August 2017 - openSUSE Security Announce

[security-announce] openSUSE-SU-2017:2270-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 28 Aug '17

28 Aug '17

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2270-1 Rating: important References: #1049086 Cross-References: CVE-2017-10978 CVE-2017-10983 CVE-2017-10984 CVE-2017-10985 CVE-2017-10986 CVE-2017-10987 CVE-2017-10988 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: - update to 3.0.15 (bsc#1049086) * Bind the lifetime of program name and python path to the module * CVE-2017-10978: FR-GV-201: Check input / output length in make_secret() (bsc#1049086) * CVE-2017-10983: FR-GV-206: Fix read overflow when decoding DHCP option 63 (bsc#1049086) * CVE-2017-10984: FR-GV-301: Fix write overflow in data2vp_wimax() (bsc#1049086) * CVE-2017-10985: FR-GV-302: Fix infinite loop and memory exhaustion with 'concat' attributes (bsc#1049086) * CVE-2017-10986: FR-GV-303: Fix infinite read in dhcp_attr2vp() (bsc#1049086) * CVE-2017-10987: FR-GV-304: Fix buffer over-read in fr_dhcp_decode_suboptions() (bsc#1049086) * CVE-2017-10988: FR-GV-305: Decode 'signed' attributes correctly. (bsc#1049086) * FR-AD-001: use strncmp() instead of memcmp() for bounded data * Print messages when we see deprecated configuration items * Show reasons why we couldn't parse a certificate expiry time * Be more accepting about truncated ASN1 times. * Fix OpenSSL API issue which could leak small amounts of memory. * For Access-Reject, call rad_authlog() after running the post-auth section, just like for Access-Accept. * Don't crash when reading corrupted data from session resumption cache. * Parse port in dhcpclient. * Don't leak memory for OpenSSL. * Portability fixes taken from OpenBSD port collection. * run rad_authlog after post-auth for Access-Reject. * Don't process VMPS packets twice. * Fix attribute truncation in rlm_perl * Fix bug when processing huntgroups. * FR-AD-002 - Bind the lifetime of program name and python path to the module * FR-AD-003 - Pass correct statement length into sqlite3_prepare[_v2] This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-972=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): freeradius-server-3.0.15-3.1 freeradius-server-debuginfo-3.0.15-3.1 freeradius-server-debugsource-3.0.15-3.1 freeradius-server-devel-3.0.15-3.1 freeradius-server-doc-3.0.15-3.1 freeradius-server-krb5-3.0.15-3.1 freeradius-server-krb5-debuginfo-3.0.15-3.1 freeradius-server-ldap-3.0.15-3.1 freeradius-server-ldap-debuginfo-3.0.15-3.1 freeradius-server-libs-3.0.15-3.1 freeradius-server-libs-debuginfo-3.0.15-3.1 freeradius-server-mysql-3.0.15-3.1 freeradius-server-mysql-debuginfo-3.0.15-3.1 freeradius-server-perl-3.0.15-3.1 freeradius-server-perl-debuginfo-3.0.15-3.1 freeradius-server-postgresql-3.0.15-3.1 freeradius-server-postgresql-debuginfo-3.0.15-3.1 freeradius-server-python-3.0.15-3.1 freeradius-server-python-debuginfo-3.0.15-3.1 freeradius-server-sqlite-3.0.15-3.1 freeradius-server-sqlite-debuginfo-3.0.15-3.1 freeradius-server-utils-3.0.15-3.1 freeradius-server-utils-debuginfo-3.0.15-3.1 References: https://www.suse.com/security/cve/CVE-2017-10978.html https://www.suse.com/security/cve/CVE-2017-10983.html https://www.suse.com/security/cve/CVE-2017-10984.html https://www.suse.com/security/cve/CVE-2017-10985.html https://www.suse.com/security/cve/CVE-2017-10986.html https://www.suse.com/security/cve/CVE-2017-10987.html https://www.suse.com/security/cve/CVE-2017-10988.html https://bugzilla.suse.com/1049086 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2264-1: important: Security update for libzypp
by opensuse-security＠opensuse.org 25 Aug '17

