40.6.1 mozilla-nss-certs-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-sysinit-32bit-3.28.5-40.6.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.5-40.6.1 References: https://www.suse.com/security/cve/CVE-2017-5470.html https://www.suse.com/security/cve/CVE-2017-5472.html https://www.suse.com/security/cve/CVE-2017-7749.html https://www.suse.com/security/cve/CVE-2017-7750.html https://www.suse.com/security/cve/CVE-2017-7751.html https://www.suse.com/security/cve/CVE-2017-7752.html https://www.suse.com/security/cve/CVE-2017-7754.html https://www.suse.com/security/cve/CVE-2017-7755.html https://www.suse.com/security/cve/CVE-2017-7756.html https://www.suse.com/security/cve/CVE-2017-7757.html https://www.suse.com/security/cve/CVE-2017-7758.html https://www.suse.com/security/cve/CVE-2017-7760.html https://www.suse.com/security/cve/CVE-2017-7761.html https://www.suse.com/security/cve/CVE-2017-7764.html https://www.suse.com/security/cve/CVE-2017-7765.html https://www.suse.com/security/cve/CVE-2017-7766.html https://www.suse.com/security/cve/CVE-2017-7767.html https://www.suse.com/security/cve/CVE-2017-7768.html https://www.suse.com/security/cve/CVE-2017-7771.html https://www.suse.com/security/cve/CVE-2017-7772.html https://www.suse.com/security/cve/CVE-2017-7773.html https://www.suse.com/security/cve/CVE-2017-7774.html https://www.suse.com/security/cve/CVE-2017-7775.html https://www.suse.com/security/cve/CVE-2017-7776.html https://www.suse.com/security/cve/CVE-2017-7777.html https://www.suse.com/security/cve/CVE-2017-7778.html https://bugzilla.suse.com/1040105 https://bugzilla.suse.com/1043960 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1619-1: important: Security update for glibc
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1619-1 Rating: important References: #1039357 #1040043 Cross-References: CVE-2017-1000366 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] - A bug in glibc that could result in deadlocks between malloc() and fork() has been fixed. [bsc#1040043] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-990=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-990=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-990=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-990=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-990=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): glibc-debuginfo-2.22-61.3 glibc-debugsource-2.22-61.3 glibc-devel-static-2.22-61.3 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): glibc-info-2.22-61.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): glibc-2.22-61.3 glibc-debuginfo-2.22-61.3 glibc-debugsource-2.22-61.3 glibc-devel-2.22-61.3 glibc-devel-debuginfo-2.22-61.3 glibc-locale-2.22-61.3 glibc-locale-debuginfo-2.22-61.3 glibc-profile-2.22-61.3 nscd-2.22-61.3 nscd-debuginfo-2.22-61.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): glibc-html-2.22-61.3 glibc-i18ndata-2.22-61.3 glibc-info-2.22-61.3 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): glibc-2.22-61.3 glibc-debuginfo-2.22-61.3 glibc-debugsource-2.22-61.3 glibc-devel-2.22-61.3 glibc-devel-debuginfo-2.22-61.3 glibc-locale-2.22-61.3 glibc-locale-debuginfo-2.22-61.3 glibc-profile-2.22-61.3 nscd-2.22-61.3 nscd-debuginfo-2.22-61.3 - SUSE Linux Enterprise Server 12-SP2 (noarch): glibc-html-2.22-61.3 glibc-i18ndata-2.22-61.3 glibc-info-2.22-61.3 - SUSE Linux Enterprise Server 12-SP2 (x86_64): glibc-32bit-2.22-61.3 glibc-debuginfo-32bit-2.22-61.3 glibc-devel-32bit-2.22-61.3 glibc-devel-debuginfo-32bit-2.22-61.3 glibc-locale-32bit-2.22-61.3 glibc-locale-debuginfo-32bit-2.22-61.3 glibc-profile-32bit-2.22-61.3 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): glibc-i18ndata-2.22-61.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): glibc-2.22-61.3 glibc-32bit-2.22-61.3 glibc-debuginfo-2.22-61.3 glibc-debuginfo-32bit-2.22-61.3 glibc-debugsource-2.22-61.3 glibc-devel-2.22-61.3 glibc-devel-32bit-2.22-61.3 glibc-devel-debuginfo-2.22-61.3 glibc-devel-debuginfo-32bit-2.22-61.3 glibc-locale-2.22-61.3 glibc-locale-32bit-2.22-61.3 glibc-locale-debuginfo-2.22-61.3 glibc-locale-debuginfo-32bit-2.22-61.3 nscd-2.22-61.3 nscd-debuginfo-2.22-61.3 - OpenStack Cloud Magnum Orchestration 7 (x86_64): glibc-2.22-61.3 glibc-debuginfo-2.22-61.3 glibc-debugsource-2.22-61.3 glibc-locale-2.22-61.3 glibc-locale-debuginfo-2.22-61.3 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1039357 https://bugzilla.suse.com/1040043 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1618-1: critical: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1618-1 Rating: critical References: #1039348 #1042292 Cross-References: CVE-2017-1000364 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be "jumped over" by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) The following non-security bugs were fixed: netfilter: A use-after-free was fixed that could cause a kernel panic on a system shutdown. (bsc#1042292) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-995=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-995=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-995=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): kernel-devel-3.12.61-52.77.1 kernel-macros-3.12.61-52.77.1 kernel-source-3.12.61-52.77.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): kernel-default-3.12.61-52.77.1 kernel-default-base-3.12.61-52.77.1 kernel-default-base-debuginfo-3.12.61-52.77.1 kernel-default-debuginfo-3.12.61-52.77.1 kernel-default-debugsource-3.12.61-52.77.1 kernel-default-devel-3.12.61-52.77.1 kernel-syms-3.12.61-52.77.1 kernel-xen-3.12.61-52.77.1 kernel-xen-base-3.12.61-52.77.1 kernel-xen-base-debuginfo-3.12.61-52.77.1 kernel-xen-debuginfo-3.12.61-52.77.1 kernel-xen-debugsource-3.12.61-52.77.1 kernel-xen-devel-3.12.61-52.77.1 kgraft-patch-3_12_61-52_77-default-1-4.1 kgraft-patch-3_12_61-52_77-xen-1-4.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.61-52.77.1 kernel-default-base-3.12.61-52.77.1 kernel-default-base-debuginfo-3.12.61-52.77.1 kernel-default-debuginfo-3.12.61-52.77.1 kernel-default-debugsource-3.12.61-52.77.1 kernel-default-devel-3.12.61-52.77.1 kernel-syms-3.12.61-52.77.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.61-52.77.1 kernel-xen-base-3.12.61-52.77.1 kernel-xen-base-debuginfo-3.12.61-52.77.1 kernel-xen-debuginfo-3.12.61-52.77.1 kernel-xen-debugsource-3.12.61-52.77.1 kernel-xen-devel-3.12.61-52.77.1 kgraft-patch-3_12_61-52_77-default-1-4.1 kgraft-patch-3_12_61-52_77-xen-1-4.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.61-52.77.1 kernel-macros-3.12.61-52.77.1 kernel-source-3.12.61-52.77.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.61-52.77.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.61-52.77.1 kernel-ec2-debuginfo-3.12.61-52.77.1 kernel-ec2-debugsource-3.12.61-52.77.1 kernel-ec2-devel-3.12.61-52.77.1 kernel-ec2-extra-3.12.61-52.77.1 kernel-ec2-extra-debuginfo-3.12.61-52.77.1 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1042292 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1615-1: critical: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1615-1 Rating: critical References: #1039348 #1042292 Cross-References: CVE-2017-1000364 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be "jumped over" by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) The following non-security bugs were fixed: netfilter: A use-after-free was fixed that could cause a kernel panic on a system shutdown. (bsc#1042292) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-996=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-996=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-996=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-996=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): kernel-default-3.12.74-60.64.45.1 kernel-default-base-3.12.74-60.64.45.1 kernel-default-base-debuginfo-3.12.74-60.64.45.1 kernel-default-debuginfo-3.12.74-60.64.45.1 kernel-default-debugsource-3.12.74-60.64.45.1 kernel-default-devel-3.12.74-60.64.45.1 kernel-syms-3.12.74-60.64.45.1 kernel-xen-3.12.74-60.64.45.1 kernel-xen-base-3.12.74-60.64.45.1 kernel-xen-base-debuginfo-3.12.74-60.64.45.1 kernel-xen-debuginfo-3.12.74-60.64.45.1 kernel-xen-debugsource-3.12.74-60.64.45.1 kernel-xen-devel-3.12.74-60.64.45.1 kgraft-patch-3_12_74-60_64_45-default-1-4.1 kgraft-patch-3_12_74-60_64_45-xen-1-4.1 - SUSE OpenStack Cloud 6 (noarch): kernel-devel-3.12.74-60.64.45.1 kernel-macros-3.12.74-60.64.45.1 kernel-source-3.12.74-60.64.45.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): kernel-default-3.12.74-60.64.45.1 kernel-default-base-3.12.74-60.64.45.1 kernel-default-base-debuginfo-3.12.74-60.64.45.1 kernel-default-debuginfo-3.12.74-60.64.45.1 kernel-default-debugsource-3.12.74-60.64.45.1 kernel-default-devel-3.12.74-60.64.45.1 kernel-syms-3.12.74-60.64.45.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): kernel-devel-3.12.74-60.64.45.1 kernel-macros-3.12.74-60.64.45.1 kernel-source-3.12.74-60.64.45.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kernel-xen-3.12.74-60.64.45.1 kernel-xen-base-3.12.74-60.64.45.1 kernel-xen-base-debuginfo-3.12.74-60.64.45.1 kernel-xen-debuginfo-3.12.74-60.64.45.1 kernel-xen-debugsource-3.12.74-60.64.45.1 kernel-xen-devel-3.12.74-60.64.45.1 kgraft-patch-3_12_74-60_64_45-default-1-4.1 kgraft-patch-3_12_74-60_64_45-xen-1-4.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): kernel-default-3.12.74-60.64.45.1 kernel-default-base-3.12.74-60.64.45.1 kernel-default-base-debuginfo-3.12.74-60.64.45.1 kernel-default-debuginfo-3.12.74-60.64.45.1 kernel-default-debugsource-3.12.74-60.64.45.1 kernel-default-devel-3.12.74-60.64.45.1 kernel-syms-3.12.74-60.64.45.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): kernel-devel-3.12.74-60.64.45.1 kernel-macros-3.12.74-60.64.45.1 kernel-source-3.12.74-60.64.45.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kernel-xen-3.12.74-60.64.45.1 kernel-xen-base-3.12.74-60.64.45.1 kernel-xen-base-debuginfo-3.12.74-60.64.45.1 kernel-xen-debuginfo-3.12.74-60.64.45.1 kernel-xen-debugsource-3.12.74-60.64.45.1 kernel-xen-devel-3.12.74-60.64.45.1 kgraft-patch-3_12_74-60_64_45-default-1-4.1 kgraft-patch-3_12_74-60_64_45-xen-1-4.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x): kernel-default-man-3.12.74-60.64.45.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.74-60.64.45.1 kernel-ec2-debuginfo-3.12.74-60.64.45.1 kernel-ec2-debugsource-3.12.74-60.64.45.1 kernel-ec2-devel-3.12.74-60.64.45.1 kernel-ec2-extra-3.12.74-60.64.45.1 kernel-ec2-extra-debuginfo-3.12.74-60.64.45.1 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1042292 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1614-1: important: Security update for glibc
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1614-1 Rating: important References: #1038690 #1039357 #986858 Cross-References: CVE-2017-1000366 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] - The incorrectly defined constant O_TMPFILE has been fixed. [bsc#1038690] - An incorrectly specified buffer length in nscd netgroup queries has been fixed. [bsc#986858] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-989=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-989=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-989=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): glibc-2.19-40.6.1 glibc-32bit-2.19-40.6.1 glibc-debuginfo-2.19-40.6.1 glibc-debuginfo-32bit-2.19-40.6.1 glibc-debugsource-2.19-40.6.1 glibc-devel-2.19-40.6.1 glibc-devel-32bit-2.19-40.6.1 glibc-devel-debuginfo-2.19-40.6.1 glibc-devel-debuginfo-32bit-2.19-40.6.1 glibc-locale-2.19-40.6.1 glibc-locale-32bit-2.19-40.6.1 glibc-locale-debuginfo-2.19-40.6.1 glibc-locale-debuginfo-32bit-2.19-40.6.1 glibc-profile-2.19-40.6.1 glibc-profile-32bit-2.19-40.6.1 nscd-2.19-40.6.1 nscd-debuginfo-2.19-40.6.1 - SUSE OpenStack Cloud 6 (noarch): glibc-html-2.19-40.6.1 glibc-i18ndata-2.19-40.6.1 glibc-info-2.19-40.6.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): glibc-2.19-40.6.1 glibc-debuginfo-2.19-40.6.1 glibc-debugsource-2.19-40.6.1 glibc-devel-2.19-40.6.1 glibc-devel-debuginfo-2.19-40.6.1 glibc-locale-2.19-40.6.1 glibc-locale-debuginfo-2.19-40.6.1 glibc-profile-2.19-40.6.1 nscd-2.19-40.6.1 nscd-debuginfo-2.19-40.6.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): glibc-32bit-2.19-40.6.1 glibc-debuginfo-32bit-2.19-40.6.1 glibc-devel-32bit-2.19-40.6.1 glibc-devel-debuginfo-32bit-2.19-40.6.1 glibc-locale-32bit-2.19-40.6.1 glibc-locale-debuginfo-32bit-2.19-40.6.1 glibc-profile-32bit-2.19-40.6.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): glibc-html-2.19-40.6.1 glibc-i18ndata-2.19-40.6.1 glibc-info-2.19-40.6.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): glibc-2.19-40.6.1 glibc-debuginfo-2.19-40.6.1 glibc-debugsource-2.19-40.6.1 glibc-devel-2.19-40.6.1 glibc-devel-debuginfo-2.19-40.6.1 glibc-locale-2.19-40.6.1 glibc-locale-debuginfo-2.19-40.6.1 glibc-profile-2.19-40.6.1 nscd-2.19-40.6.1 nscd-debuginfo-2.19-40.6.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): glibc-32bit-2.19-40.6.1 glibc-debuginfo-32bit-2.19-40.6.1 glibc-devel-32bit-2.19-40.6.1 glibc-devel-debuginfo-32bit-2.19-40.6.1 glibc-locale-32bit-2.19-40.6.1 glibc-locale-debuginfo-32bit-2.19-40.6.1 glibc-profile-32bit-2.19-40.6.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): glibc-html-2.19-40.6.1 glibc-i18ndata-2.19-40.6.1 glibc-info-2.19-40.6.1 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1038690 https://bugzilla.suse.com/1039357 https://bugzilla.suse.com/986858 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1613-1: critical: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1613-1 Rating: critical References: #1039348 #979021 Cross-References: CVE-2015-3288 CVE-2017-1000364 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security fixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be "jumped over" by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bnc#979021). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-kernel-13156=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-13156=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-kernel-13156=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-13156=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.47.102.1 kernel-default-base-3.0.101-0.47.102.1 kernel-default-devel-3.0.101-0.47.102.1 kernel-source-3.0.101-0.47.102.1 kernel-syms-3.0.101-0.47.102.1 kernel-trace-3.0.101-0.47.102.1 kernel-trace-base-3.0.101-0.47.102.1 kernel-trace-devel-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.47.102.1 kernel-ec2-base-3.0.101-0.47.102.1 kernel-ec2-devel-3.0.101-0.47.102.1 kernel-xen-3.0.101-0.47.102.1 kernel-xen-base-3.0.101-0.47.102.1 kernel-xen-devel-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): kernel-bigsmp-3.0.101-0.47.102.1 kernel-bigsmp-base-3.0.101-0.47.102.1 kernel-bigsmp-devel-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x): kernel-default-man-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): kernel-pae-3.0.101-0.47.102.1 kernel-pae-base-3.0.101-0.47.102.1 kernel-pae-devel-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.102.1 kernel-trace-extra-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.102.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.102.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): kernel-default-3.0.101-0.47.102.1 kernel-default-base-3.0.101-0.47.102.1 kernel-default-devel-3.0.101-0.47.102.1 kernel-ec2-3.0.101-0.47.102.1 kernel-ec2-base-3.0.101-0.47.102.1 kernel-ec2-devel-3.0.101-0.47.102.1 kernel-pae-3.0.101-0.47.102.1 kernel-pae-base-3.0.101-0.47.102.1 kernel-pae-devel-3.0.101-0.47.102.1 kernel-source-3.0.101-0.47.102.1 kernel-syms-3.0.101-0.47.102.1 kernel-trace-3.0.101-0.47.102.1 kernel-trace-base-3.0.101-0.47.102.1 kernel-trace-devel-3.0.101-0.47.102.1 kernel-xen-3.0.101-0.47.102.1 kernel-xen-base-3.0.101-0.47.102.1 kernel-xen-devel-3.0.101-0.47.102.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.102.1 kernel-default-debugsource-3.0.101-0.47.102.1 kernel-trace-debuginfo-3.0.101-0.47.102.1 kernel-trace-debugsource-3.0.101-0.47.102.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.102.1 kernel-ec2-debugsource-3.0.101-0.47.102.1 kernel-xen-debuginfo-3.0.101-0.47.102.1 kernel-xen-debugsource-3.0.101-0.47.102.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.102.1 kernel-bigsmp-debugsource-3.0.101-0.47.102.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.102.1 kernel-pae-debugsource-3.0.101-0.47.102.1 References: https://www.suse.com/security/cve/CVE-2015-3288.html https://www.suse.com/security/cve/CVE-2017-1000364.html https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/979021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1611-1: important: Security update for glibc
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1611-1 Rating: important References: #1038690 #1039357 #987216 Cross-References: CVE-2017-1000366 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] - The incorrectly defined constant O_TMPFILE has been fixed. [bsc#1038690] - A defect in glibc's regression test suite has been remedied to avoid false positives. [bsc#987216] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-988=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-988=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): glibc-2.19-22.21.1 glibc-32bit-2.19-22.21.1 glibc-debuginfo-2.19-22.21.1 glibc-debuginfo-32bit-2.19-22.21.1 glibc-debugsource-2.19-22.21.1 glibc-devel-2.19-22.21.1 glibc-devel-32bit-2.19-22.21.1 glibc-devel-debuginfo-2.19-22.21.1 glibc-devel-debuginfo-32bit-2.19-22.21.1 glibc-locale-2.19-22.21.1 glibc-locale-32bit-2.19-22.21.1 glibc-locale-debuginfo-2.19-22.21.1 glibc-locale-debuginfo-32bit-2.19-22.21.1 glibc-profile-2.19-22.21.1 glibc-profile-32bit-2.19-22.21.1 nscd-2.19-22.21.1 nscd-debuginfo-2.19-22.21.1 - SUSE Linux Enterprise Server for SAP 12 (noarch): glibc-html-2.19-22.21.1 glibc-i18ndata-2.19-22.21.1 glibc-info-2.19-22.21.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): glibc-2.19-22.21.1 glibc-debuginfo-2.19-22.21.1 glibc-debugsource-2.19-22.21.1 glibc-devel-2.19-22.21.1 glibc-devel-debuginfo-2.19-22.21.1 glibc-locale-2.19-22.21.1 glibc-locale-debuginfo-2.19-22.21.1 glibc-profile-2.19-22.21.1 nscd-2.19-22.21.1 nscd-debuginfo-2.19-22.21.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): glibc-32bit-2.19-22.21.1 glibc-debuginfo-32bit-2.19-22.21.1 glibc-devel-32bit-2.19-22.21.1 glibc-devel-debuginfo-32bit-2.19-22.21.1 glibc-locale-32bit-2.19-22.21.1 glibc-locale-debuginfo-32bit-2.19-22.21.1 glibc-profile-32bit-2.19-22.21.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): glibc-html-2.19-22.21.1 glibc-i18ndata-2.19-22.21.1 glibc-info-2.19-22.21.1 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1038690 https://bugzilla.suse.com/1039357 https://bugzilla.suse.com/987216 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1606-1: important: Security update for mercurial
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

SUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1606-1 Rating: important References: #1043063 Cross-References: CVE-2017-9462 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mercurial fixes the following issues: Security issue fixed: - CVE-2017-9462: Fix the arbitrary code exec by remote users via "hg serve --stdio" (bsc#1043063): Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-981=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): mercurial-2.8.2-14.1 mercurial-debuginfo-2.8.2-14.1 mercurial-debugsource-2.8.2-14.1 References: https://www.suse.com/security/cve/CVE-2017-9462.html https://bugzilla.suse.com/1043063 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1572-1: important: Security update for mercurial
by opensuse-security＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1572-1 Rating: important References: #1043063 #1043502 Cross-References: CVE-2017-9462 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mercurial fixes the following issues: - CVE-2017-9462: Fix the arbitrary code exec by remote users via "hg serve --stdio" (boo#1043063) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-689=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mercurial-3.8.3-2.5.1 mercurial-debuginfo-3.8.3-2.5.1 mercurial-debugsource-3.8.3-2.5.1 - openSUSE Leap 42.2 (noarch): mercurial-lang-3.8.3-2.5.1 References: https://www.suse.com/security/cve/CVE-2017-9462.html https://bugzilla.suse.com/1043063 https://bugzilla.suse.com/1043502 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1568-1: important: Security update for jakarta-taglibs-standard
by opensuse-security＠opensuse.org 14 Jun '17

14 Jun '17

SUSE Security Update: Security update for jakarta-taglibs-standard ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1568-1 Rating: important References: #920813 Cross-References: CVE-2015-0254 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jakarta-taglibs-standard fixes the following issues: - CVE-2015-0254: Apache Standard Taglibs allowed remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) x:parse or (2) x:transform JSTL XML tag. (bsc#920813) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-963=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-963=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): jakarta-taglibs-standard-1.1.1-255.2 jakarta-taglibs-standard-javadoc-1.1.1-255.2 - SUSE Linux Enterprise Server 12-SP2 (noarch): jakarta-taglibs-standard-1.1.1-255.2 jakarta-taglibs-standard-javadoc-1.1.1-255.2 References: https://www.suse.com/security/cve/CVE-2015-0254.html https://bugzilla.suse.com/920813 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1558-1: important: Security update for mercurial
by opensuse-security＠opensuse.org 13 Jun '17

13 Jun '17

SUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1558-1 Rating: important References: #1043063 #1043502 Cross-References: CVE-2017-9462 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mercurial fixes the following issues: - CVE-2017-9462: Arbitrary code execution was possible by remote users via "hg serve --stdio" (bsc#1043063): Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-mercurial-13144=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-mercurial-13144=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): mercurial-2.3.2-0.17.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): mercurial-debuginfo-2.3.2-0.17.1 mercurial-debugsource-2.3.2-0.17.1 References: https://www.suse.com/security/cve/CVE-2017-9462.html https://bugzilla.suse.com/1043063 https://bugzilla.suse.com/1043502 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1513-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 Jun '17

