- openSUSE Security Announce

[security-announce] SUSE-SU-2016:0555-1: important: Security update for postgresql94
by opensuse-security＠opensuse.org 24 Feb '16

24 Feb '16

SUSE Security Update: Security update for postgresql94 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0555-1 Rating: important References: #578053 #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql94 fixes the following issues: - Security and bugfix release 9.4.6: * *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries. * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html - PL/Perl still needs to be linked with rpath, so that it can find libperl.so at runtime. bsc#578053, postgresql-plperl-keep-rpath.patch Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-306=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-306=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-306=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-306=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-306=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-306=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): postgresql94-devel-9.4.6-7.1 postgresql94-devel-debuginfo-9.4.6-7.1 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): postgresql94-devel-9.4.6-7.1 postgresql94-devel-debuginfo-9.4.6-7.1 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-contrib-9.4.6-7.2 postgresql94-contrib-debuginfo-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 postgresql94-server-9.4.6-7.2 postgresql94-server-debuginfo-9.4.6-7.2 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libpq5-32bit-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): postgresql94-docs-9.4.6-7.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-contrib-9.4.6-7.2 postgresql94-contrib-debuginfo-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 postgresql94-server-9.4.6-7.2 postgresql94-server-debuginfo-9.4.6-7.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libpq5-32bit-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 - SUSE Linux Enterprise Server 12 (noarch): postgresql94-docs-9.4.6-7.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-32bit-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libecpg6-9.4.6-7.1 libecpg6-debuginfo-9.4.6-7.1 libpq5-32bit-9.4.6-7.1 libpq5-9.4.6-7.1 libpq5-debuginfo-32bit-9.4.6-7.1 libpq5-debuginfo-9.4.6-7.1 postgresql94-9.4.6-7.2 postgresql94-debuginfo-9.4.6-7.2 postgresql94-debugsource-9.4.6-7.2 postgresql94-libs-debugsource-9.4.6-7.1 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/578053 https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0554-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Feb '16

24 Feb '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0554-1 Rating: important References: #967087 Cross-References: CVE-2016-1523 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox fixes the following issues: - update to Firefox 38.6.1 ESR (bsc#967087) * MFSA 2016-14/CVE-2016-1523 (bmo#1246093) Vulnerabilities in Graphite 2 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-307=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-307=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-307=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-307=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-307=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-307=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-devel-38.6.1esr-60.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-devel-38.6.1esr-60.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.6.1esr-60.1 MozillaFirefox-debuginfo-38.6.1esr-60.1 MozillaFirefox-debugsource-38.6.1esr-60.1 MozillaFirefox-translations-38.6.1esr-60.1 References: https://www.suse.com/security/cve/CVE-2016-1523.html https://bugzilla.suse.com/967087 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0539-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 22 Feb '16

22 Feb '16

SUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0539-1 Rating: important References: #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.3/static/release-9-3-11.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-292=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-292=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-292=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): postgresql93-devel-9.3.11-14.1 postgresql93-devel-debuginfo-9.3.11-14.1 postgresql93-libs-debugsource-9.3.11-14.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): postgresql93-9.3.11-14.2 postgresql93-contrib-9.3.11-14.2 postgresql93-contrib-debuginfo-9.3.11-14.2 postgresql93-debuginfo-9.3.11-14.2 postgresql93-debugsource-9.3.11-14.2 postgresql93-server-9.3.11-14.2 postgresql93-server-debuginfo-9.3.11-14.2 - SUSE Linux Enterprise Server 12 (noarch): postgresql93-docs-9.3.11-14.2 - SUSE Linux Enterprise Desktop 12 (x86_64): postgresql93-9.3.11-14.2 postgresql93-debuginfo-9.3.11-14.2 postgresql93-debugsource-9.3.11-14.2 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0537-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Feb '16

22 Feb '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0537-1 Rating: important References: #907378 #961500 #963767 #965308 #965356 Cross-References: CVE-2016-0723 CVE-2016-2069 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: The openSUSE 13.2 kernel was updated to receive security and bugfixes. It also fixes a regression that caused the Chromium sandbox to no longer work (bsc#965356). Following security bugs were fixed: - CVE-2016-2069: A flaw was discovered in a way the Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question, causing a local denial service (machine crash). (bnc#963767). - CVE-2016-0723: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). The following non-security bugs were fixed: - Bluetooth: ath3k: workaround the compatibility issue with xHCI controller (bnc#907378). - kABI fix for addition of user_namespace.flags field (bnc#965308, bnc#965356). - userns: Add a knob to disable setgroups on a per user namespace basis (bnc#965308, bnc#965356). - userns: Allow setting gid_maps without privilege when setgroups is disabled (bnc#965308, bnc#965356). - userns: Rename id_map_mutex to userns_state_mutex (bnc#965308, bnc#965356). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-256=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i686 x86_64): kernel-debug-3.16.7-35.1 kernel-debug-base-3.16.7-35.1 kernel-debug-base-debuginfo-3.16.7-35.1 kernel-debug-debuginfo-3.16.7-35.1 kernel-debug-debugsource-3.16.7-35.1 kernel-debug-devel-3.16.7-35.1 kernel-debug-devel-debuginfo-3.16.7-35.1 kernel-desktop-3.16.7-35.1 kernel-desktop-base-3.16.7-35.1 kernel-desktop-base-debuginfo-3.16.7-35.1 kernel-desktop-debuginfo-3.16.7-35.1 kernel-desktop-debugsource-3.16.7-35.1 kernel-desktop-devel-3.16.7-35.1 kernel-ec2-base-debuginfo-3.16.7-35.1 kernel-ec2-debuginfo-3.16.7-35.1 kernel-ec2-debugsource-3.16.7-35.1 kernel-vanilla-3.16.7-35.1 kernel-vanilla-debuginfo-3.16.7-35.1 kernel-vanilla-debugsource-3.16.7-35.1 kernel-vanilla-devel-3.16.7-35.1 kernel-xen-3.16.7-35.1 kernel-xen-base-3.16.7-35.1 kernel-xen-base-debuginfo-3.16.7-35.1 kernel-xen-debuginfo-3.16.7-35.1 kernel-xen-debugsource-3.16.7-35.1 kernel-xen-devel-3.16.7-35.1 - openSUSE 13.2 (i586 x86_64): bbswitch-0.8-3.17.1 bbswitch-debugsource-0.8-3.17.1 bbswitch-kmp-default-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-default-debuginfo-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-desktop-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-desktop-debuginfo-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-xen-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-xen-debuginfo-0.8_k3.16.7_35-3.17.1 cloop-2.639-14.17.1 cloop-debuginfo-2.639-14.17.1 cloop-debugsource-2.639-14.17.1 cloop-kmp-default-2.639_k3.16.7_35-14.17.1 cloop-kmp-default-debuginfo-2.639_k3.16.7_35-14.17.1 