25 Aug '17

SUSE Security Update: Security update for libzypp ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2264-1 Rating: important References: #1009745 #1036659 #1038984 #1043218 #1045735 #1046417 #1047785 #1048315 Cross-References: CVE-2017-7435 CVE-2017-7436 CVE-2017-9269 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: The Software Update Stack was updated to receive fixes and enhancements. libzypp: - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984) - Fix gpg-pubkey release (creation time) computation. (bsc#1036659) - Update lsof blacklist. (bsc#1046417) - Re-probe on refresh if the repository type changes. (bsc#1048315) - Propagate proper error code to DownloadProgressReport. (bsc#1047785) - Allow to trigger an appdata refresh unconditionally. (bsc#1009745) - Support custom repo variables defined in /etc/zypp/vars.d. yast2-pkg-bindings: - Do not crash when the repository URL is not defined. (bsc#1043218) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1390=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1390=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1390=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libzypp-debuginfo-16.15.3-2.3.1 libzypp-debugsource-16.15.3-2.3.1 libzypp-devel-16.15.3-2.3.1 libzypp-devel-doc-16.15.3-2.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): yast2-pkg-bindings-devel-doc-3.2.4-2.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libzypp-16.15.3-2.3.1 libzypp-debuginfo-16.15.3-2.3.1 libzypp-debugsource-16.15.3-2.3.1 yast2-pkg-bindings-3.2.4-2.3.1 yast2-pkg-bindings-debuginfo-3.2.4-2.3.1 yast2-pkg-bindings-debugsource-3.2.4-2.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libzypp-16.15.3-2.3.1 libzypp-debuginfo-16.15.3-2.3.1 libzypp-debugsource-16.15.3-2.3.1 yast2-pkg-bindings-3.2.4-2.3.1 yast2-pkg-bindings-debuginfo-3.2.4-2.3.1 yast2-pkg-bindings-debugsource-3.2.4-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-7435.html https://www.suse.com/security/cve/CVE-2017-7436.html https://www.suse.com/security/cve/CVE-2017-9269.html https://bugzilla.suse.com/1009745 https://bugzilla.suse.com/1036659 https://bugzilla.suse.com/1038984 https://bugzilla.suse.com/1043218 https://bugzilla.suse.com/1045735 https://bugzilla.suse.com/1046417 https://bugzilla.suse.com/1047785 https://bugzilla.suse.com/1048315 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2263-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 25 Aug '17

25 Aug '17

SUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2263-1 Rating: important References: #1053431 Cross-References: CVE-2017-10053 CVE-2017-10067 CVE-2017-10074 CVE-2017-10078 CVE-2017-10081 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10105 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10111 CVE-2017-10115 CVE-2017-10116 CVE-2017-10125 CVE-2017-10243 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update for java-1_8_0-ibm fixes the following issues: - Version update to 8.0-4.10 [bsc#1053431] CVE-2017-10111, CVE-2017-10110, CVE-2017-10107, CVE-2017-10101, CVE-2017-10096, CVE-2017-10090, CVE-2017-10089, CVE-2017-10087, CVE-2017-10102, CVE-2017-10116, CVE-2017-10074, CVE-2017-10078, CVE-2017-10115, CVE-2017-10067, CVE-2017-10125, CVE-2017-10243, CVE-2017-10109, CVE-2017-10108, CVE-2017-10053, CVE-2017-10105, CVE-2017-10081: Multiple unspecified vulnerabilities in multiple Java components could lead to code execution or sandbox escape More information can be found here: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#Oracle_ July_18_2017_CPU Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1389=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1389=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1389=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1389=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1389=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1389=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1389=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-ibm-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-ibm-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1 java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1 References: https://www.suse.com/security/cve/CVE-2017-10053.html https://www.suse.com/security/cve/CVE-2017-10067.html https://www.suse.com/security/cve/CVE-2017-10074.html https://www.suse.com/security/cve/CVE-2017-10078.html https://www.suse.com/security/cve/CVE-2017-10081.html https://www.suse.com/security/cve/CVE-2017-10087.html https://www.suse.com/security/cve/CVE-2017-10089.html https://www.suse.com/security/cve/CVE-2017-10090.html https://www.suse.com/security/cve/CVE-2017-10096.html https://www.suse.com/security/cve/CVE-2017-10101.html https://www.suse.com/security/cve/CVE-2017-10102.html https://www.suse.com/security/cve/CVE-2017-10105.html https://www.suse.com/security/cve/CVE-2017-10107.html https://www.suse.com/security/cve/CVE-2017-10108.html https://www.suse.com/security/cve/CVE-2017-10109.html https://www.suse.com/security/cve/CVE-2017-10110.html https://www.suse.com/security/cve/CVE-2017-10111.html https://www.suse.com/security/cve/CVE-2017-10115.html https://www.suse.com/security/cve/CVE-2017-10116.html https://www.suse.com/security/cve/CVE-2017-10125.html https://www.suse.com/security/cve/CVE-2017-10243.html https://bugzilla.suse.com/1053431 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2258-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 25 Aug '17