08 Jun '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1513-1 Rating: important References: #1003581 #1004003 #1011044 #1012422 #1012452 #1012829 #1012910 #1012985 #1013561 #1018885 #1020412 #1022266 #1026570 #1028310 #1028340 #1029607 #1030057 #1031040 #1031142 #1031470 #1031500 #1031512 #1031717 #1034635 #1034670 #1034762 #1034995 #1035024 #1035866 #1035887 #1035920 #1035922 #1036214 #1036752 #1036763 #1037177 #1037186 #1037384 #1037483 #1037871 #1037969 #1038033 #1038043 #1038142 #1038143 #1038297 #1038458 #1038544 #1038842 #1038843 #1038846 #1038847 #1038848 #1038879 #1039700 #1039864 #1039882 #1039883 #1039885 #1040069 #1040125 #1040279 #1040395 #1040425 #1040463 #1040929 #1040941 #1041087 #1041160 #1041168 #1041242 #799133 #922871 #966321 #971975 #989311 Cross-References: CVE-2017-7487 CVE-2017-7645 CVE-2017-8890 CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-9150 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 68 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to 4.4.70 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885). - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1040069). - CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039883). - CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel did not consider that the nexthdr field may be associated with an invalid option, which allowed local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls (bnc#1039882). - CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel mishandled reference counts, which allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface (bnc#1038879). - CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bnc#1038544). - CVE-2017-9150: The do_check function in kernel/bpf/verifier.c in the Linux kernel did not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allowed local users to obtain sensitive address information via crafted bpf system calls (bnc#1040279). - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670) The following non-security bugs were fixed: - 9p: fix a potential acl leak (4.4.68 stable queue). - acpi / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal (bsc#1031717). - acpi / scan: Drop support for force_remove (bnc#1029607). - ahci: disable correct irq for dummy ports (bsc#1040125). - alsa: hda - Fix deadlock of controller device lock at unbinding (4.4.68 stable queue). - arm: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode (4.4.68 stable queue). - arm: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build (4.4.68 stable queue). - asoc: rt5640: use msleep() for long delays (bsc#1031717). - asoc: sti: Fix error handling if of_clk_get() fails (bsc#1031717). - blacklist 61e8a0d5a027 powerpc/pci: Fix endian bug in fixed PHB numbering (bsc#989311) - block: get rid of blk_integrity_revalidate() (4.4.68 stable queue). - bna: avoid writing uninitialized data into hw registers (bsc#966321 FATE#320156). - bnxt_en: allocate enough space for ->ntp_fltr_bmap (bsc#1020412 FATE#321671). - bpf, arm64: fix jit branch offset related to ldimm64 (4.4.68 stable queue). - brcmfmac: Ensure pointer correctly set if skb data location changes (4.4.68 stable queue). - brcmfmac: Make skb header writable before use (4.4.68 stable queue). - brcmfmac: restore stopping netdev queue when bus clogs up (bsc#1031717). - btrfs: add a flags field to btrfs_fs_info (bsc#1012452). - btrfs: add ASSERT for block group's memory leak (bsc#1012452). - btrfs: add btrfs_trans_handle->fs_info pointer (bsc#1012452). - btrfs: add bytes_readonly to the spaceinfo at once (bsc#1012452). - btrfs: add check to sysfs handler of label (bsc#1012452). - btrfs: add dynamic debug support (bsc#1012452). - btrfs: add error handling for extent buffer in print tree (bsc#1012452). - btrfs: add missing bytes_readonly attribute file in sysfs (bsc#1012452). - btrfs: add missing check for writeback errors on fsync (bsc#1012452). - btrfs: add more validation checks for superblock (bsc#1012452). - btrfs: Add ratelimit to btrfs printing (bsc#1012452). - btrfs: add read-only check to sysfs handler of features (bsc#1012452). - btrfs: add semaphore to synchronize direct IO writes with fsync (bsc#1012452). - btrfs: add tracepoint for adding block groups (bsc#1012452). - btrfs: add tracepoints for flush events (bsc#1012452). - btrfs: add validadtion checks for chunk loading (bsc#1012452). - btrfs: add write protection to SET_FEATURES ioctl (bsc#1012452). - btrfs: allow balancing to dup with multi-device (bsc#1012452). - btrfs: always reserve metadata for delalloc extents (bsc#1012452). - btrfs: always use trans->block_rsv for orphans (bsc#1012452). - btrfs: avoid blocking open_ctree from cleaner_kthread (bsc#1012452). - btrfs: avoid deadlocks during reservations in btrfs_truncate_block (bsc#1012452). - btrfs: avoid overflowing f_bfree (bsc#1012452). - btrfs: btrfs_abort_transaction, drop root parameter (bsc#1012452). - btrfs: __btrfs_buffered_write: Pass valid file offset when releasing delalloc space (bsc#1012452). - btrfs: btrfs_check_super_valid: Allow 4096 as stripesize (bsc#1012452). - btrfs: btrfs_debug should consume fs_info when DEBUG is not defined (bsc#1012452). - btrfs: btrfs_relocate_chunk pass extent_root to btrfs_end_transaction (bsc#1012452). - btrfs: build fixup for qgroup_account_snapshot (bsc#1012452). - btrfs: change BUG_ON()'s to ASSERT()'s in backref_cache_cleanup() (bsc#1012452). - btrfs: change delayed reservation fallback behavior (bsc#1012452). - btrfs: change how we calculate the global block rsv (bsc#1012452). - btrfs: check btree node's nritems (bsc#1012452). - btrfs: check if extent buffer is aligned to sectorsize (bsc#1012452). - btrfs: check inconsistence between chunk and block group (bsc#1012452). - btrfs: clarify do_chunk_alloc()'s return value (bsc#1012452). - btrfs: clean the old superblocks before freeing the device (bsc#1012452). - btrfs: clean up and optimize __check_raid_min_device() (bsc#1012452). - btrfs: cleanup assigning next active device with a check (bsc#1012452). - btrfs: cleanup BUG_ON in merge_bio (bsc#1012452). - btrfs: Cleanup compress_file_range() (bsc#1012452). - btrfs: cleanup error handling in extent_write_cached_pages (bsc#1012452). - btrfs: clear uptodate flags of pages in sys_array eb (bsc#1012452). - btrfs: clone: use vmalloc only as fallback for nodesize bufer (bsc#1012452). - btrfs: convert nodesize macros to static inlines (bsc#1012452). - btrfs: convert printk(KERN_* to use pr_* calls (bsc#1012452). - btrfs: convert pr_* to btrfs_* where possible (bsc#1012452). - btrfs: convert send's verbose_printk to btrfs_debug (bsc#1012452). - btrfs: copy_to_sk drop unused root parameter (bsc#1012452). - btrfs: create a helper function to read the disk super (bsc#1012452). - btrfs: create example debugfs file only in debugging build (bsc#1012452). - btrfs: create helper btrfs_find_device_by_user_input() (bsc#1012452). - btrfs: create helper function __check_raid_min_devices() (bsc#1012452). - btrfs: detect corruption when non-root leaf has zero item (bsc#1012452). - btrfs: divide btrfs_update_reserved_bytes() into two functions (bsc#1012452). - btrfs: do not background blkdev_put() (bsc#1012452). - btrfs: do not bother kicking async if there's nothing to reclaim (bsc#1012452). - btrfs: do not BUG_ON() in btrfs_orphan_add (bsc#1012452). - btrfs: do not create empty block group if we have allocated data (bsc#1012452). - btrfs: do not decrease bytes_may_use when replaying extents (bsc#1012452). - btrfs: do not do nocow check unless we have to (bsc#1012452). - btrfs: do not do unnecessary delalloc flushes when relocating (bsc#1012452). - btrfs: do not force mounts to wait for cleaner_kthread to delete one or more subvolumes (bsc#1012452). - btrfs: do not wait for unrelated IO to finish before relocation (bsc#1012452). - btrfs: do not WARN() in btrfs_transaction_abort() for IO errors (bsc#1035866). - btrfs: end transaction if we abort when creating uuid root (bsc#1012452). - btrfs: enhance btrfs_find_device_by_user_input() to check device path (bsc#1012452). - btrfs: error out if generic_bin_search get invalid arguments (bsc#1012452). - btrfs: expand cow_file_range() to support in-band dedup and subpage-blocksize (bsc#1012452). - btrfs: extend btrfs_set_extent_delalloc and its friends to support in-band dedupe and subpage size patchset (bsc#1012452). - btrfs: fill relocation block rsv after allocation (bsc#1012452). - btrfs: fix an integer overflow check (bsc#1012452). - btrfs: fix a possible umount deadlock (bsc#1012452). - btrfs: fix btrfs_no_printk stub helper (bsc#1012452). - btrfs: Fix BUG_ON condition in scrub_setup_recheck_block() (bsc#1012452). - btrfs: fix BUG_ON in btrfs_mark_buffer_dirty (bsc#1012452). - btrfs: fix BUG_ON in btrfs_submit_compressed_write (bsc#1012452). - btrfs: fix callers of btrfs_block_rsv_migrate (bsc#1012452). - btrfs: fix check_direct_IO() for non-iovec iterators (bsc#1012452). - btrfs: fix check_shared for fiemap ioctl (bsc#1037177). - btrfs: fix crash when tracepoint arguments are freed by wq callbacks (bsc#1012452). - btrfs: fix data loss after truncate when using the no-holes feature (bsc#1036214). - btrfs: fix deadlock in delayed_ref_async_start (bsc#1012452). - btrfs: fix delalloc reservation amount tracepoint (bsc#1012452). - btrfs: fix disk_i_size update bug when fallocate() fails (bsc#1012452). - btrfs: fix divide error upon chunk's stripe_len (bsc#1012452). - btrfs: fix double free of fs root (bsc#1012452). - btrfs: fix eb memory leak due to readpage failure (bsc#1012452). - btrfs: fix em leak in find_first_block_group (bsc#1012452). - btrfs: fix emptiness check for dirtied extent buffers at check_leaf() (bsc#1012452). - btrfs: fix error handling in map_private_extent_buffer (bsc#1012452). - btrfs: fix error return code in btrfs_init_test_fs() (bsc#1012452). - btrfs: fix free space calculation in dump_space_info() (bsc#1012452). - btrfs: fix fsfreeze hang caused by delayed iputs deal (bsc#1012452). - btrfs: fix fspath error deallocation (bsc#1012452). - btrfs: fix int32 overflow in shrink_delalloc() (bsc#1012452). - btrfs: Fix integer overflow when calculating bytes_per_bitmap (bsc#1012452). - btrfs: fix invalid dereference in btrfs_retry_endio (bsc#1040395). - btrfs: fix lock dep warning, move scratch dev out of device_list_mutex and uuid_mutex (bsc#1012452). - btrfs: fix lock dep warning move scratch super outside of chunk_mutex (bsc#1012452). - btrfs: fix __MAX_CSUM_ITEMS (bsc#1012452). - btrfs: fix memory leak during RAID 5/6 device replacement (bsc#1012452). - btrfs: fix memory leak of block group cache (bsc#1012452). - btrfs: fix memory leak of reloc_root (bsc#1012452). - btrfs: fix mixed block count of available space (bsc#1012452). - btrfs: fix one bug that process may endlessly wait for ticket in wait_reserve_ticket() (bsc#1012452). - btrfs: fix panic in balance due to EIO (bsc#1012452). - btrfs: fix race between block group relocation and nocow writes (bsc#1012452). - btrfs: fix race between device replace and block group removal (bsc#1012452). - btrfs: fix race between device replace and chunk allocation (bsc#1012452). - btrfs: fix race between device replace and discard (bsc#1012452). - btrfs: fix race between device replace and read repair (bsc#1012452). - btrfs: fix race between fsync and direct IO writes for prealloc extents (bsc#1012452). - btrfs: fix race between readahead and device replace/removal (bsc#1012452). - btrfs: fix race setting block group back to RW mode during device replace (bsc#1012452). - btrfs: fix race setting block group readonly during device replace (bsc#1012452). - btrfs: fix read_node_slot to return errors (bsc#1012452). - btrfs: fix release reserved