March 2018 - openSUSE Security Announce

[security-announce] SUSE-SU-2018:0665-1: important: Security update for java-1_8_0-ibm
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_8_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0665-1 Rating: important References: #1076390 #1082810 #929900 #955131 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2638 CVE-2018-2639 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for java-1_8_0-ibm fixes the following issues: - Removed java-1_8_0-ibm-alsa and java-1_8_0-ibm-plugin entries in baselibs.conf due to errors in osc source_validator Version update to 8.0.5.10 [bsc#1082810] * Security fixes: CVE-2018-2639 CVE-2018-2638 CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ02608 Class Libraries: Change of namespace definitions with handlers that implement javax.xml.ws.handler.soap.soaphandler - IJ04280 Class Libraries: Deploy Upgrade to Oracle level 8u161-b12 - IJ03390 Class Libraries: JCL Upgrade to Oracle level 8u161-b12 - IJ04001 Class Libraries: Performance improvement with child process on AIX - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03440 Java Virtual Machine: Assertion failure during class creation - IJ03717 Java Virtual Machine: Assertion for gencon with concurrent scavenger on ZOS64 - IJ03513 Java Virtual Machine: Assertion in concurrent scavenger if initial heap memory size -Xms is set too low - IJ03994 Java Virtual Machine: Class.getmethods() does not return all methods - IJ03413 Java Virtual Machine: Hang creating thread after redefining classes - IJ03852 Java Virtual Machine: ICH408I message when groupaccess is specified with -xshareclasses - IJ03716 Java Virtual Machine: java/lang/linkageerror from sun/misc/unsafe.definean onymousclass() - IJ03116 Java Virtual Machine: java.fullversion string contains an extra space - IJ03347 Java Virtual Machine: java.lang.IllegalStateException in related class MemoryMXBean - IJ03878 Java Virtual Machine: java.lang.StackOverflowError is thrown when custom security manager in place - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ04248 JIT Compiler: ArrayIndexOutOfBoundsException is thrown when converting BigDecimal to String - IJ04250 JIT Compiler: Assertion failure with concurrentScavenge on Z14 - IJ03606 JIT Compiler: Java crashes with -version - IJ04251 JIT Compiler: JIT compiled method that takes advantage of AutoSIMD produces an incorrect result on x86 - IJ03854 JIT Compiler: JVM info message appears in stdout - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ03715 Security: Add additional support for the IBMJCEPlus provider, add support for new IBMJCEPlusFIPS provider - IJ03800 Security: A fix in CMS provider for KDB integrity - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - PI93233 z/OS Extentions: Cipher.doFinal() fails when using AES/GCM/nopadding with AAD data of 13 bytes and a block size of 4081 to 4096 * Fixes in 8.0.5.7: - IJ02605 Class Libraries: Update IBM-1371 charset with new specification support - IJ02541 Java Virtual Machine: Assertions in GC when jvmti runs with Concurrent Scavenger - IJ02443 Java Virtual Machine: Committed eden region size is bigger than maximum eden region size - IJ02378 Java Virtual Machine: Existing signal action for SIG_IGN/SIG_DFL is not detected properly - IJ02758 JIT Compiler: Crash in JIT module during method compilation - IJ02733 JIT Compiler: Crash in jit module when compiling in non-default configuration * Fixes in 8.0.5.6: - IJ02283 Java Virtual Machine: IllegalAccessException due to a missing access check for the same class in MethodHandle apis - IJ02082 Java Virtual Machine: The default value for class unloading kick off threshold is not set - IJ02018 JIT Compiler: Crash or assertion while attempting to acquire VM access - IJ02284 JIT Compiler: Division by zero in JIT compiler - IV88941 JIT Compiler: JIT compiler takes far too long to compile a method - IJ02285 JIT Compiler: Performance degradation during class unloading in Java 8 SR5 - Support Java jnlp files run from Firefox. [bsc#1076390] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-447=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-447=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2018-447=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-447=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-447=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-447=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-447=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-ibm-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-devel-1.8.0_sr5.10-30.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): java-1_8_0-ibm-alsa-1.8.0_sr5.10-30.16.1 java-1_8_0-ibm-plugin-1.8.0_sr5.10-30.16.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2638.html https://www.suse.com/security/cve/CVE-2018-2639.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/955131 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0664-1: important: Security update for the Linux Kernel (Live Patch 32 for SLE 12)
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for the Linux Kernel (Live Patch 32 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0664-1 Rating: important References: #1064392 Cross-References: CVE-2017-15649 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.61-52_122 fixes several issues. The following security issue was fixed: - CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bsc#1064392) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2018-450=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_122-default-2-2.1 kgraft-patch-3_12_61-52_122-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-15649.html https://bugzilla.suse.com/1064392 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0663-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0663-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Security issues fix in jdk8u161 (icedtea 3.7.0)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2582: Better interface invocations - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming deserialization cases Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-449=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-449=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-449=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-449=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-449=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-449=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-449=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-449=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-1.8.0.161-27.13.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-devel-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): java-1_8_0-openjdk-1.8.0.161-27.13.1 java-1_8_0-openjdk-debuginfo-1.8.0.161-27.13.1 java-1_8_0-openjdk-debugsource-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-1.8.0.161-27.13.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.161-27.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0661-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0661-1 Rating: important References: #1076366 Cross-References: CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 (January 2018 CPU)(bsc#1076366): - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages - CVE-2018-2603: Improve PKCS usage - CVE-2018-2618: Stricter key generation - CVE-2018-2629: Improve GSS handling - CVE-2018-2633: Improve LDAP lookup robustness - CVE-2018-2634: Improve property negotiations - CVE-2018-2637: Improve JMX supportive features - CVE-2018-2641: Improve GTK initialization - CVE-2018-2663: More refactoring for deserialization cases - CVE-2018-2677: More refactoring for client deserialization cases - CVE-2018-2678: More refactoring for naming Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-448=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-448=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-448=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-448=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-448=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-1.7.0.171-43.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-1.7.0.171-43.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): java-1_7_0-openjdk-1.7.0.171-43.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.171-43.12.1 java-1_7_0-openjdk-debugsource-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-1.7.0.171-43.12.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.171-43.12.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2629.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1076366 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0660-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 12 Mar '18