25 Aug '17

SUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2258-1 Rating: important References: #1051684 #1051685 #1053259 Cross-References: CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Postgresql94 was updated to 9.4.13 to fix the following issues: * CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685) * CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684) * CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259) The changelog for this release is here: https://www.postgresql.org/docs/9.4/static/release-9-4-13.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-postgresql94-13247=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-postgresql94-13247=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-postgresql94-13247=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-postgresql94-13247=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-postgresql94-13247=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-postgresql94-13247=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): postgresql94-devel-9.4.13-0.23.5.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libecpg6-9.4.13-0.23.5.1 libpq5-9.4.13-0.23.5.1 postgresql94-9.4.13-0.23.5.1 postgresql94-contrib-9.4.13-0.23.5.1 postgresql94-docs-9.4.13-0.23.5.1 postgresql94-server-9.4.13-0.23.5.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libpq5-32bit-9.4.13-0.23.5.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): libecpg6-9.4.13-0.23.5.1 libpq5-9.4.13-0.23.5.1 postgresql94-9.4.13-0.23.5.1 postgresql94-contrib-9.4.13-0.23.5.1 postgresql94-docs-9.4.13-0.23.5.1 postgresql94-server-9.4.13-0.23.5.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libpq5-32bit-9.4.13-0.23.5.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): libecpg6-9.4.13-0.23.5.1 libpq5-9.4.13-0.23.5.1 postgresql94-9.4.13-0.23.5.1 postgresql94-contrib-9.4.13-0.23.5.1 postgresql94-docs-9.4.13-0.23.5.1 postgresql94-server-9.4.13-0.23.5.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): postgresql94-debuginfo-9.4.13-0.23.5.1 postgresql94-debugsource-9.4.13-0.23.5.1 postgresql94-libs-debuginfo-9.4.13-0.23.5.1 postgresql94-libs-debugsource-9.4.13-0.23.5.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): postgresql94-debuginfo-9.4.13-0.23.5.1 postgresql94-debugsource-9.4.13-0.23.5.1 References: https://www.suse.com/security/cve/CVE-2017-7546.html https://www.suse.com/security/cve/CVE-2017-7547.html https://www.suse.com/security/cve/CVE-2017-7548.html https://bugzilla.suse.com/1051684 https://bugzilla.suse.com/1051685 https://bugzilla.suse.com/1053259 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2237-1: important: Security update for samba and resource-agents
by opensuse-security＠opensuse.org 22 Aug '17