extents trace points (bsc#1012452). - btrfs: fix segmentation fault when doing dio read (bsc#1040425). - btrfs: Fix slab accounting flags (bsc#1012452). - btrfs: fix unexpected return value of fiemap (bsc#1012452). - btrfs: fix unprotected assignment of the left cursor for device replace (bsc#1012452). - btrfs: fix WARNING in btrfs_select_ref_head() (bsc#1012452). - btrfs: flush_space: treat return value of do_chunk_alloc properly (bsc#1012452). - btrfs: Force stripesize to the value of sectorsize (bsc#1012452). - btrfs: free sys_array eb as soon as possible (bsc#1012452). - btrfs: GFP_NOFS does not GFP_HIGHMEM (bsc#1012452). - btrfs: Handle uninitialised inode eviction (bsc#1012452). - btrfs: hide test-only member under ifdef (bsc#1012452). - btrfs: improve check_node to avoid reading corrupted nodes (bsc#1012452). - btrfs: introduce BTRFS_MAX_ITEM_SIZE (bsc#1012452). - btrfs: introduce device delete by devid (bsc#1012452). - btrfs: introduce raid-type to error-code table, for minimum device constraint (bsc#1012452). - btrfs: introduce ticketed enospc infrastructure (bsc#1012452). - btrfs: introduce tickets_id to determine whether asynchronous metadata reclaim work makes progress (bsc#1012452). - btrfs: ioctl: reorder exclusive op check in RM_DEV (bsc#1012452). - btrfs: kill BUG_ON in do_relocation (bsc#1012452). - btrfs: kill BUG_ON in run_delayed_tree_ref (bsc#1012452). - btrfs: kill BUG_ON()'s in btrfs_mark_extent_written (bsc#1012452). - btrfs: kill invalid ASSERT() in process_all_refs() (bsc#1012452). - btrfs: kill the start argument to read_extent_buffer_pages (bsc#1012452). - btrfs: kill unused writepage_io_hook callback (bsc#1012452). - btrfs: make find_workspace always succeed (bsc#1012452). - btrfs: make find_workspace warn if there are no workspaces (bsc#1012452). - btrfs: make mapping->writeback_index point to the last written page (bsc#1012452). - btrfs: make state preallocation more speculative in __set_extent_bit (bsc#1012452). - btrfs: make sure device is synced before return (bsc#1012452). - btrfs: make use of btrfs_find_device_by_user_input() (bsc#1012452). - btrfs: make use of btrfs_scratch_superblocks() in btrfs_rm_device() (bsc#1012452). - btrfs: memset to avoid stale content in btree leaf (bsc#1012452). - btrfs: memset to avoid stale content in btree node block (bsc#1012452). - btrfs: move error handling code together in ctree.h (bsc#1012452). - btrfs: optimize check for stale device (bsc#1012452). - btrfs: parent_start initialization cleanup (bsc#1012452). - btrfs: pass correct args to btrfs_async_run_delayed_refs() (bsc#1012452). - btrfs: pass number of devices to btrfs_check_raid_min_devices (bsc#1012452). - btrfs: pass the right error code to the btrfs_std_error (bsc#1012452). - btrfs: preallocate compression workspaces (bsc#1012452). - btrfs: Ratelimit "no csum found" info message (bsc#1012452). - btrfs: refactor btrfs_dev_replace_start for reuse (bsc#1012452). - btrfs: Refactor btrfs_lock_cluster() to kill compiler warning (bsc#1012452). - btrfs: remove BUG() in raid56 (bsc#1012452). - btrfs: remove BUG_ON in start_transaction (bsc#1012452). - btrfs: remove BUG_ON()'s in btrfs_map_block (bsc#1012452). - btrfs: remove build fixup for qgroup_account_snapshot (bsc#1012452). - btrfs: remove save_error_info() (bsc#1012452). - btrfs: remove unnecessary btrfs_mark_buffer_dirty in split_leaf (bsc#1012452). - btrfs: remove unused function btrfs_assert() (bsc#1012452). - btrfs: rename and document compression workspace members (bsc#1012452). - btrfs: rename btrfs_find_device_by_user_input (bsc#1012452). - btrfs: rename btrfs_std_error to btrfs_handle_fs_error (bsc#1012452). - btrfs: rename __check_raid_min_devices (bsc#1012452). - btrfs: rename flags for vol args v2 (bsc#1012452). - btrfs: reorg btrfs_close_one_device() (bsc#1012452). - btrfs: Replace -ENOENT by -ERANGE in btrfs_get_acl() (bsc#1012452). - btrfs: reuse existing variable in scrub_stripe, reduce stack usage (bsc#1012452). - btrfs: s_bdev is not null after missing replace (bsc#1012452). - btrfs: scrub: Set bbio to NULL before calling btrfs_map_block (bsc#1012452). - btrfs: send: silence an integer overflow warning (bsc#1012452). - btrfs: send: use temporary variable to store allocation size (bsc#1012452). - btrfs: send: use vmalloc only as fallback for clone_roots (bsc#1012452). - btrfs: send: use vmalloc only as fallback for clone_sources_tmp (bsc#1012452). - btrfs: send: use vmalloc only as fallback for read_buf (bsc#1012452). - btrfs: send: use vmalloc only as fallback for send_buf (bsc#1012452). - btrfs: Simplify conditions about compress while mapping btrfs flags to inode flags (bsc#1012452). - btrfs: sink gfp parameter to clear_extent_bits (bsc#1012452). - btrfs: sink gfp parameter to clear_extent_dirty (bsc#1012452). - btrfs: sink gfp parameter to clear_record_extent_bits (bsc#1012452). - btrfs: sink gfp parameter to convert_extent_bit (bsc#1012452). - btrfs: sink gfp parameter to set_extent_bits (bsc#1012452). - btrfs: sink gfp parameter to set_extent_defrag (bsc#1012452). - btrfs: sink gfp parameter to set_extent_delalloc (bsc#1012452). - btrfs: sink gfp parameter to set_extent_new (bsc#1012452). - btrfs: sink gfp parameter to set_record_extent_bits (bsc#1012452). - btrfs: skip commit transaction if we do not have enough pinned bytes (bsc#1037186). - btrfs: subpage-blocksize: Rate limit scrub error message (bsc#1012452). - btrfs: switch to common message helpers in open_ctree, adjust messages (bsc#1012452). - btrfs: sysfs: protect reading label by lock (bsc#1012452). - btrfs: trace pinned extents (bsc#1012452). - btrfs: track transid for delayed ref flushing (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, document subvol flags (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, move balance flags (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, move BTRFS_LABEL_SIZE (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, move feature flags (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, move struct btrfs_ioctl_defrag_range_args (bsc#1012452). - btrfs: uapi/linux/btrfs.h migration, qgroup limit flags (bsc#1012452). - btrfs: uapi/linux/btrfs_tree.h migration, item types and defines (bsc#1012452). - btrfs: uapi/linux/btrfs_tree.h, use __u8 and __u64 (bsc#1012452). - btrfs: unsplit printed strings (bsc#1012452). - btrfs: untangle gotos a bit in __clear_extent_bit (bsc#1012452). - btrfs: untangle gotos a bit in convert_extent_bit (bsc#1012452). - btrfs: untangle gotos a bit in __set_extent_bit (bsc#1012452). - btrfs: update btrfs_space_info's bytes_may_use timely (bsc#1012452). - btrfs: Use correct format specifier (bsc#1012452). - btrfs: use correct offset for reloc_inode in prealloc_file_extent_cluster() (bsc#1012452). - btrfs: use dynamic allocation for root item in create_subvol (bsc#1012452). - btrfs: use existing device constraints table btrfs_raid_array (bsc#1012452). - btrfs: use FLUSH_LIMIT for relocation in reserve_metadata_bytes (bsc#1012452). - btrfs: use fs_info directly (bsc#1012452). - btrfs: use new error message helper in qgroup_account_snapshot (bsc#1012452). - btrfs: use root when checking need_async_flush (bsc#1012452). - btrfs: use the correct struct for BTRFS_IOC_LOGICAL_INO (bsc#1012452). - btrfs: Use __u64 in exported linux/btrfs.h (bsc#1012452). - btrfs: warn_on for unaccounted spaces (bsc#1012452). - ceph: check i_nlink while converting a file handle to dentry (bsc#1039864). - ceph: Check that the new inode size is within limits in ceph_fallocate() (bsc#1037969). - ceph: Correctly return NXIO errors from ceph_llseek (git-fixes). - ceph: fix file open flags on ppc64 (bsc#1022266). - ceph: fix memory leak in __ceph_setxattr() (bsc#1036763). - cifs: backport prepath matching fix (bsc#799133). - clk: Make x86/ conditional on CONFIG_COMMON_CLK (4.4.68 stable queue). - cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores (4.4.68 stable queue). - crypto: algif_aead - Require setkey before accept(2) (bsc#1031717). - crypto: sha-mb - Fix load failure (bsc#1037384). - dell-laptop: Adds support for keyboard backlight timeout AC settings (bsc#1013561). - Disable CONFIG_POWER_SUPPLY_DEBUG in debug kernel (bsc#1031500). - dmaengine: dw: fix typo in Kconfig (bsc#1031717). - dm: fix dm_target_io leak if clone_bio() returns an error (bsc#1040125). - dm-mpath: fix race window in do_end_io() (bsc#1011044). - dm round robin: do not use this_cpu_ptr() without having preemption disabled (bsc#1040125). - dm verity fec: fix block calculation (bsc#1040125). - dm verity fec: fix bufio leaks (bsc#1040125). - dm verity fec: limit error correction recursion (bsc#1040125). - drivers: base: dma-mapping: Fix typo in dmam_alloc_non_coherent comments (bsc#1031717). - drivers/tty: 8250: only call fintek_8250_probe when doing port I/O (bsc#1031717). - drm/i915: Disable tv output on i9x5gm (bsc#1039700). - drm/i915: Do not touch NULL sg on i915_gem_object_get_pages_gtt() error (bsc#1031717). - drm/i915: Fix mismatched INIT power domain disabling during suspend (bsc#1031717). - drm/i915: Nuke debug messages from the pipe update critical section (bsc#1031717). - drm/i915: Program iboost settings for HDMI/DVI on SKL (bsc#1031717). - drm/i915: relax uncritical udelay_range() (bsc#1031717). - drm/i915: relax uncritical udelay_range() settings (bsc#1031717). - drm/i915: Use pagecache write to prepopulate shmemfs from pwrite-ioctl (bsc#1040463). - drm/ttm: fix use-after-free races in vm fault handling (4.4.68 stable queue). - e1000e: Do not return uninitialized stats (bug#1034635). - enic: set skb->hash type properly (bsc#922871 fate#318754). - f2fs: fix bad prefetchw of NULL page (bsc#1012829). - f2fs: sanity check segment count (4.4.68 stable queue). - fnic: Return 'DID_IMM_RETRY' if rport is not ready (bsc#1035920). - fs/block_dev: always invalidate cleancache in invalidate_bdev() (git-fixes). - fs: fix data invalidation in the cleancache during direct IO (git-fixes). - fs/xattr.c: zero out memory copied to userspace in getxattr (git-fixes). - ftrace: Make ftrace_location_range() global (FATE#322421). - ibmvnic: Add set_link_state routine for setting adapter link state (fate#322021, bsc#1031512). - ibmvnic: Allocate zero-filled memory for sub crqs (fate#322021, bsc#1031512). - ibmvnic: Check for driver reset first in ibmvnic_xmit (fate#322021, bsc#1038297). - ibmvnic: Cleanup failure path in ibmvnic_open (fate#322021, bsc#1031512). - ibmvnic: Clean up tx pools when closing (fate#322021, bsc#1038297). - ibmvnic: Continue skb processing after skb completion error (fate#322021, bsc#1038297). - ibmvnic: Correct crq and resource releasing (fate#322021, bsc#1031512). - ibmvnic: Create init and release routines for the bounce buffer (fate#322021, bsc#1031512). - ibmvnic: Create init and release routines for the rx pool (fate#322021, bsc#1031512). - ibmvnic: Create init and release routines for the tx pool (fate#322021, bsc#1031512). - ibmvnic: Create init/release routines for stats token (fate#322021, bsc#1031512). - ibmvnic: Delete napi's when releasing driver resources (fate#322021, bsc#1038297). - ibmvnic: Disable irq prior to close (fate#322021, bsc#1031512). - ibmvnic: Do not disable IRQ after scheduling tasklet (fate#322021, bsc#1031512). - ibmvnic: Fix ibmvnic_change_mac_addr struct format (fate#322021, bsc#1031512). - ibmvnic: fix missing unlock on error in __ibmvnic_reset() (fate#322021, bsc#1038297, Fixes: ed651a10875f). - ibmvnic: Fixup atomic API usage (fate#322021, bsc#1031512). - ibmvnic: Free skb's in cases of failure in transmit (fate#322021, bsc#1031512). - ibmvnic: Insert header on VLAN tagged received frame (fate#322021, bsc#1031512). - ibmvnic: Merge the two release_sub_crq_queue routines (fate#322021, bsc#1031512). - ibmvnic: Move initialization of sub crqs to ibmvnic_init (fate#322021, bsc#1031512). - ibmvnic: Move initialization of the stats token to ibmvnic_open (fate#322021, bsc#1031512). - ibmvnic: Move queue restarting in ibmvnic_tx_complete (fate#322021, bsc#1038297). - ibmvnic: Move resource initialization to its own routine (fate#322021, bsc#1038297). - ibmvnic: Only retrieve error info if present (fate#322021, bsc#1031512). - ibmvnic: Record SKB RX queue during poll (fate#322021, bsc#1038297). - ibmvnic: Remove debugfs support (fate#322021, bsc#1031512). - ibmvnic: Remove inflight list (fate#322021, bsc#1031512). - ibmvnic: Remove unused bouce buffer (fate#322021, bsc#1031512). - ibmvnic: Replace is_closed with state field (fate#322021, bsc#1038297). - ibmvnic: Report errors when failing to release sub-crqs (fate#322021, bsc#1031512). - ibmvnic: Set real number of rx queues (fate#322021, bsc#1031512). - ibmvnic: Split initialization of scrqs to its own routine (fate#322021, bsc#1031512). - ibmvnic: Unmap longer term buffer before free (fate#322021, bsc#1031512). - ibmvnic: Updated reset handling (fate#322021, bsc#1038297). - ibmvnic: Update main crq initialization and release (fate#322021, bsc#1031512). - ibmvnic: Validate napi exist before disabling them (fate#322021, bsc#1031512). - ibmvnic: Wait for any pending scrqs entries at driver close (fate#322021, bsc#1038297). - ibmvnic: Whitespace correction in release_rx_pools (fate#322021, bsc#1038297). - iio: hid-sensor: Store restore poll and hysteresis on S3 (bsc#1031717). - iio: Workaround for kABI breakage by 4.4.67 iio hid-sensor changes (stable-4.4.67). - infiniband: avoid dereferencing uninitialized dst on error path (git-fixes). - iommu/arm-smmu: Disable stalling faults for all endpoints (bsc#1038843). - iommu/dma: Respect IOMMU aperture when allocating (bsc#1038842). - iommu/exynos: Block SYSMMU while invalidating FLPD cache (bsc#1038848). - iommu: Handle default domain attach failure (bsc#1038846). - iommu/vt-d: Do not over-free page table directories (bsc#1038847). - ipv4, ipv6: ensure raw socket message is big enough to hold an IP header (4.4.68 stable queue). - ipv6: initialize route null entry in addrconf_init() (4.4.68 stable queue). - ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf (4.4.68 stable queue). - isa: Call isa_bus_init before dependent ISA bus drivers register (bsc#1031717). - iw_cxgb4: Guard against null cm_id in dump_ep/qp (bsc#1026570). - KABI: Hide new include in arch/powerpc/kernel/process.c (fate#322421). - kABI: move and hide new cxgbi device owner field (bsc#1018885). - kABI: protect cgroup include in kernel/kthread (kabi). - kABI: protect struct mnt_namespace (kabi). - kABI: protect struct snd_fw_async_midi_port (kabi). - kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed (4.4.68 stable queue). - kvm: better MWAIT emulation for guests (bsc#1031142). - kvm: nVMX: do not leak PML full vmexit to L1 (4.4.68 stable queue). - kvm: nVMX: initialize PML fields in vmcs02 (4.4.68 stable queue). - leds: ktd2692: avoid harmless maybe-uninitialized warning (4.4.68 stable queue). - libata-scsi: Fixup ata_gen_passthru_sense() (bsc#1040125). - lib/mpi: mpi_read_raw_data(): fix nbits calculation (bsc#1003581). - lib/mpi: mpi_read_raw_data(): purge redundant clearing of nbits (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): do not include leading zero SGEs in nbytes (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): fix nbits calculation (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): fix out-of-bounds buffer access (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): purge redundant clearing of nbits (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): replace len argument by nbytes (bsc#1003581). - lib/mpi: mpi_read_raw_from_sgl(): sanitize meaning of indices (bsc#1003581). - libnvdimm, pfn: fix 'npfns' vs section alignment (bsc#1040125). - livepatch: Allow architectures to specify an alternate ftrace location (FATE#322421). - locking/ww_mutex: Fix compilation of __WW_MUTEX_INITIALIZER (bsc#1031717). - lpfc: remove incorrect lockdep assertion (bsc#1040125). - md.c:didn't unlock the mddev before return EINVAL in array_size_store (bsc#1038143). - md-cluster: fix potential lock issue in add_new_disk (bsc#1041087). - md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop (bsc#1038142). - md/raid1: avoid reusing a resync bio after error handling (Fate#311379). - media: am437x-vpfe: fix an uninitialized variable bug (bsc#1031717). - media: b2c2: use IS_REACHABLE() instead of open-coding it (bsc#1031717). - media: c8sectpfe: Rework firmware loading mechanism (bsc#1031717). - media: cx231xx-audio: fix NULL-deref at probe (bsc#1031717). - media: cx231xx-cards: fix NULL-deref at probe (bsc#1031717). - media: cx23885: uninitialized variable in cx23885_av_work_handler() (bsc#1031717). - media: DaVinci-VPBE: Check return value of a setup_if_config() call in vpbe_set_output() (bsc#1031717). - media: DaVinci-VPFE-Capture: fix error handling (bsc#1031717). - media: dib0700: fix NULL-deref at probe (bsc#1031717). - media: dvb-usb: avoid link error with dib3000m{b,c| (bsc#1031717). - media: exynos4-is: fix a format string bug (bsc#1031717). - media: gspca: konica: add missing endpoint sanity check (bsc#1031717). - media: lirc_imon: do not leave imon_probe() with mutex held (bsc#1031717). - media: pvrusb2: reduce stack usage pvr2_eeprom_analyze() (bsc#1031717). - media: rc: allow rc modules to be loaded if rc-main is not a module (bsc#1031717). - media: s5p-mfc: Fix unbalanced call to clock management (bsc#1031717). - media: sh-vou: clarify videobuf2 dependency (bsc#1031717). - media: staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs() (bsc#1031717). - media: usbvision: fix NULL-deref at probe (bsc#1031717). - media: uvcvideo: Fix empty packet statistic (bsc#1031717). - mips: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix (4.4.68 stable queue). - mmc: debugfs: correct wrong voltage value (bsc#1031717). - mm,compaction: serialize waitqueue_active() checks (bsc#971975). - mmc: sdhci-pxav3: fix higher speed mode capabilities (bsc#1031717). - mmc: sdhci: restore behavior when setting VDD via external regulator (bsc#1031717). - mm: fix <linux/pagemap.h> stray kernel-doc notation (bnc#971975 VM -- git fixes). - mwifiex: Avoid skipping WEP key deletion for AP (4.4.68 stable queue). - mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print (4.4.68 stable queue). - mwifiex: pcie: fix cmd_buf use-after-free in remove/reset (bsc#1031717). - mwifiex: Removed unused 'pkt_type' variable (bsc#1031717). - mwifiex: remove redundant dma padding in AMSDU (4.4.68 stable queue). - mwifiex: Remove unused 'bcd_usb' variable (bsc#1031717). - mwifiex: Remove unused 'chan_num' variable (bsc#1031717). - mwifiex: Remove unused 'pm_flag' variable (bsc#1031717). - mwifiex: Remove unused 'sta_ptr' variable (bsc#1031717). - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670). - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670). - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670). - nfs: Fix inode corruption in nfs_prime_dcache() (git-fixes). - nfs: Fix missing pg_cleanup after nfs_pageio_cond_complete() (git-fixes). - nfs: Use GFP_NOIO for two allocations in writeback (git-fixes). - nfsv4.1: Fix Oopsable condition in server callback races (git-fixes). - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (bsc#1004003). - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (bsc#1004003). - pci: pciehp: Prioritize data-link event over presence detect (bsc#1031040,bsc#1037483). - pci: Reverse standard ACS vs device-specific ACS enabling (bsc#1030057). - pci: Work around Intel Sunrise Point PCH incorrect ACS capability (bsc#1030057). - perf/x86/intel/uncore: Remove SBOX support for Broadwell server (bsc#1035887). - phy: qcom-usb-hs: Add depends on EXTCON (4.4.68 stable queue). - pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes (bnc#1012985). - PKCS#7: fix missing break on OID_sha224 case (bsc#1031717). - platform/x86: fujitsu-laptop: use brightness_set_blocking for LED-setting callbacks (bsc#1031717). - PM / wakeirq: Enable dedicated wakeirq for suspend (bsc#1031717). - PM / wakeirq: Fix spurious wake-up events for dedicated wakeirqs (bsc#1031717). - PM / wakeirq: report a wakeup_event on dedicated wekup irq (bsc#1031717). - power: bq27xxx: fix register numbers of bq27500 (bsc#1031717). - powerpc: Create a helper for getting the kernel toc value (FATE#322421). - powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel (FATE#322421). - powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI (FATE#322421). - powerpc/ftrace: Use $(CC_FLAGS_FTRACE) when disabling ftrace (FATE#322421). - powerpc/ftrace: Use generic ftrace_modify_all_code() (FATE#322421). - powerpc: introduce TIF_KGR_IN_PROGRESS thread flag (FATE#322421). - powerpc/livepatch: Add livepatch header (FATE#322421). - powerpc/livepatch: Add live patching support on ppc64le (FATE#322421). - powerpc/livepatch: Add livepatch stack to struct thread_info (FATE#322421). - powerpc/module: Create a special stub for ftrace_caller() (FATE#322421). - powerpc/module: Mark module stubs with a magic value (FATE#322421). - powerpc/module: Only try to generate the ftrace_caller() stub once (FATE#322421). - powerpc/modules: Never restore r2 for a mprofile-kernel style mcount() call (FATE#322421). - powerpc/powernv: Fix opal_exit tracepoint opcode (4.4.68 stable queue). - power: supply: bq24190_charger: Call power_supply_changed() for relevant component (4.4.68 stable queue). - power: supply: bq24190_charger: Call set_mode_host() on pm_resume() (4.4.68 stable queue). - power: supply: bq24190_charger: Do not read fault register outside irq_handle_thread() (4.4.68 stable queue). - power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING (4.4.68 stable queue). - power: supply: bq24190_charger: Handle fault before status on interrupt (4.4.68 stable queue). - power: supply: bq24190_charger: Install irq_handler_thread() at end of probe() (4.4.68 stable queue). - ppc64le: Update ppc64le config files to use KGRAFT. - printk: Switch to the sync mode when an emergency message is printed (bsc#1034995). - RDMA/iw_cxgb4: Add missing error codes for act open cmd (bsc#1026570). - RDMA/iw_cxgb4: Low resource fixes for Completion queue (bsc#1026570). - RDMA/iw_cxgb4: only read markers_enabled mod param once (bsc#1026570). - regulator: isl9305: fix array size (bsc#1031717). - Revert "acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)" (kabi). - Revert "KVM: nested VMX: disable perf cpuid reporting" (4.4.68 stable queue). - Revert "l2tp: take reference on sessions being dumped" (kabi). - Revert "mac80211: pass block ack session timeout to to driver" (kabi). - Revert "mac80211: RX BA support for sta max_rx_aggregation_subframes" (kabi). - Revert "wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event" (kabi). - rpm/SLES-UEFI-SIGN-Certificate-2048.crt: Update the certificate (bsc#1035922) - rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string (4.4.68 stable queue). - s390/dasd: check if query host access feature is supported (bsc#1037871). - scsi: be2iscsi: Add FUNCTION_RESET during driver unload (bsc#1038458). - scsi: be2iscsi: Add IOCTL to check UER supported (bsc#1038458). - scsi: be2iscsi: Add TPE recovery feature (bsc#1038458). - scsi: be2iscsi: Add V1 of EPFW cleanup IOCTL (bsc#1038458). - scsi: be2iscsi: allocate enough memory in beiscsi_boot_get_sinfo() (bsc#1038458). - scsi: be2iscsi: Check all zeroes IP before issuing IOCTL (bsc#1038458). - scsi: be2iscsi: Fail the sessions immediately after TPE (bsc#1038458). - scsi: be2iscsi: Fix async PDU handling path (bsc#1038458). - scsi: be2iscsi: Fix bad WRB index error (bsc#1038458). - scsi: be2iscsi: Fix checks for HBA in error state (bsc#1038458). - scsi: be2iscsi: Fix gateway APIs to support IPv4 & IPv6 (bsc#1038458). - scsi: be2iscsi: Fix POST check and reset sequence (bsc#1038458). - scsi: be2iscsi: Fix queue and connection parameters (bsc#1038458). - scsi: be2iscsi: Fix release of DHCP IP in static mode (bsc#1038458). - scsi: be2iscsi: Fix to add timer for UE detection (bsc#1038458). - scsi: be2iscsi: Fix to make boot discovery non-blocking (bsc#1038458). - scsi: be2iscsi: Fix to use correct configuration values (bsc#1038458). - scsi: be2iscsi: Handle only NET_PARAM in iface_get_param (bsc#1038458). - scsi: be2iscsi: Move functions to right files (bsc#1038458). - scsi: be2iscsi: Move VLAN code to common iface_set_param (bsc#1038458). - scsi: be2iscsi: Reduce driver load/unload time (bsc#1038458). - scsi: be2iscsi: Remove alloc_mcc_tag & beiscsi_pci_soft_reset (bsc#1038458). - scsi: be2iscsi: Remove isr_lock and dead code (bsc#1038458). - scsi: be2iscsi: Rename iface get/set/create/destroy APIs (bsc#1038458). - scsi: be2iscsi: Replace _bh version for mcc_lock spinlock (bsc#1038458). - scsi: be2iscsi: Set and return right iface v4/v6 states (bsc#1038458). - scsi: be2iscsi: Update copyright information (bsc#1038458). - scsi: be2iscsi: Update iface handle before any set param (bsc#1038458). - scsi: be2iscsi: Update the driver version (bsc#1038458). - scsi: cxgb4i: libcxgbi: add missing module_put() (bsc#1018885). - scsi: cxlflash: Remove the device cleanly in the system shutdown path (bsc#1028310, fate#321597, bsc#1034762). cherry-pick from SP3 - scsi_dh_alua: do not call BUG_ON when updating port group (bsc#1028340). - scsi_dh_alua: Do not retry for unmapped device (bsc#1012910). - scsi: fnic: Correcting rport check location in fnic_queuecommand_lck (bsc#1035920). - scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m (4.4.68 stable queue). - scsi: scsi_dh_alua: Check scsi_device_get() return value (bsc#1040125). - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (4.4.68 stable queue). - serial: 8250_omap: Fix probe and remove for PM runtime (4.4.68 stable queue). - staging: emxx_udc: remove incorrect __init annotations (4.4.68 stable queue). - staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() (bsc#1031717). - staging: wlan-ng: add missing byte order conversion (4.4.68 stable queue). - sunrpc: Allow xprt->ops->timer method to sleep (git-fixes). - sunrpc: fix UDP memory accounting (git-fixes). - tcp: do not inherit fastopen_req from parent (4.4.68 stable queue). - tcp: do not underestimate skb->truesize in tcp_trim_head() (4.4.68 stable queue). - tcp: fix wraparound issue in tcp_lp (4.4.68 stable queue). - tracing/kprobes: Enforce kprobes teardown after testing (bnc#1012985). - usb: chipidea: Handle extcon events properly (4.4.68 stable queue). - usb: chipidea: Only read/write OTGSC from one place (4.4.68 stable queue). - usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths (4.4.68 stable queue). - usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths (4.4.68 stable queue). - usb: musb: ux500: Fix NULL pointer dereference at system PM (bsc#1038033). - usb: serial: ark3116: fix open error handling (bnc#1038043). - usb: serial: ch341: add register and USB request definitions (bnc#1038043). - usb: serial: ch341: add support for parity, frame length, stop bits (bnc#1038043). - usb: serial: ch341: fix baud rate and line-control handling (bnc#1038043). - usb: serial: ch341: fix line settings after reset-resume (bnc#1038043). - usb: serial: ch341: fix modem-status handling (bnc#1038043). - usb: serial: ch341: reinitialize chip on reconfiguration (bnc#1038043). - usb: serial: digi_acceleport: fix incomplete rx sanity check (4.4.68 stable queue). - usb: serial: fix compare_const_fl.cocci warnings (bnc#1038043). - usb: serial: ftdi_sio: fix latency-timer error handling (4.4.68 stable queue). - usb: serial: io_edgeport: fix descriptor error handling (4.4.68 stable queue). - usb: serial: io_edgeport: fix epic-descriptor handling (bnc#1038043). - usb: serial: keyspan_pda: fix receive sanity checks (4.4.68 stable queue). - usb: serial: mct_u232: fix modem-status error handling (4.4.68 stable queue). - usb: serial: quatech2: fix control-message error handling (bnc#1038043). - usb: serial: sierra: fix bogus alternate-setting assumption (bnc#1038043). - usb: serial: ssu100: fix control-message error handling (bnc#1038043). - usb: serial: ti_usb_3410_5052: fix control-message error handling (4.4.68 stable queue). - Use make --output-sync feature when available (bsc#1012422). The mesages in make output can interleave making it impossible to extract warnings reliably. Since version 4 GNU Make supports --output-sync flag that prints output of each sub-command atomically preventing this issue. Detect the flag and use it if available. - Use up spare in struct module for livepatch (FATE#322421). - vsock: Detach QP check should filter out non matching QPs (bsc#1036752). - x86/ioapic: Restore IO-APIC irq_chip retrigger callback (4.4.68 stable queue). - x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0 (4.4.68 stable queue). - x86/platform/intel-mid: Correct MSI IRQ line for watchdog device (4.4.68 stable queue). - x86/platform/uv/BAU: Add generic function pointers (bsc#1035024). - x86/platform/uv/BAU: Add payload descriptor qualifier (bsc#1035024). - x86/platform/uv/BAU: Add status mmr location fields to bau_control (bsc#1035024). - x86/platform/uv/BAU: Add UV4-specific functions (bsc#1035024). - x86/platform/uv/BAU: Add uv_bau_version enumerated constants (bsc#1035024). - x86/platform/uv/BAU: Add wait_completion to bau_operations (bsc#1035024). - x86/platform/uv/BAU: Clean up and update printks (bsc#1035024). - x86/platform/uv/BAU: Cleanup bau_operations declaration and instances (bsc#1035024). - x86/platform/uv/BAU: Clean up pq_init() (bsc#1035024). - x86/platform/uv/BAU: Clean up vertical alignment (bsc#1035024). - x86/platform/uv/BAU: Convert uv_physnodeaddr() use to uv_gpa_to_offset() (bsc#1035024). - x86/platform/uv/BAU: Disable software timeout on UV4 hardware (bsc#1035024). - x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register (bsc#1035024). - x86/platform/uv/BAU: Fix payload queue setup on UV4 hardware (bsc#1035024). - x86/platform/uv/BAU: Implement uv4_wait_completion with read_status (bsc#1035024). - x86/platform/uv/BAU: Populate ->uvhub_version with UV4 version information (bsc#1035024). - x86/platform/uv/BAU: Use generic function pointers (bsc#1035024). - xen: adjust early dom0 p2m handling to xen hypervisor behavior (bnc#1031470). - xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1041160). - xfs: fix eofblocks race with file extending async dio writes (bsc#1040929). - xfs: Fix missed holes in SEEK_HOLE implementation (bsc#1041168). - xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() (bsc#1041168). - xfs: in _attrlist_by_handle, copy the cursor back to userspace (bsc#1041242). - xfs: only return -errno or success from attr ->put_listent (bsc#1041242). - xfs: Split default quota limits by quota type (bsc#1040941). - xfs: use ->b_state to fix buffer I/O accounting release race (bsc#1041160). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-666=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.70-18.9.1 kernel-docs-4.4.70-18.9.2 kernel-docs-html-4.4.70-18.9.2 kernel-docs-pdf-4.4.70-18.9.2 kernel-macros-4.4.70-18.9.1 kernel-source-4.4.70-18.9.1 kernel-source-vanilla-4.4.70-18.9.1 - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.70-18.9.1 kernel-debug-base-4.4.70-18.9.1 kernel-debug-base-debuginfo-4.4.70-18.9.1 kernel-debug-debuginfo-4.4.70-18.9.1 kernel-debug-debugsource-4.4.70-18.9.1 kernel-debug-devel-4.4.70-18.9.1 kernel-debug-devel-debuginfo-4.4.70-18.9.1 kernel-default-4.4.70-18.9.1 kernel-default-base-4.4.70-18.9.1 kernel-default-base-debuginfo-4.4.70-18.9.1 kernel-default-debuginfo-4.4.70-18.9.1 kernel-default-debugsource-4.4.70-18.9.1 kernel-default-devel-4.4.70-18.9.1 kernel-obs-build-4.4.70-18.9.1 kernel-obs-build-debugsource-4.4.70-18.9.1 kernel-obs-qa-4.4.70-18.9.1 kernel-syms-4.4.70-18.9.1 kernel-vanilla-4.4.70-18.9.1 kernel-vanilla-base-4.4.70-18.9.1 kernel-vanilla-base-debuginfo-4.4.70-18.9.1 kernel-vanilla-debuginfo-4.4.70-18.9.1 kernel-vanilla-debugsource-4.4.70-18.9.1 kernel-vanilla-devel-4.4.70-18.9.1 References: https://www.suse.com/security/cve/CVE-2017-7487.html https://www.suse.com/security/cve/CVE-2017-7645.html https://www.suse.com/security/cve/CVE-2017-8890.html https://www.suse.com/security/cve/CVE-2017-9074.html https://www.suse.com/security/cve/CVE-2017-9075.html https://www.suse.com/security/cve/CVE-2017-9076.html https://www.suse.com/security/cve/CVE-2017-9077.html https://www.suse.com/security/cve/CVE-2017-9150.html https://bugzilla.suse.com/1003581 https://bugzilla.suse.com/1004003 https://bugzilla.suse.com/1011044 https://bugzilla.suse.com/1012422 https://bugzilla.suse.com/1012452 https://bugzilla.suse.com/1012829 https://bugzilla.suse.com/1012910 https://bugzilla.suse.com/1012985 https://bugzilla.suse.com/1013561 https://bugzilla.suse.com/1018885 https://bugzilla.suse.com/1020412 https://bugzilla.suse.com/1022266 https://bugzilla.suse.com/1026570 https://bugzilla.suse.com/1028310 https://bugzilla.suse.com/1028340 https://bugzilla.suse.com/1029607 https://bugzilla.suse.com/1030057 https://bugzilla.suse.com/1031040 https://bugzilla.suse.com/1031142 https://bugzilla.suse.com/1031470 https://bugzilla.suse.com/1031500 https://bugzilla.suse.com/1031512 https://bugzilla.suse.com/1031717 https://bugzilla.suse.com/1034635 https://bugzilla.suse.com/1034670 https://bugzilla.suse.com/1034762 https://bugzilla.suse.com/1034995 https://bugzilla.suse.com/1035024 https://bugzilla.suse.com/1035866 https://bugzilla.suse.com/1035887 https://bugzilla.suse.com/1035920 https://bugzilla.suse.com/1035922 https://bugzilla.suse.com/1036214 https://bugzilla.suse.com/1036752 https://bugzilla.suse.com/1036763 https://bugzilla.suse.com/1037177 https://bugzilla.suse.com/1037186 https://bugzilla.suse.com/1037384 https://bugzilla.suse.com/1037483 https://bugzilla.suse.com/1037871 https://bugzilla.suse.com/1037969 https://bugzilla.suse.com/1038033 https://bugzilla.suse.com/1038043 https://bugzilla.suse.com/1038142 https://bugzilla.suse.com/1038143 https://bugzilla.suse.com/1038297 https://bugzilla.suse.com/1038458 https://bugzilla.suse.com/1038544 https://bugzilla.suse.com/1038842 https://bugzilla.suse.com/1038843 https://bugzilla.suse.com/1038846 https://bugzilla.suse.com/1038847 https://bugzilla.suse.com/1038848 https://bugzilla.suse.com/1038879 https://bugzilla.suse.com/1039700 https://bugzilla.suse.com/1039864 https://bugzilla.suse.com/1039882 https://bugzilla.suse.com/1039883 https://bugzilla.suse.com/1039885 https://bugzilla.suse.com/1040069 https://bugzilla.suse.com/1040125 https://bugzilla.suse.com/1040279 https://bugzilla.suse.com/1040395 https://bugzilla.suse.com/1040425 https://bugzilla.suse.com/1040463 https://bugzilla.suse.com/1040929 https://bugzilla.suse.com/1040941 https://bugzilla.suse.com/1041087 https://bugzilla.suse.com/1041160 https://bugzilla.suse.com/1041168 https://bugzilla.suse.com/1041242 https://bugzilla.suse.com/799133 https://bugzilla.suse.com/922871 https://bugzilla.suse.com/966321 https://bugzilla.suse.com/971975 https://bugzilla.suse.com/989311 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1507-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 08 Jun '17