cloop-kmp-desktop-2.639_k3.16.7_35-14.17.1 cloop-kmp-desktop-debuginfo-2.639_k3.16.7_35-14.17.1 cloop-kmp-xen-2.639_k3.16.7_35-14.17.1 cloop-kmp-xen-debuginfo-2.639_k3.16.7_35-14.17.1 crash-7.0.8-17.1 crash-debuginfo-7.0.8-17.1 crash-debugsource-7.0.8-17.1 crash-devel-7.0.8-17.1 crash-doc-7.0.8-17.1 crash-eppic-7.0.8-17.1 crash-eppic-debuginfo-7.0.8-17.1 crash-gcore-7.0.8-17.1 crash-gcore-debuginfo-7.0.8-17.1 crash-kmp-default-7.0.8_k3.16.7_35-17.1 crash-kmp-default-debuginfo-7.0.8_k3.16.7_35-17.1 crash-kmp-desktop-7.0.8_k3.16.7_35-17.1 crash-kmp-desktop-debuginfo-7.0.8_k3.16.7_35-17.1 crash-kmp-xen-7.0.8_k3.16.7_35-17.1 crash-kmp-xen-debuginfo-7.0.8_k3.16.7_35-17.1 hdjmod-debugsource-1.28-18.18.1 hdjmod-kmp-default-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-default-debuginfo-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-desktop-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-xen-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-xen-debuginfo-1.28_k3.16.7_35-18.18.1 ipset-6.23-17.1 ipset-debuginfo-6.23-17.1 ipset-debugsource-6.23-17.1 ipset-devel-6.23-17.1 ipset-kmp-default-6.23_k3.16.7_35-17.1 ipset-kmp-default-debuginfo-6.23_k3.16.7_35-17.1 ipset-kmp-desktop-6.23_k3.16.7_35-17.1 ipset-kmp-desktop-debuginfo-6.23_k3.16.7_35-17.1 ipset-kmp-xen-6.23_k3.16.7_35-17.1 ipset-kmp-xen-debuginfo-6.23_k3.16.7_35-17.1 kernel-default-3.16.7-35.1 kernel-default-base-3.16.7-35.1 kernel-default-base-debuginfo-3.16.7-35.1 kernel-default-debuginfo-3.16.7-35.1 kernel-default-debugsource-3.16.7-35.1 kernel-default-devel-3.16.7-35.1 kernel-ec2-3.16.7-35.1 kernel-ec2-base-3.16.7-35.1 kernel-ec2-devel-3.16.7-35.1 kernel-obs-build-3.16.7-35.2 kernel-obs-build-debugsource-3.16.7-35.2 kernel-obs-qa-3.16.7-35.1 kernel-obs-qa-xen-3.16.7-35.1 kernel-syms-3.16.7-35.1 libipset3-6.23-17.1 libipset3-debuginfo-6.23-17.1 pcfclock-0.44-260.17.1 pcfclock-debuginfo-0.44-260.17.1 pcfclock-debugsource-0.44-260.17.1 pcfclock-kmp-default-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-default-debuginfo-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-desktop-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.16.7_35-260.17.1 python-virtualbox-4.3.36-43.2 python-virtualbox-debuginfo-4.3.36-43.2 vhba-kmp-debugsource-20140629-2.17.1 vhba-kmp-default-20140629_k3.16.7_35-2.17.1 vhba-kmp-default-debuginfo-20140629_k3.16.7_35-2.17.1 vhba-kmp-desktop-20140629_k3.16.7_35-2.17.1 vhba-kmp-desktop-debuginfo-20140629_k3.16.7_35-2.17.1 vhba-kmp-xen-20140629_k3.16.7_35-2.17.1 vhba-kmp-xen-debuginfo-20140629_k3.16.7_35-2.17.1 virtualbox-4.3.36-43.2 virtualbox-debuginfo-4.3.36-43.2 virtualbox-debugsource-4.3.36-43.2 virtualbox-devel-4.3.36-43.2 virtualbox-guest-kmp-default-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-default-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-desktop-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-desktop-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-guest-tools-4.3.36-43.2 virtualbox-guest-tools-debuginfo-4.3.36-43.2 virtualbox-guest-x11-4.3.36-43.2 virtualbox-guest-x11-debuginfo-4.3.36-43.2 virtualbox-host-kmp-default-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-default-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-desktop-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-desktop-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-qt-4.3.36-43.2 virtualbox-qt-debuginfo-4.3.36-43.2 virtualbox-websrv-4.3.36-43.2 virtualbox-websrv-debuginfo-4.3.36-43.2 xen-debugsource-4.4.3_08-40.1 xen-devel-4.4.3_08-40.1 xen-libs-4.4.3_08-40.1 xen-libs-debuginfo-4.4.3_08-40.1 xen-tools-domU-4.4.3_08-40.1 xen-tools-domU-debuginfo-4.4.3_08-40.1 xtables-addons-2.6-17.1 xtables-addons-debuginfo-2.6-17.1 xtables-addons-debugsource-2.6-17.1 xtables-addons-kmp-default-2.6_k3.16.7_35-17.1 xtables-addons-kmp-default-debuginfo-2.6_k3.16.7_35-17.1 xtables-addons-kmp-desktop-2.6_k3.16.7_35-17.1 