22 Aug '17

SUSE Security Update: Security update for samba and resource-agents ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2237-1 Rating: important References: #1048278 #1048339 #1048352 #1048387 #1048790 #1052577 #1054017 Cross-References: CVE-2017-11103 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise High Availability 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update provides Samba 4.6.7, which fixes the following issues: - CVE-2017-11103: Metadata were being taken from the unauthenticated plaintext (the Ticket) rather than the authenticated and encrypted KDC response. (bsc#1048278) - Fix cephwrap_chdir(). (bsc#1048790) - Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb. (bsc#1048339) - Fix inconsistent ctdb socket path. (bsc#1048352) - Fix non-admin cephx authentication. (bsc#1048387) - CTDB cannot start when there is no persistent database. (bsc#1052577) The CTDB resource agent was also fixed to not fail when the database is empty. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1367=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1367=1 - SUSE Linux Enterprise High Availability 12-SP3: zypper in -t patch SUSE-SLE-HA-12-SP3-2017-1367=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1367=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libsmbclient-devel-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient-devel-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debugsource-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libdcerpc-binding0-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc-binding0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debugsource-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libdcerpc-binding0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc-binding0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): samba-doc-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise High Availability 12-SP3 (ppc64le s390x x86_64): ctdb-4.6.7+git.38.90b2cdb4f22-3.7.1 ctdb-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 ldirectord-4.0.1+git.1495055229.643177f1-2.4.2 resource-agents-4.0.1+git.1495055229.643177f1-2.4.2 resource-agents-debuginfo-4.0.1+git.1495055229.643177f1-2.4.2 resource-agents-debugsource-4.0.1+git.1495055229.643177f1-2.4.2 samba-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debugsource-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise High Availability 12-SP3 (noarch): monitoring-plugins-metadata-4.0.1+git.1495055229.643177f1-2.4.2 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): samba-doc-4.6.7+git.38.90b2cdb4f22-3.7.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libdcerpc-binding0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc-binding0-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc-binding0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc-binding0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libdcerpc0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-krb5pac0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-nbt0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr-standard0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libndr0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libnetapi0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-credentials0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-errors0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-hostconfig0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-passdb0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamba-util0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsamdb0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbclient0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbconf0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libsmbldap0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libtevent-util0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 libwbclient0-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-client-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-debugsource-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-libs-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-debuginfo-32bit-4.6.7+git.38.90b2cdb4f22-3.7.1 samba-winbind-debuginfo-4.6.7+git.38.90b2cdb4f22-3.7.1 References: https://www.suse.com/security/cve/CVE-2017-11103.html https://bugzilla.suse.com/1048278 https://bugzilla.suse.com/1048339 https://bugzilla.suse.com/1048352 https://bugzilla.suse.com/1048387 https://bugzilla.suse.com/1048790 https://bugzilla.suse.com/1052577 https://bugzilla.suse.com/1054017 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2236-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 22 Aug '17

22 Aug '17

SUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2236-1 Rating: important References: #1051684 #1051685 #1053259 Cross-References: CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Postgresql93 was updated to 9.3.18 to fix the following issues: * CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685) * CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684) * CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259) The changelog for the release is here: https://www.postgresql.org/docs/9.3/static/release-9-3-18.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1368=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1368=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): postgresql93-9.3.18-25.5.1 postgresql93-contrib-9.3.18-25.5.1 postgresql93-contrib-debuginfo-9.3.18-25.5.1 postgresql93-debuginfo-9.3.18-25.5.1 postgresql93-debugsource-9.3.18-25.5.1 postgresql93-server-9.3.18-25.5.1 postgresql93-server-debuginfo-9.3.18-25.5.1 - SUSE Linux Enterprise Server for SAP 12 (noarch): postgresql93-docs-9.3.18-25.5.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): postgresql93-9.3.18-25.5.1 postgresql93-contrib-9.3.18-25.5.1 postgresql93-contrib-debuginfo-9.3.18-25.5.1 postgresql93-debuginfo-9.3.18-25.5.1 postgresql93-debugsource-9.3.18-25.5.1 postgresql93-server-9.3.18-25.5.1 postgresql93-server-debuginfo-9.3.18-25.5.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): postgresql93-docs-9.3.18-25.5.1 References: https://www.suse.com/security/cve/CVE-2017-7546.html https://www.suse.com/security/cve/CVE-2017-7547.html https://www.suse.com/security/cve/CVE-2017-7548.html https://bugzilla.suse.com/1051684 https://bugzilla.suse.com/1051685 https://bugzilla.suse.com/1053259 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2235-1: important: Security update for MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss
by opensuse-security＠opensuse.org 22 Aug '17