12 Mar '18

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0660-1 Rating: important References: #1012382 #1054305 #1060279 #1068032 #1068984 #1070781 #1073311 #1074488 #1074621 #1075091 #1075410 #1075617 #1075621 #1075908 #1075994 #1076017 #1076154 #1076278 #1076849 #1077406 #1077560 #1077922 Cross-References: CVE-2017-13215 CVE-2017-17741 CVE-2017-18017 CVE-2017-18079 CVE-2017-5715 CVE-2018-1000004 CVE-2018-5332 CVE-2018-5333 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 14 fixes is now available. Description: The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032). The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka "retpolines". - CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621). - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617). - CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488). - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922). - CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311). - CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908). - CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017). The following non-security bugs were fixed: - cdc-acm: apply quirk for card reader (bsc#1060279). - Enable CPU vulnerabilities reporting via sysfs - fork: clear thread stack upon allocation (bsc#1077560). - kaiser: Set _PAGE_NX only if supported (bnc#1012382, bnc#1076278). - kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032). - Move kABI fixup for retpolines to proper place. - powerpc/vdso64: Use double word compare on pointers (bsc#1070781). - s390: add ppa to the idle loop (bnc#1077406, LTC#163910). - s390/cpuinfo: show facilities as reported by stfle (bnc#1076849, LTC#163741). - storvsc: do not assume SG list is continuous when doing bounce buffers (bsc#1075410). - sysfs/cpu: Add vulnerability folder (bnc#1012382). - sysfs/cpu: Fix typos in vulnerability documentation (bnc#1012382). - sysfs: spectre_v2, handle spec_ctrl (bsc#1075994 bsc#1075091). - x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984). - x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984). - x86/boot: Fix early command-line parsing when matching at end (bsc#1068032). - x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091). - x86/cpu: Implement CPU vulnerabilites sysfs functions (bnc#1012382). - x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091). - x86/kaiser: Populate shadow PGD with NX bit only if supported by platform (bsc#1076154 bsc#1076278). - x86/kaiser: use trampoline stack for kernel entry. - x86/microcode/intel: Disable late loading on model 79 (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading further with LLC size check (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading with a revision check (bsc#1054305). - x86/microcode: Rescan feature flags upon late loading (bsc#1075994 bsc#1075091). - x86/retpolines/spec_ctrl: disable IBRS on !SKL if retpolines are active (bsc#1068032). - x86/spec_ctrl: handle late setting of X86_FEATURE_SPEC_CTRL properly (bsc#1075994 bsc#1075091). - x86/spectre_v2: fix ordering in IBRS initialization (bsc#1075994 bsc#1075091). - x86/spectre_v2: nospectre_v2 means nospec too (bsc#1075994 bsc#1075091). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-kernel-20180212-13505=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-20180212-13505=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.47.106.19.1 kernel-default-base-3.0.101-0.47.106.19.1 kernel-default-devel-3.0.101-0.47.106.19.1 kernel-source-3.0.101-0.47.106.19.1 kernel-syms-3.0.101-0.47.106.19.1 kernel-trace-3.0.101-0.47.106.19.1 kernel-trace-base-3.0.101-0.47.106.19.1 kernel-trace-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.47.106.19.1 kernel-ec2-base-3.0.101-0.47.106.19.1 kernel-ec2-devel-3.0.101-0.47.106.19.1 kernel-xen-3.0.101-0.47.106.19.1 kernel-xen-base-3.0.101-0.47.106.19.1 kernel-xen-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): kernel-bigsmp-3.0.101-0.47.106.19.1 kernel-bigsmp-base-3.0.101-0.47.106.19.1 kernel-bigsmp-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x): kernel-default-man-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): kernel-pae-3.0.101-0.47.106.19.1 kernel-pae-base-3.0.101-0.47.106.19.1 kernel-pae-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.106.19.1 kernel-trace-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): kernel-default-3.0.101-0.47.106.19.1 kernel-default-base-3.0.101-0.47.106.19.1 kernel-default-devel-3.0.101-0.47.106.19.1 kernel-ec2-3.0.101-0.47.106.19.1 kernel-ec2-base-3.0.101-0.47.106.19.1 kernel-ec2-devel-3.0.101-0.47.106.19.1 kernel-pae-3.0.101-0.47.106.19.1 kernel-pae-base-3.0.101-0.47.106.19.1 kernel-pae-devel-3.0.101-0.47.106.19.1 kernel-source-3.0.101-0.47.106.19.1 kernel-syms-3.0.101-0.47.106.19.1 kernel-trace-3.0.101-0.47.106.19.1 kernel-trace-base-3.0.101-0.47.106.19.1 kernel-trace-devel-3.0.101-0.47.106.19.1 kernel-xen-3.0.101-0.47.106.19.1 kernel-xen-base-3.0.101-0.47.106.19.1 kernel-xen-devel-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.106.19.1 kernel-default-debugsource-3.0.101-0.47.106.19.1 kernel-trace-debuginfo-3.0.101-0.47.106.19.1 kernel-trace-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.106.19.1 kernel-ec2-debugsource-3.0.101-0.47.106.19.1 kernel-xen-debuginfo-3.0.101-0.47.106.19.1 kernel-xen-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.106.19.1 kernel-bigsmp-debugsource-3.0.101-0.47.106.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.106.19.1 kernel-pae-debugsource-3.0.101-0.47.106.19.1 References: https://www.suse.com/security/cve/CVE-2017-13215.html https://www.suse.com/security/cve/CVE-2017-17741.html https://www.suse.com/security/cve/CVE-2017-18017.html https://www.suse.com/security/cve/CVE-2017-18079.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2018-1000004.html https://www.suse.com/security/cve/CVE-2018-5332.html https://www.suse.com/security/cve/CVE-2018-5333.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1054305 https://bugzilla.suse.com/1060279 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1068984 https://bugzilla.suse.com/1070781 https://bugzilla.suse.com/1073311 https://bugzilla.suse.com/1074488 https://bugzilla.suse.com/1074621 https://bugzilla.suse.com/1075091 https://bugzilla.suse.com/1075410 https://bugzilla.suse.com/1075617 https://bugzilla.suse.com/1075621 https://bugzilla.suse.com/1075908 https://bugzilla.suse.com/1075994 https://bugzilla.suse.com/1076017 https://bugzilla.suse.com/1076154 https://bugzilla.suse.com/1076278 https://bugzilla.suse.com/1076849 https://bugzilla.suse.com/1077406 https://bugzilla.suse.com/1077560 https://bugzilla.suse.com/1077922 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0645-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 09 Mar '18