08 Jun '17

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1507-1 Rating: important References: #1034849 Cross-References: CVE-2017-3509 CVE-2017-3511 CVE-2017-3512 CVE-2017-3514 CVE-2017-3526 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Upgrade to version jdk8u131 (icedtea 3.4.0) - bsc#1034849 * Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8168699: Validate special case invocations - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing * New features - PR1969: Add AArch32 JIT port - PR3297: Allow Shenandoah to be used on AArch64 - PR3340: jstack.stp should support AArch64 * Import of OpenJDK 8 u131 build 11 - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6515172, PR3346: Runtime.availableProcessors() ignores Linux taskset command - S7155957: closed/java/awt/MenuBar/MenuBarStress1/MenuBarStress1.java hangs on win 64 bit with jdk8 - S7167293: FtpURLConnection connection leak on FileNotFoundException - S8035568: [macosx] Cursor management unification - S8079595: Resizing dialog which is JWindow parent makes JVM crash - S8130769: The new menu can't be shown on the menubar after clicking the "Add" button. - S8146602: jdk/test/sun/misc/URLClassPath/ClassnameCharTest.java test fails with NullPointerException - S8147842: IME Composition Window is displayed at incorrect location - S8147910, PR3346: Cache initial active_processor_count - S8150490: Update OS detection code to recognize Windows Server 2016 - S8160951: [TEST_BUG] javax/xml/bind/marshal/8134111/UnmarshalTest.java should be added into :needs_jre group - S8160958: [TEST_BUG] java/net/SetFactoryPermission/SetFactoryPermission.java should be added into :needs_compact2 group - S8161147: jvm crashes when -XX:+UseCountedLoopSafepoints is enabled - S8161195: Regression: closed/javax/swing/text/FlowView/LayoutTest.java - S8161993, PR3346: G1 crashes if active_processor_count changes during startup - S8162876: [TEST_BUG] sun/net/www/protocol/http/HttpInputStream.java fails intermittently - S8162916: Test sun/security/krb5/auto/UnboundSSL.java fails - S8164533: sun/security/ssl/SSLSocketImpl/CloseSocket.java failed with "Error while cleaning up threads after test" - S8167179: Make XSL generated namespace prefixes local to transformation process - S8168774: Polymorhic signature method check crashes javac - S8169465: Deadlock in com.sun.jndi.ldap.pool.Connections - S8169589: [macosx] Activating a JDialog puts to back another dialog - S8170307: Stack size option -Xss is ignored - S8170316: (tz) Support tzdata2016j - S8170814: Reuse cache entries (part II) - S8170888, PR3314, RH1284948: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments - S8171388: Update JNDI Thread contexts - S8171949: [macosx] AWT_ZoomFrame Automated tests fail with error: The bitwise mask Frame.ICONIFIED is not setwhen the frame is in ICONIFIED state - S8171952: [macosx] AWT_Modality/Automated/ModalExclusion/NoExclusion/ModelessDialog test fails as DummyButton on Dialog did not gain focus when clicked. - S8173030: Temporary backout fix #8035568 from 8u131-b03 - S8173031: Temporary backout fix #8171952 from 8u131-b03 - S8173783, PR3328: IllegalArgumentException: jdk.tls.namedGroups - S8173931: 8u131 L10n resource file update - S8174844: Incorrect GPL header causes RE script to miss swap to commercial header for licensee source bundle - S8174985: NTLM authentication doesn't work with IIS if NTLM cache is disabled - S8176044: (tz) Support tzdata2017a * Backports - S6457406, PR3335: javadoc doesn't handle <a href='http://...'> properly in producing index pages - S8030245, PR3335: Update langtools to use try-with-resources and multi-catch - S8030253, PR3335: Update langtools to use strings-in-switch - S8030262, PR3335: Update langtools to use foreach loops - S8031113, PR3337: TEST_BUG: java/nio/channels/AsynchronousChannelGroup/Basic.java fails intermittently - S8031625, PR3335: javadoc problems referencing inner class constructors - S8031649, PR3335: Clean up javadoc tests - S8031670, PR3335: Remove unneeded -source options in javadoc tests - S8032066, PR3335: Serialized form has broken links to non private inner classes of package private - S8034174, PR2290: Remove use of JVM_* functions from java.net code - S8034182, PR2290: Misc. warnings in java.net code - S8035876, PR2290: AIX build issues after '8034174: Remove use of JVM_* functions from java.net code' - S8038730, PR3335: Clean up the way JavadocTester is invoked, and checks for errors. - S8040903, PR3335: Clean up use of BUG_ID in javadoc tests - S8040904, PR3335: Ensure javadoc tests do not overwrite results within tests - S8040908, PR3335: javadoc test TestDocEncoding should use -notimestamp - S8041150, PR3335: Avoid silly use of static methods in JavadocTester - S8041253, PR3335: Avoid redundant synonyms of NO_TEST - S8043780, PR3368: Use open(O_CLOEXEC) instead of fcntl(FD_CLOEXEC) - S8061305, PR3335: Javadoc crashes when method name ends with "Property" - S8072452, PR3337: Support DHE sizes up to 8192-bits and DSA sizes up to 3072-bits - S8075565, PR3337: Define @intermittent jtreg keyword and mark intermittently failing jdk tests - S8075670, PR3337: Remove intermittent keyword from some tests - S8078334, PR3337: Mark regression tests using randomness - S8078880, PR3337: Mark a few more intermittently failuring security-libs - S8133318, PR3337: Exclude intermittent failing PKCS11 tests on Solaris SPARC 11.1 and earlier - S8144539, PR3337: Update PKCS11 tests to run with security manager - S8144566, PR3352: Custom HostnameVerifier disables SNI extension - S8153711, PR3313, RH1284948: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command - S8155049, PR3352: New tests from 8144566 fail with "No expected Server Name Indication" - S8173941, PR3326: SA does not work if executable is DSO - S8174164, PR3334, RH1417266: SafePointNode::_replaced_nodes breaks with irreducible loops - S8174729, PR3336, RH1420518: Race Condition in java.lang.reflect.WeakCache - S8175097, PR3334, RH1417266: [TESTBUG] 8174164 fix missed the test * Bug fixes - PR3348: Architectures unsupported by SystemTap tapsets throw a parse error - PR3378: Perl should be mandatory - PR3389: javac.in and javah.in should use @PERL@ rather than a hardcoded path * AArch64 port - S8168699, PR3372: Validate special case invocations [AArch64 support] - S8170100, PR3372: AArch64: Crash in C1-compiled code accessing References - S8172881, PR3372: AArch64: assertion failure: the int pressure is incorrect - S8173472, PR3372: AArch64: C1 comparisons with null only use 32-bit instructions - S8177661, PR3372: Correct ad rule output register types from iRegX to iRegXNoSp * AArch32 port - PR3380: Zero should not be enabled by default on arm with the AArch32 HotSpot build - PR3384, S8139303, S8167584: Add support for AArch32 architecture to configure and jdk makefiles - PR3385: aarch32 does not support -Xshare:dump - PR3386, S8164652: AArch32 jvm.cfg wrong for C1 build - PR3387: Installation fails on arm with AArch32 port as INSTALL_ARCH_DIR is arm, not aarch32 - PR3388: Wrong path for jvm.cfg being used on arm with AArch32 build * Shenandoah - Fix Shenandoah argument checking on 32bit builds. - Import from Shenandoah tag aarch64-shenandoah-jdk8u101-b14-shenandoah-merge-2016-07-25 - Import from Shenandoah tag aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-02-20 - Import from Shenandoah tag aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-06 - Import from Shenandoah tag aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-09 - Import from Shenandoah tag aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-23 This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-662=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.131-10.8.1 java-1_8_0-openjdk-accessibility-1.8.0.131-10.8.1 java-1_8_0-openjdk-debuginfo-1.8.0.131-10.8.1 java-1_8_0-openjdk-debugsource-1.8.0.131-10.8.1 java-1_8_0-openjdk-demo-1.8.0.131-10.8.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.131-10.8.1 java-1_8_0-openjdk-devel-1.8.0.131-10.8.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.131-10.8.1 java-1_8_0-openjdk-headless-1.8.0.131-10.8.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.131-10.8.1 java-1_8_0-openjdk-src-1.8.0.131-10.8.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.131-10.8.1 References: https://www.suse.com/security/cve/CVE-2017-3509.html https://www.suse.com/security/cve/CVE-2017-3511.html https://www.suse.com/security/cve/CVE-2017-3512.html https://www.suse.com/security/cve/CVE-2017-3514.html https://www.suse.com/security/cve/CVE-2017-3526.html https://www.suse.com/security/cve/CVE-2017-3533.html https://www.suse.com/security/cve/CVE-2017-3539.html https://www.suse.com/security/cve/CVE-2017-3544.html https://bugzilla.suse.com/1034849 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1502-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Jun '17