22 Aug '17

SUSE Security Update: Security update for MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2235-1 Rating: important References: #1025108 #1031485 #1035082 #1043960 #930392 #930496 #935510 #939460 #945842 #953831 #954002 #955382 #962765 #964468 #966220 #968771 Cross-References: CVE-2015-5276 CVE-2016-10196 CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5451 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5469 CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7761 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7768 CVE-2017-7778 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 51 vulnerabilities is now available. Description: This update for MozillaFirefox and mozilla-nss fixes the following issues: Security issues fixed: - Fixes in Firefox ESR 52.2 (bsc#1043960,MFSA 2017-16) - CVE-2017-7758: Out-of-bounds read in Opus encoder - CVE-2017-7749: Use-after-free during docshell reloading - CVE-2017-7751: Use-after-free with content viewer listeners - CVE-2017-5472: Use-after-free using destroyed node when regenerating trees - CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 - CVE-2017-7752: Use-after-free with IME input - CVE-2017-7750: Use-after-free with track elements - CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service - CVE-2017-7778: Vulnerabilities in the Graphite 2 library - CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object - CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files - CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors - CVE-2017-7757: Use-after-free in IndexedDB - CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application - CVE-2017-7763: Mac fonts render some unicode characters as spaces - CVE-2017-7765: Mark of the Web bypass when saving executable files - CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks - update to Firefox ESR 52.1 (bsc#1035082,MFSA 2017-12) - CVE-2016-10196: Vulnerabilities in Libevent library - CVE-2017-5443: Out-of-bounds write during BinHex decoding - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - CVE-2017-5465: Out-of-bounds read in ConvolvePixel - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL - CVE-2017-5467: Memory corruption when drawing Skia content - CVE-2017-5460: Use-after-free in frame selection - CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - CVE-2017-5447: Out-of-bounds read during glyph processing - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content - CVE-2017-5445: Uninitialized values used while parsing application/http- index-format content - CVE-2017-5442: Use-after-free during style changes - CVE-2017-5469: Potential Buffer overflow in flex-generated code - CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing - CVE-2017-5441: Use-after-free with selection during scroll events - CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing - CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 - CVE-2017-5435: Use-after-free during transaction processing in the editor - CVE-2017-5434: Use-after-free during focus handling - CVE-2017-5433: Use-after-free in SMIL animation functions - CVE-2017-5432: Use-after-free in text input selection - CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 - CVE-2017-5459: Buffer overflow in WebGL - CVE-2017-5462: DRBG flaw in NSS - CVE-2017-5455: Sandbox escape through internal feed reader APIs - CVE-2017-5454: Sandbox escape allowing file system read access through file picker - CVE-2017-5456: Sandbox escape allowing local file system access - CVE-2017-5451: Addressbar spoofing with onblur event - General - CVE-2015-5276: Fix for C++11 std::random_device short reads (bsc#945842) Bugfixes: - workaround for Firefox hangs (bsc#1031485, bsc#1025108) - Update to gcc-5-branch head. * Includes fixes for (bsc#966220), (bsc#962765), (bsc#964468), (bsc#939460), (bsc#930496), (bsc#930392) and (bsc#955382). - Add fix to revert accidential libffi ABI breakage on AARCH64. (bsc#968771) - Build s390[x] with --with-tune=z9-109 --with-arch=z900 on SLE11 again. (bsc#954002) - Fix libffi include install. (bsc#935510) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-13237=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-13237=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-13237=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-MozillaFirefox-13237=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-13237=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-13237=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): mozilla-nss-devel-3.29.5-47.3.2 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): MozillaFirefox-devel-52.2.0esr-72.5.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): firefox-libffi4-5.3.1+r233831-7.1 firefox-libstdc++6-5.3.1+r233831-7.1 libfreebl3-3.29.5-47.3.2 libsoftokn3-3.29.5-47.3.2 mozilla-nss-3.29.5-47.3.2 mozilla-nss-tools-3.29.5-47.3.