09 Mar '18

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0645-1 Rating: important References: #1057460 #1076390 #1082810 #929900 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_0-ibm provides the following fixes: The version was updated to 7.0.10.20 [bsc#1082810]: * Following security issues were fixed: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ02284 JIT Compiler: Division by zero in JIT compiler - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_7_0-ibm-13503=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-java-1_7_0-ibm-13503=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_7_0-ibm-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-devel-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-jdbc-1.7.0_sr10.20-65.13.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-plugin-1.7.0_sr10.20-65.13.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): java-1_7_0-ibm-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-alsa-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-devel-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-jdbc-1.7.0_sr10.20-65.13.1 java-1_7_0-ibm-plugin-1.7.0_sr10.20-65.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0638-1: important: Security update for xen
by opensuse-security＠opensuse.org 08 Mar '18

08 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0638-1 Rating: important References: #1027519 #1031382 #1035442 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-5683 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for xen fixes several issues. This new feature was included: - add script and sysv service to watch for vcpu online/offline events in a HVM domU These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). These non-security issues were fixed: - bsc#1035442: Increased the value of LIBXL_DESTROY_TIMEOUT from 10 to 100 seconds. If many domUs shutdown in parallel the backends couldn't keep up - bsc#1031382: Prevent VMs from crashing when migrating between dom0 hosts in case read() returns zero on the receiver side. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-13501=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-13501=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-13501=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_28_3.0.101_108.35-61.23.2 xen-libs-4.4.4_28-61.23.2 xen-tools-domU-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_28-61.23.2 xen-doc-html-4.4.4_28-61.23.2 xen-libs-32bit-4.4.4_28-61.23.2 xen-tools-4.4.4_28-61.23.2 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_28_3.0.101_108.35-61.23.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_28-61.23.2 xen-debugsource-4.4.4_28-61.23.2 References: https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2018-5683.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1031382 https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0630-1: important: Security update for java-1_7_1-ibm
by opensuse-security＠opensuse.org 07 Mar '18

07 Mar '18

SUSE Security Update: Security update for java-1_7_1-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0630-1 Rating: important References: #1057460 #1076390 #1082810 #929900 #966304 Cross-References: CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_1-ibm provides the following fix: The version was updated to 7.1.4.20 [bsc#1082810] * Security fixes: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ03256 Security: javax.security.auth.Subject.toString() throws NPE - IJ02284 JIT Compiler: Division by zero in JIT compiler - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-java-1_7_1-ibm-13500=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-java-1_7_1-ibm-13500=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-devel-1.7.1_sr4.20-26.13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ppc64 s390x x86_64): java-1_7_1-ibm-1.7.1_sr4.20-26.13.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.20-26.13.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): java-1_7_1-ibm-alsa-1.7.1_sr4.20-26.13.1 java-1_7_1-ibm-plugin-1.7.1_sr4.20-26.13.1 References: https://www.suse.com/security/cve/CVE-2018-2579.html https://www.suse.com/security/cve/CVE-2018-2582.html https://www.suse.com/security/cve/CVE-2018-2588.html https://www.suse.com/security/cve/CVE-2018-2599.html https://www.suse.com/security/cve/CVE-2018-2602.html https://www.suse.com/security/cve/CVE-2018-2603.html https://www.suse.com/security/cve/CVE-2018-2618.html https://www.suse.com/security/cve/CVE-2018-2633.html https://www.suse.com/security/cve/CVE-2018-2634.html https://www.suse.com/security/cve/CVE-2018-2637.html https://www.suse.com/security/cve/CVE-2018-2641.html https://www.suse.com/security/cve/CVE-2018-2657.html https://www.suse.com/security/cve/CVE-2018-2663.html https://www.suse.com/security/cve/CVE-2018-2677.html https://www.suse.com/security/cve/CVE-2018-2678.html https://bugzilla.suse.com/1057460 https://bugzilla.suse.com/1076390 https://bugzilla.suse.com/1082810 https://bugzilla.suse.com/929900 https://bugzilla.suse.com/966304 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2018:0618-1: important: Security update for cups
by opensuse-security＠opensuse.org 06 Mar '18