xtables-addons-kmp-desktop-debuginfo-2.6_k3.16.7_35-17.1 xtables-addons-kmp-xen-2.6_k3.16.7_35-17.1 xtables-addons-kmp-xen-debuginfo-2.6_k3.16.7_35-17.1 - openSUSE 13.2 (noarch): kernel-devel-3.16.7-35.1 kernel-docs-3.16.7-35.2 kernel-macros-3.16.7-35.1 kernel-source-3.16.7-35.1 kernel-source-vanilla-3.16.7-35.1 virtualbox-guest-desktop-icons-4.3.36-43.2 virtualbox-host-source-4.3.36-43.2 - openSUSE 13.2 (x86_64): xen-4.4.3_08-40.1 xen-doc-html-4.4.3_08-40.1 xen-kmp-default-4.4.3_08_k3.16.7_35-40.1 xen-kmp-default-debuginfo-4.4.3_08_k3.16.7_35-40.1 xen-kmp-desktop-4.4.3_08_k3.16.7_35-40.1 xen-kmp-desktop-debuginfo-4.4.3_08_k3.16.7_35-40.1 xen-libs-32bit-4.4.3_08-40.1 xen-libs-debuginfo-32bit-4.4.3_08-40.1 xen-tools-4.4.3_08-40.1 xen-tools-debuginfo-4.4.3_08-40.1 - openSUSE 13.2 (i686): kernel-pae-3.16.7-35.1 kernel-pae-base-3.16.7-35.1 kernel-pae-base-debuginfo-3.16.7-35.1 kernel-pae-debuginfo-3.16.7-35.1 kernel-pae-debugsource-3.16.7-35.1 kernel-pae-devel-3.16.7-35.1 - openSUSE 13.2 (i586): bbswitch-kmp-pae-0.8_k3.16.7_35-3.17.1 bbswitch-kmp-pae-debuginfo-0.8_k3.16.7_35-3.17.1 cloop-kmp-pae-2.639_k3.16.7_35-14.17.1 cloop-kmp-pae-debuginfo-2.639_k3.16.7_35-14.17.1 crash-kmp-pae-7.0.8_k3.16.7_35-17.1 crash-kmp-pae-debuginfo-7.0.8_k3.16.7_35-17.1 hdjmod-kmp-pae-1.28_k3.16.7_35-18.18.1 hdjmod-kmp-pae-debuginfo-1.28_k3.16.7_35-18.18.1 ipset-kmp-pae-6.23_k3.16.7_35-17.1 ipset-kmp-pae-debuginfo-6.23_k3.16.7_35-17.1 pcfclock-kmp-pae-0.44_k3.16.7_35-260.17.1 pcfclock-kmp-pae-debuginfo-0.44_k3.16.7_35-260.17.1 vhba-kmp-pae-20140629_k3.16.7_35-2.17.1 vhba-kmp-pae-debuginfo-20140629_k3.16.7_35-2.17.1 virtualbox-guest-kmp-pae-4.3.36_k3.16.7_35-43.2 virtualbox-guest-kmp-pae-debuginfo-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-pae-4.3.36_k3.16.7_35-43.2 virtualbox-host-kmp-pae-debuginfo-4.3.36_k3.16.7_35-43.2 xtables-addons-kmp-pae-2.6_k3.16.7_35-17.1 xtables-addons-kmp-pae-debuginfo-2.6_k3.16.7_35-17.1 References: https://www.suse.com/security/cve/CVE-2016-0723.html https://www.suse.com/security/cve/CVE-2016-2069.html https://bugzilla.suse.com/907378 https://bugzilla.suse.com/961500 https://bugzilla.suse.com/963767 https://bugzilla.suse.com/965308 https://bugzilla.suse.com/965356 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0536-1: important: Security update for qemu
by opensuse-security＠opensuse.org 21 Feb '16

21 Feb '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0536-1 Rating: important References: #954864 #956829 #957162 Cross-References: CVE-2015-7512 CVE-2015-8345 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - Enforce receive packet size, thus eliminating buffer overflow and potential security issue. (bsc#957162 CVE-2015-7512) - Infinite loop in processing command block list. CVE-2015-8345 (bsc#956829): This update also fixes a non-security bug: - Due to space restrictions in limited bios data areas, don't create mptable if vcpu count is "high" (ie more than ~19). (bsc#954864) (No supported guests are negatively impacted by this change, which is taken from upstream seabios) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-252=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): qemu-2.3.1-12.1 qemu-arm-2.3.1-12.1 qemu-arm-debuginfo-2.3.1-12.1 qemu-block-curl-2.3.1-12.1 qemu-block-curl-debuginfo-2.3.1-12.1 qemu-debugsource-2.3.1-12.1 qemu-extra-2.3.1-12.1 qemu-extra-debuginfo-2.3.1-12.1 qemu-guest-agent-2.3.1-12.1 qemu-guest-agent-debuginfo-2.3.1-12.1 qemu-kvm-2.3.1-12.1 qemu-lang-2.3.1-12.1 qemu-linux-user-2.3.1-12.1 qemu-linux-user-debuginfo-2.3.1-12.1 qemu-linux-user-debugsource-2.3.1-12.1 qemu-ppc-2.3.1-12.1 qemu-ppc-debuginfo-2.3.1-12.1 qemu-s390-2.3.1-12.1 qemu-s390-debuginfo-2.3.1-12.1 qemu-tools-2.3.1-12.1 qemu-tools-debuginfo-2.3.1-12.1 qemu-x86-2.3.1-12.1 qemu-x86-debuginfo-2.3.1-12.1 - openSUSE Leap 42.1 (x86_64): qemu-block-rbd-2.3.1-12.1 qemu-block-rbd-debuginfo-2.3.1-12.1 qemu-testsuite-2.3.1-12.2 - openSUSE Leap 42.1 (noarch): qemu-ipxe-1.0.0-12.1 qemu-seabios-1.8.1-12.1 qemu-sgabios-8-12.1 qemu-vgabios-1.8.1-12.1 References: https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://bugzilla.suse.com/954864 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0531-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 21 Feb '16