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): MozillaFirefox-52.2.0esr-72.5.2 MozillaFirefox-branding-SLED-52-24.3.44 MozillaFirefox-translations-52.2.0esr-72.5.2 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libfreebl3-32bit-3.29.5-47.3.2 libsoftokn3-32bit-3.29.5-47.3.2 mozilla-nss-32bit-3.29.5-47.3.2 - SUSE Linux Enterprise Server 11-SP4 (ia64): libfreebl3-x86-3.29.5-47.3.2 libsoftokn3-x86-3.29.5-47.3.2 mozilla-nss-x86-3.29.5-47.3.2 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-52.2.0esr-72.5.2 MozillaFirefox-branding-SLED-52-24.3.44 MozillaFirefox-translations-52.2.0esr-72.5.2 firefox-libffi4-5.3.1+r233831-7.1 firefox-libstdc++6-5.3.1+r233831-7.1 libfreebl3-3.29.5-47.3.2 libsoftokn3-3.29.5-47.3.2 mozilla-nss-3.29.5-47.3.2 mozilla-nss-tools-3.29.5-47.3.2 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): libfreebl3-32bit-3.29.5-47.3.2 libsoftokn3-32bit-3.29.5-47.3.2 mozilla-nss-32bit-3.29.5-47.3.2 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): MozillaFirefox-52.2.0esr-72.5.2 MozillaFirefox-branding-SLED-52-24.3.44 MozillaFirefox-translations-52.2.0esr-72.5.2 firefox-libffi4-5.3.1+r233831-7.1 firefox-libstdc++6-5.3.1+r233831-7.1 libfreebl3-3.29.5-47.3.2 libsoftokn3-3.29.5-47.3.2 mozilla-nss-3.29.5-47.3.2 mozilla-nss-tools-3.29.5-47.3.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): mozilla-nss-debuginfo-3.29.5-47.3.2 mozilla-nss-debugsource-3.29.5-47.3.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ppc64 s390x x86_64): MozillaFirefox-debuginfo-52.2.0esr-72.5.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-52.2.0esr-72.5.2 firefox-gcc5-debuginfo-5.3.1+r233831-7.1 firefox-gcc5-debugsource-5.3.1+r233831-7.1 firefox-libffi-gcc5-debuginfo-5.3.1+r233831-7.1 mozilla-nss-debuginfo-3.29.5-47.3.2 mozilla-nss-debugsource-3.29.5-47.3.2 References: https://www.suse.com/security/cve/CVE-2015-5276.html https://www.suse.com/security/cve/CVE-2016-10196.html https://www.suse.com/security/cve/CVE-2017-5429.html https://www.suse.com/security/cve/CVE-2017-5430.html https://www.suse.com/security/cve/CVE-2017-5432.html https://www.suse.com/security/cve/CVE-2017-5433.html https://www.suse.com/security/cve/CVE-2017-5434.html https://www.suse.com/security/cve/CVE-2017-5435.html https://www.suse.com/security/cve/CVE-2017-5436.html https://www.suse.com/security/cve/CVE-2017-5438.html https://www.suse.com/security/cve/CVE-2017-5439.html https://www.suse.com/security/cve/CVE-2017-5440.html https://www.suse.com/security/cve/CVE-2017-5441.html https://www.suse.com/security/cve/CVE-2017-5442.html https://www.suse.com/security/cve/CVE-2017-5443.html https://www.suse.com/security/cve/CVE-2017-5444.html https://www.suse.com/security/cve/CVE-2017-5445.html https://www.suse.com/security/cve/CVE-2017-5446.html https://www.suse.com/security/cve/CVE-2017-5447.html https://www.suse.com/security/cve/CVE-2017-5448.html https://www.suse.com/security/cve/CVE-2017-5449.html https://www.suse.com/security/cve/CVE-2017-5451.html https://www.suse.com/security/cve/CVE-2017-5454.html https://www.suse.com/security/cve/CVE-2017-5455.html https://www.suse.com/security/cve/CVE-2017-5456.html https://www.suse.com/security/cve/CVE-2017-5459.html https://www.suse.com/security/cve/CVE-2017-5460.html https://www.suse.com/security/cve/CVE-2017-5461.html https://www.suse.com/security/cve/CVE-2017-5462.html https://www.suse.com/security/cve/CVE-2017-5464.html https://www.suse.com/security/cve/CVE-2017-5465.html https://www.suse.com/security/cve/CVE-2017-5466.html https://www.suse.com/security/cve/CVE-2017-5467.html https://www.suse.com/security/cve/CVE-2017-5469.html https://www.suse.com/security/cve/CVE-2017-5470.html https://www.suse.com/security/cve/CVE-2017-5472.html https://www.suse.com/security/cve/CVE-2017-7749.html https://www.suse.com/security/cve/CVE-2017-7750.html https://www.suse.com/security/cve/CVE-2017-7751.html https://www.suse.com/security/cve/CVE-2017-7752.html https://www.suse.com/security/cve/CVE-2017-7754.html https://www.suse.com/security/cve/CVE-2017-7755.html https://www.suse.com/security/cve/CVE-2017-7756.html https://www.suse.com/security/cve/CVE-2017-7757.html https://www.suse.com/security/cve/CVE-2017-7758.html https://www.suse.com/security/cve/CVE-2017-7761.html https://www.suse.com/security/cve/CVE-2017-7763.html https://www.suse.com/security/cve/CVE-2017-7764.html https://www.suse.com/security/cve/CVE-2017-7765.html https://www.suse.com/security/cve/CVE-2017-7768.html https://www.suse.com/security/cve/CVE-2017-7778.html https://bugzilla.suse.com/1025108 https://bugzilla.suse.com/1031485 https://bugzilla.suse.com/1035082 https://bugzilla.suse.com/1043960 https://bugzilla.suse.com/930392 https://bugzilla.suse.com/930496 https://bugzilla.suse.com/935510 https://bugzilla.suse.com/939460 https://bugzilla.suse.com/945842 https://bugzilla.suse.com/953831 https://bugzilla.suse.com/954002 https://bugzilla.suse.com/955382 https://bugzilla.suse.com/962765 https://bugzilla.suse.com/964468 https://bugzilla.suse.com/966220 https://bugzilla.suse.com/968771 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2234-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 22 Aug '17

