- openSUSE Security Announce

[security-announce] SUSE-SU-2015:0927-1: important: Security update for Xen
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0927-1 Rating: important References: #910441 #927967 #929339 Cross-References: CVE-2015-3456 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen=10673 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen=10673 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen=10673 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-libs-4.2.5_06-0.7.1 xen-tools-domU-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.5_06-0.7.1 xen-doc-html-4.2.5_06-0.7.1 xen-doc-pdf-4.2.5_06-0.7.1 xen-libs-32bit-4.2.5_06-0.7.1 xen-tools-4.2.5_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_06_3.0.101_0.47.52-0.7.1 xen-libs-4.2.5_06-0.7.1 xen-tools-domU-4.2.5_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.5_06-0.7.1 xen-doc-html-4.2.5_06-0.7.1 xen-doc-pdf-4.2.5_06-0.7.1 xen-libs-32bit-4.2.5_06-0.7.1 xen-tools-4.2.5_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.5_06_3.0.101_0.47.52-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/910441 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 https://download.suse.com/patch/finder/?keywords=beaa1b0c2d4c1d543469208fc4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0923-1: important: Security update for xen
by opensuse-security＠opensuse.org 21 May '15

21 May '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0923-1 Rating: important References: #922705 #922709 #927967 #929339 Cross-References: CVE-2015-2751 CVE-2015-2752 CVE-2015-3340 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: XEN was updated to fix two security issues and bugs. Security issues fixed: * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * CVE-2015-2751: Xen, when using toolstack disaggregation, allowed remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. * CVE-2015-2752: The XEN_DOMCTL_memory_mapping hypercall in Xen, when using a PCI passthrough device, was not preemptable, which allowed local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Bugs fixed: - xentop: Fix memory leak on read failure Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-206=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-206=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-206=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.2_04-18.1 xen-devel-4.4.2_04-18.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.2_04-18.1 xen-debugsource-4.4.2_04-18.1 xen-doc-html-4.4.2_04-18.1 xen-kmp-default-4.4.2_04_k3.12.39_47-18.1 xen-kmp-default-debuginfo-4.4.2_04_k3.12.39_47-18.1 xen-libs-32bit-4.4.2_04-18.1 xen-libs-4.4.2_04-18.1 xen-libs-debuginfo-32bit-4.4.2_04-18.1 xen-libs-debuginfo-4.4.2_04-18.1 xen-tools-4.4.2_04-18.1 xen-tools-debuginfo-4.4.2_04-18.1 xen-tools-domU-4.4.2_04-18.1 xen-tools-domU-debuginfo-4.4.2_04-18.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.2_04-18.1 xen-debugsource-4.4.2_04-18.1 xen-kmp-default-4.4.2_04_k3.12.39_47-18.1 xen-kmp-default-debuginfo-4.4.2_04_k3.12.39_47-18.1 xen-libs-32bit-4.4.2_04-18.1 xen-libs-4.4.2_04-18.1 xen-libs-debuginfo-32bit-4.4.2_04-18.1 xen-libs-debuginfo-4.4.2_04-18.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-2752.html https://www.suse.com/security/cve/CVE-2015-3340.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/922705 https://bugzilla.suse.com/922709 https://bugzilla.suse.com/927967 https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0921-1: important: Security update for gstreamer-0_10-plugins-bad
by opensuse-security＠opensuse.org 20 May '15