21 Feb '16

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0531-1 Rating: important References: #966435 #966436 Cross-References: CVE-2007-4772 CVE-2016-0766 CVE-2016-0773 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for postgresql93 fixes the following issues: - Security and bugfix release 9.3.11: * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, boo#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, boo#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.3/static/release-9-3-11.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-253=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-253=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): postgresql93-9.3.11-3.2 postgresql93-contrib-9.3.11-3.2 postgresql93-contrib-debuginfo-9.3.11-3.2 postgresql93-debuginfo-9.3.11-3.2 postgresql93-debugsource-9.3.11-3.2 postgresql93-devel-9.3.11-3.2 postgresql93-devel-debuginfo-9.3.11-3.2 postgresql93-libs-debugsource-9.3.11-3.2 postgresql93-plperl-9.3.11-3.2 postgresql93-plperl-debuginfo-9.3.11-3.2 postgresql93-plpython-9.3.11-3.2 postgresql93-plpython-debuginfo-9.3.11-3.2 postgresql93-pltcl-9.3.11-3.2 postgresql93-pltcl-debuginfo-9.3.11-3.2 postgresql93-server-9.3.11-3.2 postgresql93-server-debuginfo-9.3.11-3.2 postgresql93-test-9.3.11-3.2 - openSUSE Leap 42.1 (noarch): postgresql-init-9.4-6.1 postgresql93-docs-9.3.11-3.2 - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.11-2.10.1 libecpg6-debuginfo-9.3.11-2.10.1 libpq5-9.3.11-2.10.1 libpq5-debuginfo-9.3.11-2.10.1 postgresql93-9.3.11-2.10.1 postgresql93-contrib-9.3.11-2.10.1 postgresql93-contrib-debuginfo-9.3.11-2.10.1 postgresql93-debuginfo-9.3.11-2.10.1 postgresql93-debugsource-9.3.11-2.10.1 postgresql93-devel-9.3.11-2.10.1 postgresql93-devel-debuginfo-9.3.11-2.10.1 postgresql93-libs-debugsource-9.3.11-2.10.1 postgresql93-plperl-9.3.11-2.10.1 postgresql93-plperl-debuginfo-9.3.11-2.10.1 postgresql93-plpython-9.3.11-2.10.1 postgresql93-plpython-debuginfo-9.3.11-2.10.1 postgresql93-pltcl-9.3.11-2.10.1 postgresql93-pltcl-debuginfo-9.3.11-2.10.1 postgresql93-server-9.3.11-2.10.1 postgresql93-server-debuginfo-9.3.11-2.10.1 postgresql93-test-9.3.11-2.10.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.11-2.10.1 libecpg6-debuginfo-32bit-9.3.11-2.10.1 libpq5-32bit-9.3.11-2.10.1 libpq5-debuginfo-32bit-9.3.11-2.10.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.11-2.10.1 References: https://www.suse.com/security/cve/CVE-2007-4772.html https://www.suse.com/security/cve/CVE-2016-0766.html https://www.suse.com/security/cve/CVE-2016-0773.html https://bugzilla.suse.com/966435 https://bugzilla.suse.com/966436 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0529-1: critical: Security update for Chromium
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0529-1 Rating: critical References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update contains Chromium 48.0.2564.116 and fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-249=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-48.0.2564.116-129.1 chromedriver-debuginfo-48.0.2564.116-129.1 chromium-48.0.2564.116-129.1 chromium-debuginfo-48.0.2564.116-129.1 chromium-debugsource-48.0.2564.116-129.1 chromium-desktop-gnome-48.0.2564.116-129.1 chromium-desktop-kde-48.0.2564.116-129.1 chromium-ffmpegsumo-48.0.2564.116-129.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-129.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0525-1: critical: Security update to Chromium 48.0.2564.116