22 Aug '17

SUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2234-1 Rating: important References: #1050699 #1050704 #1050708 #1050711 #1050712 #1050714 Cross-References: CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2017-2834: Out-of-bounds write in license_recv() (bsc#1050714) - CVE-2017-2835: Out-of-bounds write in rdp_recv_tpkt_pdu (bsc#1050712) - CVE-2017-2836: Rdp Client Read Server Proprietary Certificate Denial of Service (bsc#1050699) - CVE-2017-2837: Client GCC Read Server Security Data DoS (bsc#1050704) - CVE-2017-2838: Client License Read Product Info Denial of Service Vulnerability (bsc#1050708) - CVE-2017-2839: Client License Read Challenge Packet Denial of Service (bsc#1050711) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-1365=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-1365=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1365=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1365=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1365=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1365=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): freerdp-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): freerdp-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-devel-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-devel-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): freerdp-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): freerdp-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 freerdp-debugsource-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-2.0.0~git.1463131968.4e66df7-12.3.2 libfreerdp2-debuginfo-2.0.0~git.1463131968.4e66df7-12.3.2 References: https://www.suse.com/security/cve/CVE-2017-2834.html https://www.suse.com/security/cve/CVE-2017-2835.html https://www.suse.com/security/cve/CVE-2017-2836.html https://www.suse.com/security/cve/CVE-2017-2837.html https://www.suse.com/security/cve/CVE-2017-2838.html https://www.suse.com/security/cve/CVE-2017-2839.html https://bugzilla.suse.com/1050699 https://bugzilla.suse.com/1050704 https://bugzilla.suse.com/1050708 https://bugzilla.suse.com/1050711 https://bugzilla.suse.com/1050712 https://bugzilla.suse.com/1050714 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2229-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Aug '17