07 Jun '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1502-1 Rating: important References: #1042833 Cross-References: CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 CVE-2017-5086 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update to Chromium 59.0.3071.86 fixes the following security issues: - CVE-2017-5070: Type confusion in V8 - CVE-2017-5071: Out of bounds read in V8 - CVE-2017-5072: Address spoofing in Omnibox - CVE-2017-5073: Use after free in print preview - CVE-2017-5074: Use after free in Apps Bluetooth - CVE-2017-5075: Information leak in CSP reporting - CVE-2017-5086: Address spoofing in Omnibox - CVE-2017-5076: Address spoofing in Omnibox - CVE-2017-5077: Heap buffer overflow in Skia - CVE-2017-5078: Possible command injection in mailto handling - CVE-2017-5079: UI spoofing in Blink - CVE-2017-5080: Use after free in credit card autofill - CVE-2017-5081: Extension verification bypass - CVE-2017-5082: Insufficient hardening in credit card editor - CVE-2017-5083: UI spoofing in Blink - CVE-2017-5085: Inappropriate javascript execution on WebUI pages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-661=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-59.0.3071.86-104.15.1 chromedriver-debuginfo-59.0.3071.86-104.15.1 chromium-59.0.3071.86-104.15.1 chromium-debuginfo-59.0.3071.86-104.15.1 chromium-debugsource-59.0.3071.86-104.15.1 References: https://www.suse.com/security/cve/CVE-2017-5070.html https://www.suse.com/security/cve/CVE-2017-5071.html https://www.suse.com/security/cve/CVE-2017-5072.html https://www.suse.com/security/cve/CVE-2017-5073.html https://www.suse.com/security/cve/CVE-2017-5074.html https://www.suse.com/security/cve/CVE-2017-5075.html https://www.suse.com/security/cve/CVE-2017-5076.html https://www.suse.com/security/cve/CVE-2017-5077.html https://www.suse.com/security/cve/CVE-2017-5078.html https://www.suse.com/security/cve/CVE-2017-5079.html https://www.suse.com/security/cve/CVE-2017-5080.html https://www.suse.com/security/cve/CVE-2017-5081.html https://www.suse.com/security/cve/CVE-2017-5082.html https://www.suse.com/security/cve/CVE-2017-5083.html https://www.suse.com/security/cve/CVE-2017-5085.html https://www.suse.com/security/cve/CVE-2017-5086.html https://bugzilla.suse.com/1042833 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1501-1: important: Security update for chromium
by opensuse-security＠opensuse.org 07 Jun '17

07 Jun '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1501-1 Rating: important References: #1042833 Cross-References: CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 CVE-2017-5086 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update to Chromium 59.0.3071.86 fixes the following security issues: - CVE-2017-5070: Type confusion in V8 - CVE-2017-5071: Out of bounds read in V8 - CVE-2017-5072: Address spoofing in Omnibox - CVE-2017-5073: Use after free in print preview - CVE-2017-5074: Use after free in Apps Bluetooth - CVE-2017-5075: Information leak in CSP reporting - CVE-2017-5086: Address spoofing in Omnibox - CVE-2017-5076: Address spoofing in Omnibox - CVE-2017-5077: Heap buffer overflow in Skia - CVE-2017-5078: Possible command injection in mailto handling - CVE-2017-5079: UI spoofing in Blink - CVE-2017-5080: Use after free in credit card autofill - CVE-2017-5081: Extension verification bypass - CVE-2017-5082: Insufficient hardening in credit card editor - CVE-2017-5083: UI spoofing in Blink - CVE-2017-5085: Inappropriate javascript execution on WebUI pages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-661=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-59.0.3071.86-20.1 chromedriver-debuginfo-59.0.3071.86-20.1 chromium-59.0.3071.86-20.1 chromium-debuginfo-59.0.3071.86-20.1 chromium-debugsource-59.0.3071.86-20.1 References: https://www.suse.com/security/cve/CVE-2017-5070.html https://www.suse.com/security/cve/CVE-2017-5071.html https://www.suse.com/security/cve/CVE-2017-5072.html https://www.suse.com/security/cve/CVE-2017-5073.html https://www.suse.com/security/cve/CVE-2017-5074.html https://www.suse.com/security/cve/CVE-2017-5075.html https://www.suse.com/security/cve/CVE-2017-5076.html https://www.suse.com/security/cve/CVE-2017-5077.html https://www.suse.com/security/cve/CVE-2017-5078.html https://www.suse.com/security/cve/CVE-2017-5079.html https://www.suse.com/security/cve/CVE-2017-5080.html https://www.suse.com/security/cve/CVE-2017-5081.html https://www.suse.com/security/cve/CVE-2017-5082.html https://www.suse.com/security/cve/CVE-2017-5083.html https://www.suse.com/security/cve/CVE-2017-5085.html https://www.suse.com/security/cve/CVE-2017-5086.html https://bugzilla.suse.com/1042833 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1497-1: important: Security update for deluge
by opensuse-security＠opensuse.org 06 Jun '17

06 Jun '17

openSUSE Security Update: Security update for deluge ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1497-1 Rating: important References: #1039815 #1039958 Cross-References: CVE-2017-7178 CVE-2017-9031 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for deluge fixes two security issues: - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface (bsc#1039815) - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the WebUI (bsc#1039958) In addition, deluge was updated to 1.3.15 with the following fixes and changes: - Core: Fix issues with displaying libtorrent-rasterbar single proxy. - Core: Fix libtorrent-rasterbar 1.2 trackers crashing Deluge UIs. - Core: Fix an error in torrent priorities causing file priority mismatch in UIs. - GtkUI: Fix column sort state not saved in Thinclient mode. - GtkUI: Fix a connection manager error with malformed ip. - GtkUI: Rename SystemTray/Indicator "Pause/Resume All" to "Pause/Resume Session". - GtkUI: Workaround libtorrent-rasterbar single proxy by greying out unused proxy types. - Notification Plugin: Fix webui passing string for int port value. - AutoAdd Plugin: Add WebUI preferences page detailing lack of configuration via WebUI. - Label Plugin: Add WebUI preferences page detailing how to configure plugin. - Core: Fix 'Too many files open' errors. - Core: Add support for python-GeoIP for use with libtorrent 1.1. - Core: Fix a single proxy entry being overwritten resulting in no proxy set. - UI: Add the tracker_status translation to UIs. - GtkUI: Strip whitespace from infohash before checks. - GtkUI: Add a missed feature autofill infohash entry from clipboard. - WebUI: Backport bind interface option for server. - ConsoleUI: Fix a decode error comparing non-ascii (str) torrent names. - AutoAdd Plugin: Fixes for splitting magnets from file. - Remove the duplicate magnet extension when splitting. - Remove deluge-libtorrent-1.1-geoip.patch: fixed upstream. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-656=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): deluge-1.3.15-3.3.1 deluge-lang-1.3.15-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7178.html https://www.suse.com/security/cve/CVE-2017-9031.html https://bugzilla.suse.com/1039815 https://bugzilla.suse.com/1039958 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:1475-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 02 Jun '17

02 Jun '17

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1475-1 Rating: important References: #1020868 #1020890 #1020976 #1022428 #1034911 #1038740 #996821 Cross-References: CVE-2017-3302 CVE-2017-3313 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 5 fixes is now available. Description: This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA * notable changes: * XtraDB updated to 5.6.35-80.0 * TokuDB updated to 5.6.35-80.0 * PCRE updated to 8.40 * MDEV-11027: better InnoDB crash recovery progress reporting * MDEV-11520: improvements to how InnoDB data files are extended * Improvements to InnoDB startup/shutdown to make it more robust * MDEV-11233: fix for FULLTEXT index crash * MDEV-6143: MariaDB Linux binary tarballs will now always untar to directories that match their filename * release notes and changelog: * https://kb.askmonty.org/en/mariadb-10030-release-notes * https://kb.askmonty.org/en/mariadb-10030-changelog * fixes the following CVEs: CVE-2017-3313: unspecified vulnerability affecting the MyISAM component [bsc#1020890] CVE-2017-3302: Use after free in libmysqlclient.so [bsc#1022428] - set the default umask to 077 in mysql-systemd-helper [bsc#1020976] - [bsc#1034911] - tracker bug * fixes also [bsc#1020868] This update for mariadb fixes permissions for /var/run/mysql in mysql-systemd-helper that were incorrectly set to 700 instead of 755 due to umask. This prevented non-root users from connecting to the database. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-644=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysqlclient-devel-10.0.30-20.4.1 libmysqlclient18-10.0.30-20.4.1 libmysqlclient18-debuginfo-10.0.30-20.4.1 libmysqlclient_r18-10.0.30-20.4.1 libmysqld-devel-10.0.30-20.4.1 libmysqld18-10.0.30-20.4.1 libmysqld18-debuginfo-10.0.30-20.4.1 mariadb-10.0.30-20.4.1 mariadb-bench-10.0.30-20.4.1 mariadb-bench-debuginfo-10.0.30-20.4.1 mariadb-client-10.0.30-20.4.1 mariadb-client-debuginfo-10.0.30-20.4.1 mariadb-debuginfo-10.0.30-20.4.1 mariadb-debugsource-10.0.30-20.4.1 mariadb-errormessages-10.0.30-20.4.1 mariadb-test-10.0.30-20.4.1 mariadb-test-debuginfo-10.0.30-20.4.1 mariadb-tools-10.0.30-20.4.1 mariadb-tools-debuginfo-10.0.30-20.4.1 - openSUSE Leap 42.2 (x86_64): libmysqlclient18-32bit-10.0.30-20.4.1 libmysqlclient18-debuginfo-32bit-10.0.30-20.4.1 libmysqlclient_r18-32bit-10.0.30-20.4.1 References: https://www.suse.com/security/cve/CVE-2017-3302.html https://www.suse.com/security/cve/CVE-2017-3313.html https://bugzilla.suse.com/1020868 https://bugzilla.suse.com/1020890 https://bugzilla.suse.com/1020976 https://bugzilla.suse.com/1022428 https://bugzilla.suse.com/1034911 https://bugzilla.suse.com/1038740 https://bugzilla.suse.com/996821 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1471-1: important: Security update for strongswan
by opensuse-security＠opensuse.org 01 Jun '17

01 Jun '17

SUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1471-1 Rating: important References: #1039514 #1039515 Cross-References: CVE-2017-9022 CVE-2017-9023 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for strongswan fixes the following issues: - CVE-2017-9022: Insufficient Input Validation in gmp Plugin leads to Denial of service (bsc#1039514) - CVE-2017-9023: Incorrect x509 ASN.1 parser error handling could lead to Denial of service (bsc#1039515) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-strongswan-13136=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-strongswan-13136=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): strongswan-4.4.0-6.35.1 strongswan-doc-4.4.0-6.35.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): strongswan-debuginfo-4.4.0-6.35.1 strongswan-debugsource-4.4.0-6.35.1 References: https://www.suse.com/security/cve/CVE-2017-9022.html https://www.suse.com/security/cve/CVE-2017-9023.html https://bugzilla.suse.com/1039514 https://bugzilla.suse.com/1039515 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0