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update to Chromium 48.0.2564.116 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0525-1 Rating: critical References: #967376 Cross-References: CVE-2016-1629 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Chromium 48.0.2564.116 ans fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-239=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-48.0.2564.116-24.1 chromedriver-debuginfo-48.0.2564.116-24.1 chromium-48.0.2564.116-24.1 chromium-debuginfo-48.0.2564.116-24.1 chromium-debugsource-48.0.2564.116-24.1 chromium-desktop-gnome-48.0.2564.116-24.1 chromium-desktop-kde-48.0.2564.116-24.1 chromium-ffmpegsumo-48.0.2564.116-24.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-24.1 - openSUSE 13.2 (i586 x86_64): chromedriver-48.0.2564.116-78.1 chromedriver-debuginfo-48.0.2564.116-78.1 chromium-48.0.2564.116-78.1 chromium-debuginfo-48.0.2564.116-78.1 chromium-debugsource-48.0.2564.116-78.1 chromium-desktop-gnome-48.0.2564.116-78.1 chromium-desktop-kde-48.0.2564.116-78.1 chromium-ffmpegsumo-48.0.2564.116-78.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-78.1 References: https://www.suse.com/security/cve/CVE-2016-1629.html https://bugzilla.suse.com/967376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0521-1: important: Security update for obs-service-download_files, obs-service-extract_file, obs-service-recompress, obs-service-source_validator, obs-service-verify_file
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update for obs-service-download_files, obs-service-extract_file, obs-service-recompress, obs-service-source_validator, obs-service-verify_file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0521-1 Rating: important References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for a number of source services fixes the following issues: - boo#967265: Various code/parameter injection issues could have allowed malicious service definition to execute commands or make changes to the user's file system The following source services are affected - obs-service-source_validator - obs-service-extract_file - obs-service-download_files - obs-service-recompress - obs-service-verify_file Also contains all bug fixes and improvements from the openSUSE:Tools versions. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-247=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-247=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): obs-service-download_files-0.5.1.git.1455712026.9c0a4a0-6.1 obs-service-extract_file-0.3-5.1 obs-service-recompress-0.3.1+git20160217.7897d3f-7.1 obs-service-source_validator-0.6+git20160218.73d6618-5.1 obs-service-verify_file-0.1.1-20.1 - openSUSE 13.2 (noarch): obs-service-download_files-0.5.1.git.1455712026.9c0a4a0-2.6.1 obs-service-extract_file-0.3-3.1 obs-service-recompress-0.3.1+git20160217.7897d3f-3.3.1 obs-service-source_validator-0.6+git20160218.73d6618-3.1 obs-service-verify_file-0.1.1-12.3.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0520-1: critical: Security update to Chromium 48.0.2564.116
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update to Chromium 48.0.2564.116 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0520-1 Rating: critical References: #967376 Cross-References: CVE-2016-1629 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Chromium 48.0.2564.116 ans fixes the following security flaw: - CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. (boo#967376) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-239=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-48.0.2564.116-52.1 chromedriver-debuginfo-48.0.2564.116-52.1 chromium-48.0.2564.116-52.1 chromium-debuginfo-48.0.2564.116-52.1 chromium-debugsource-48.0.2564.116-52.1 chromium-desktop-gnome-48.0.2564.116-52.1 chromium-desktop-kde-48.0.2564.116-52.1 chromium-ffmpegsumo-48.0.2564.116-52.1 chromium-ffmpegsumo-debuginfo-48.0.2564.116-52.1 References: https://www.suse.com/security/cve/CVE-2016-1629.html https://bugzilla.suse.com/967376 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0