20 May '15

SUSE Security Update: Security update for gstreamer-0_10-plugins-bad ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0921-1 Rating: important References: #927559 Cross-References: CVE-2015-0797 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797). Security Issues: * CVE-2015-0797 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-gstreamer-0_10-plugins-bad=10643 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): gstreamer-0_10-plugins-bad-0.10.22-7.11.1 gstreamer-0_10-plugins-bad-lang-0.10.22-7.11.1 libgstbasecamerabinsrc-0_10-0-0.10.22-7.11.1 libgstbasevideo-0_10-0-0.10.22-7.11.1 libgstphotography-0_10-0-0.10.22-7.11.1 libgstsignalprocessor-0_10-0-0.10.22-7.11.1 libgstvdp-0_10-0-0.10.22-7.11.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libgstbasecamerabinsrc-0_10-0-32bit-0.10.22-7.11.1 libgstbasevideo-0_10-0-32bit-0.10.22-7.11.1 libgstphotography-0_10-0-32bit-0.10.22-7.11.1 libgstsignalprocessor-0_10-0-32bit-0.10.22-7.11.1 libgstvdp-0_10-0-32bit-0.10.22-7.11.1 References: https://www.suse.com/security/cve/CVE-2015-0797.html https://bugzilla.suse.com/927559 https://download.suse.com/patch/finder/?keywords=f7ccd0598b1d14e206c07e7685… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0914-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 19 May '15

19 May '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0914-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-372=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-372=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.460-2.51.1 flash-player-gnome-11.2.202.460-2.51.1 flash-player-kde4-11.2.202.460-2.51.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.460-116.1 flash-player-gnome-11.2.202.460-116.1 flash-player-kde4-11.2.202.460-116.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0896-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0896-1 Rating: important References: #886378 #924018 #929339 Cross-References: CVE-2015-1779 CVE-2015-3456 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: qemu / kvm was updated to fix a security issue and some bugs. Security issue fixed: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. * CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder. Bugs fixed: - qemu truncates vhd images in virt-rescue (bsc#886378) - Update kvm-supported.txt with the current rbd support status. - enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-200=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-200=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): qemu-2.0.2-46.1 qemu-block-curl-2.0.2-46.1 qemu-block-curl-debuginfo-2.0.2-46.1 qemu-debugsource-2.0.2-46.1 qemu-guest-agent-2.0.2-46.1 qemu-guest-agent-debuginfo-2.0.2-46.1 qemu-lang-2.0.2-46.1 qemu-tools-2.0.2-46.1 qemu-tools-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): qemu-kvm-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (ppc64le): qemu-ppc-2.0.2-46.1 qemu-ppc-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (noarch): qemu-ipxe-1.0.0-46.1 qemu-seabios-1.7.4-46.1 qemu-sgabios-8-46.1 qemu-vgabios-1.7.4-46.1 - SUSE Linux Enterprise Server 12 (x86_64): qemu-block-rbd-2.0.2-46.1 qemu-block-rbd-debuginfo-2.0.2-46.1 qemu-x86-2.0.2-46.1 qemu-x86-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Server 12 (s390x): qemu-s390-2.0.2-46.1 qemu-s390-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Desktop 12 (x86_64): qemu-2.0.2-46.1 qemu-block-curl-2.0.2-46.1 qemu-block-curl-debuginfo-2.0.2-46.1 qemu-debugsource-2.0.2-46.1 qemu-kvm-2.0.2-46.1 qemu-tools-2.0.2-46.1 qemu-tools-debuginfo-2.0.2-46.1 qemu-x86-2.0.2-46.1 qemu-x86-debuginfo-2.0.2-46.1 - SUSE Linux Enterprise Desktop 12 (noarch): qemu-ipxe-1.0.0-46.1 qemu-seabios-1.7.4-46.1 qemu-sgabios-8-46.1 qemu-vgabios-1.7.4-46.1 References: https://www.suse.com/security/cve/CVE-2015-1779.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/886378 https://bugzilla.suse.com/924018 https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0894-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0894-1 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: qemu was updated to fix a security issue: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-363=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): qemu-1.6.2-4.8.1 qemu-debuginfo-1.6.2-4.8.1 qemu-debugsource-1.6.2-4.8.1 qemu-guest-agent-1.6.2-4.8.1 qemu-guest-agent-debuginfo-1.6.2-4.8.1 qemu-lang-1.6.2-4.8.1 qemu-linux-user-1.6.2-4.8.1 qemu-linux-user-debuginfo-1.6.2-4.8.1 qemu-linux-user-debugsource-1.6.2-4.8.1 qemu-tools-1.6.2-4.8.1 qemu-tools-debuginfo-1.6.2-4.8.1 - openSUSE 13.1 (noarch): qemu-ipxe-1.0.0-4.8.1 qemu-seabios-1.7.2.2-4.8.1 qemu-sgabios-8-4.8.1 qemu-vgabios-0.6c-4.8.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0893-1: important: Security update for qemu
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0893-1 Rating: important References: #929339 Cross-References: CVE-2015-3456 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Qemu was updated to v2.1.3: See http://wiki.qemu-project.org/ChangeLog/2.1 for more information. This update includes a security fix: * CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-364=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcacard-debugsource-2.1.3-4.1 libcacard-devel-2.1.3-4.1 libcacard0-2.1.3-4.1 libcacard0-debuginfo-2.1.3-4.1 qemu-2.1.3-4.1 qemu-arm-2.1.3-4.1 qemu-arm-debuginfo-2.1.3-4.1 qemu-block-curl-2.1.3-4.1 qemu-block-curl-debuginfo-2.1.3-4.1 qemu-debugsource-2.1.3-4.1 qemu-extra-2.1.3-4.1 qemu-extra-debuginfo-2.1.3-4.1 qemu-guest-agent-2.1.3-4.1 qemu-guest-agent-debuginfo-2.1.3-4.1 qemu-ksm-2.1.3-4.1 qemu-kvm-2.1.3-4.1 qemu-lang-2.1.3-4.1 qemu-linux-user-2.1.3-4.1 qemu-linux-user-debuginfo-2.1.3-4.1 qemu-linux-user-debugsource-2.1.3-4.1 qemu-ppc-2.1.3-4.1 qemu-ppc-debuginfo-2.1.3-4.1 qemu-s390-2.1.3-4.1 qemu-s390-debuginfo-2.1.3-4.1 qemu-tools-2.1.3-4.1 qemu-tools-debuginfo-2.1.3-4.1 qemu-x86-2.1.3-4.1 qemu-x86-debuginfo-2.1.3-4.1 - openSUSE 13.2 (noarch): qemu-ipxe-1.0.0-4.1 qemu-seabios-1.7.5-4.1 qemu-sgabios-8-4.1 qemu-vgabios-1.7.5-4.1 References: https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/929339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0892-1: important: Update to Firefox 31.7.0esr
by opensuse-security＠opensuse.org 18 May '15