06 Mar '18

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0618-1 Rating: important References: #1081557 Cross-References: CVE-2017-18190 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: - CVE-2017-18190: Removed localhost.localdomain from list of trustworthy hosts in scheduler/client.c to avoid arbitrary IPP command execution in conjunction with DNS rebinding. (bsc#1081557) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-225=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cups-1.7.5-12.3.1 cups-client-1.7.5-12.3.1 cups-client-debuginfo-1.7.5-12.3.1 cups-ddk-1.7.5-12.3.1 cups-ddk-debuginfo-1.7.5-12.3.1 cups-debuginfo-1.7.5-12.3.1 cups-debugsource-1.7.5-12.3.1 cups-devel-1.7.5-12.3.1 cups-libs-1.7.5-12.3.1 cups-libs-debuginfo-1.7.5-12.3.1 - openSUSE Leap 42.3 (x86_64): cups-libs-32bit-1.7.5-12.3.1 cups-libs-debuginfo-32bit-1.7.5-12.3.1 References: https://www.suse.com/security/cve/CVE-2017-18190.html https://bugzilla.suse.com/1081557 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2018:0609-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Mar '18

05 Mar '18

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:0609-1 Rating: important References: #1035442 #1061081 #1068032 #1070158 #1070159 #1070160 #1070163 #1074562 #1076116 #1076180 #1080635 #1080662 Cross-References: CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-5683 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves 10 vulnerabilities and has two fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). This non-security issue was fixed: - bsc#1035442: Increased the value of LIBXL_DESTROY_TIMEOUT from 10 to 100 seconds. If many domUs shutdown in parallel the backends couldn't keep up Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2018-415=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-415=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-415=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): xen-4.5.5_24-22.43.1 xen-debugsource-4.5.5_24-22.43.1 xen-doc-html-4.5.5_24-22.43.1 xen-kmp-default-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-kmp-default-debuginfo-4.5.5_24_k3.12.74_60.64.82-22.43.1 xen-libs-32bit-4.5.5_24-22.43.1 xen-libs-4.5.5_24-22.43.1 xen-libs-debuginfo-32bit-4.5.5_24-22.43.1 xen-libs-debuginfo-4.5.5_24-22.43.1 xen-tools-4.5.5_24-22.43.1 xen-tools-debuginfo-4.5.5_24-22.43.1 xen-tools-domU-4.5.5_24-22.43.1 xen-tools-domU-debuginfo-4.5.5_24-22.43.1 References: https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-17563.html https://www.suse.com/security/cve/CVE-2017-17564.html https://www.suse.com/security/cve/CVE-2017-17565.html https://www.suse.com/security/cve/CVE-2017-17566.html https://www.suse.com/security/cve/CVE-2017-18030.html https://www.suse.com/security/cve/CVE-2017-5715.html https://www.suse.com/security/cve/CVE-2017-5753.html https://www.suse.com/security/cve/CVE-2017-5754.html https://www.suse.com/security/cve/CVE-2018-5683.html https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1068032 https://bugzilla.suse.com/1070158 https://bugzilla.suse.com/1070159 https://bugzilla.suse.com/1070160 https://bugzilla.suse.com/1070163 https://bugzilla.suse.com/1074562 https://bugzilla.suse.com/1076116 https://bugzilla.suse.com/1076180 https://bugzilla.suse.com/1080635 https://bugzilla.suse.com/1080662 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0