22 Aug '17

SUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2229-1 Rating: important References: #1036985 #1042826 #1043289 #1049072 #1050611 #1050674 Cross-References: CVE-2017-11403 CVE-2017-11636 CVE-2017-11643 CVE-2017-8350 CVE-2017-9439 CVE-2017-9501 Affected Products: SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2017-8350: The PNG/JNG decoder recieved an incremental fix, fixing some related issues in the same code. (bsc#1036985) - CVE-2017-9439: A memory leak was found in the function ReadPDBImage incoders/pdb.c (bsc#1042826) - CVE-2017-9501: An assertion failure could cause a denial of service via a crafted file (bsc#1043289) - CVE-2017-11403: The ReadMNGImage function in coders/png.c has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file (bsc#1049072) - CVE-2017-11643: A heap overflow in WriteCMYKImage()function in coders/cmyk.c was fixed (bsc#1050611) - CVE-2017-11636: A heap overflow in WriteRGBImage() in coders/rgb.c was fixed (bsc#1050674) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-GraphicsMagick-13236=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-GraphicsMagick-13236=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-GraphicsMagick-13236=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): GraphicsMagick-1.2.5-4.78.9.1 libGraphicsMagick2-1.2.5-4.78.9.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): GraphicsMagick-1.2.5-4.78.9.1 libGraphicsMagick2-1.2.5-4.78.9.1 perl-GraphicsMagick-1.2.5-4.78.9.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): GraphicsMagick-debuginfo-1.2.5-4.78.9.1 GraphicsMagick-debugsource-1.2.5-4.78.9.1 References: https://www.suse.com/security/cve/CVE-2017-11403.html https://www.suse.com/security/cve/CVE-2017-11636.html https://www.suse.com/security/cve/CVE-2017-11643.html https://www.suse.com/security/cve/CVE-2017-8350.html https://www.suse.com/security/cve/CVE-2017-9439.html https://www.suse.com/security/cve/CVE-2017-9501.html https://bugzilla.suse.com/1036985 https://bugzilla.suse.com/1042826 https://bugzilla.suse.com/1043289 https://bugzilla.suse.com/1049072 https://bugzilla.suse.com/1050611 https://bugzilla.suse.com/1050674 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:2225-1: important: Security update for git
by opensuse-security＠opensuse.org 21 Aug '17

21 Aug '17

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:2225-1 Rating: important References: #1052481 Cross-References: CVE-2017-1000117 Affected Products: SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: - CVE-2017-1000117: an argument injection in SSH URLs could lead to client-side code execution (bsc#1052481) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-git-13235=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-git-13235=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-git-13235=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): git-1.7.12.4-0.18.3.1 git-core-1.7.12.4-0.18.3.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): git-1.7.12.4-0.18.3.1 git-arch-1.7.12.4-0.18.3.1 git-core-1.7.12.4-0.18.3.1 git-cvs-1.7.12.4-0.18.3.1 git-daemon-1.7.12.4-0.18.3.1 git-email-1.7.12.4-0.18.3.1 git-gui-1.7.12.4-0.18.3.1 git-svn-1.7.12.4-0.18.3.1 git-web-1.7.12.4-0.18.3.1 gitk-1.7.12.4-0.18.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): git-debuginfo-1.7.12.4-0.18.3.1 git-debugsource-1.7.12.4-0.18.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000117.html https://bugzilla.suse.com/1052481 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0