18 May '15

openSUSE Security Update: Update to Firefox 31.7.0esr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0892-1 Rating: important References: #925368 #930622 Cross-References: CVE-2011-3079 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: - update to Firefox 31.7.0esr (bnc#930622) * MFSA 2015-46/CVE-2015-2708 Miscellaneous memory safety hazards * MFSA 2015-47/VE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer * MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS * MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled * MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML * MFSA 2015-57/CVE-2011-3079 (bmo#1087565) Privilege escalation through IPC channel messages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-15=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.7.0-140.1 MozillaFirefox-branding-upstream-31.7.0-140.1 MozillaFirefox-buildsymbols-31.7.0-140.1 MozillaFirefox-debuginfo-31.7.0-140.1 MozillaFirefox-debugsource-31.7.0-140.1 MozillaFirefox-devel-31.7.0-140.1 MozillaFirefox-translations-common-31.7.0-140.1 MozillaFirefox-translations-other-31.7.0-140.1 References: https://www.suse.com/security/cve/CVE-2011-3079.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://bugzilla.suse.com/925368 https://bugzilla.suse.com/930622 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0884-2: important: Security update for spice
by opensuse-security＠opensuse.org 15 May '15

15 May '15

SUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0884-2 Rating: important References: #848279 Cross-References: CVE-2013-4282 Affected Products: SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-199=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): libspice-server-devel-0.12.4-6.1 spice-debugsource-0.12.4-6.1 References: https://www.suse.com/security/cve/CVE-2013-4282.html https://bugzilla.suse.com/848279 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0890-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 May '15

15 May '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0890-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.460-161.1 flash-player-gnome-11.2.202.460-161.1 flash-player-kde4-11.2.202.460-161.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0