- openSUSE Security Announce

[security-announce] openSUSE-SU-2016:0127-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 15 Jan '16

15 Jan '16

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0127-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-39=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openssh-6.6p1-5.3.1 openssh-askpass-gnome-6.6p1-5.3.1 openssh-askpass-gnome-debuginfo-6.6p1-5.3.1 openssh-debuginfo-6.6p1-5.3.1 openssh-debugsource-6.6p1-5.3.1 openssh-fips-6.6p1-5.3.1 openssh-helpers-6.6p1-5.3.1 openssh-helpers-debuginfo-6.6p1-5.3.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0126-1: important: Security update for xen
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0126-1 Rating: important References: #954018 #956408 #956409 #956411 #956592 #956832 #957988 #958007 #958009 #958493 #958523 #958918 #959006 #959387 Cross-References: CVE-2015-5307 CVE-2015-7504 CVE-2015-7549 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2015-8567,CVE-2015-8568: xen: qemu: net: vmxnet3: host memory leakage (boo#959387) - CVE-2015-8550: xen: paravirtualized drivers incautious about shared memory contents (XSA-155, boo#957988) - CVE-2015-8558: xen: qemu: usb: infinite loop in ehci_advance_state results in DoS (boo#959006) - CVE-2015-7549: xen: qemu pci: null pointer dereference issue (boo#958918) - CVE-2015-8504: xen: qemu: ui: vnc: avoid floating point exception (boo#958493) - CVE-2015-8554: xen: qemu-dm buffer overrun in MSI-X handling (XSA-164, boo#958007) - CVE-2015-8555: xen: information leak in legacy x86 FPU/XMM initialization (XSA-165, boo#958009) - boo#958523: xen: ioreq handling possibly susceptible to multiple read issue (XSA-166) - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list (boo#956832) - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156, boo#954018) - boo#956592: xen: virtual PMU is unsupported (XSA-163) - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159, boo#956408) - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160, boo#956409) - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162, boo#956411) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-36=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xen-debugsource-4.5.2_04-9.2 xen-devel-4.5.2_04-9.2 xen-libs-4.5.2_04-9.2 xen-libs-debuginfo-4.5.2_04-9.2 xen-tools-domU-4.5.2_04-9.2 xen-tools-domU-debuginfo-4.5.2_04-9.2 - openSUSE Leap 42.1 (x86_64): xen-4.5.2_04-9.2 xen-doc-html-4.5.2_04-9.2 xen-kmp-default-4.5.2_04_k4.1.13_5-9.2 xen-kmp-default-debuginfo-4.5.2_04_k4.1.13_5-9.2 xen-libs-32bit-4.5.2_04-9.2 xen-libs-debuginfo-32bit-4.5.2_04-9.2 xen-tools-4.5.2_04-9.2 xen-tools-debuginfo-4.5.2_04-9.2 References: https://www.suse.com/security/cve/CVE-2015-5307.html https://www.suse.com/security/cve/CVE-2015-7504.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-8339.html https://www.suse.com/security/cve/CVE-2015-8340.html https://www.suse.com/security/cve/CVE-2015-8341.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8554.html https://www.suse.com/security/cve/CVE-2015-8555.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8567.html https://www.suse.com/security/cve/CVE-2015-8568.html https://bugzilla.suse.com/954018 https://bugzilla.suse.com/956408 https://bugzilla.suse.com/956409 https://bugzilla.suse.com/956411 https://bugzilla.suse.com/956592 https://bugzilla.suse.com/956832 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/958007 https://bugzilla.suse.com/958009 https://bugzilla.suse.com/958493 https://bugzilla.suse.com/958523 https://bugzilla.suse.com/958918 https://bugzilla.suse.com/959006 https://bugzilla.suse.com/959387 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0124-1: important: Security update for xen
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0124-1 Rating: important References: #947165 #950704 #954018 #954405 #956408 #956409 #956411 #956592 #956832 #957988 #958007 #958009 #958493 #958523 #958918 #959006 Cross-References: CVE-2015-5307 CVE-2015-7311 CVE-2015-7504 CVE-2015-7549 CVE-2015-7970 CVE-2015-8104 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 15 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following security issues: - CVE-2015-8550: paravirtualized drivers incautious about shared memory contents (XSA-155, boo#957988) - CVE-2015-8558: qemu: usb: infinite loop in ehci_advance_state results in DoS (boo#959006) - CVE-2015-7549: qemu pci: null pointer dereference issue (boo#958918) - CVE-2015-8504: qemu: ui: vnc: avoid floating point exception (boo#958493) - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164, boo#958007) - CVE-2015-8555: information leak in legacy x86 FPU/XMM initialization (XSA-165, boo#958009) - boo#958523 xen: ioreq handling possibly susceptible to multiple read issue (XSA-166) - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list (boo#956832) - boo#956592: xen: virtual PMU is unsupported (XSA-163) - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159, boo#956408) - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160, boo#956409) - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162, boo#956411) - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142, boo#947165) - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception (boo#954405) - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156, boo#954018) - CVE-2015-7970: xen: x86: Long latency populate-on-demand operation is not preemptible (XSA-150, boo#950704) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2016-34=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.4_10-53.1 xen-devel-4.3.4_10-53.1 xen-kmp-default-4.3.4_10_k3.11.10_29-53.1 xen-kmp-default-debuginfo-4.3.4_10_k3.11.10_29-53.1 xen-kmp-desktop-4.3.4_10_k3.11.10_29-53.1 xen-kmp-desktop-debuginfo-4.3.4_10_k3.11.10_29-53.1 xen-libs-4.3.4_10-53.1 xen-libs-debuginfo-4.3.4_10-53.1 xen-tools-domU-4.3.4_10-53.1 xen-tools-domU-debuginfo-4.3.4_10-53.1 - openSUSE 13.1 (x86_64): xen-4.3.4_10-53.1 xen-doc-html-4.3.4_10-53.1 xen-libs-32bit-4.3.4_10-53.1 xen-libs-debuginfo-32bit-4.3.4_10-53.1 xen-tools-4.3.4_10-53.1 xen-tools-debuginfo-4.3.4_10-53.1 xen-xend-tools-4.3.4_10-53.1 xen-xend-tools-debuginfo-4.3.4_10-53.1 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.4_10_k3.11.10_29-53.1 xen-kmp-pae-debuginfo-4.3.4_10_k3.11.10_29-53.1 References: https://www.suse.com/security/cve/CVE-2015-5307.html https://www.suse.com/security/cve/CVE-2015-7311.html https://www.suse.com/security/cve/CVE-2015-7504.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-7970.html https://www.suse.com/security/cve/CVE-2015-8104.html https://www.suse.com/security/cve/CVE-2015-8339.html https://www.suse.com/security/cve/CVE-2015-8340.html https://www.suse.com/security/cve/CVE-2015-8341.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8554.html https://www.suse.com/security/cve/CVE-2015-8555.html https://www.suse.com/security/cve/CVE-2015-8558.html https://bugzilla.suse.com/947165 https://bugzilla.suse.com/950704 https://bugzilla.suse.com/954018 https://bugzilla.suse.com/954405 https://bugzilla.suse.com/956408 https://bugzilla.suse.com/956409 https://bugzilla.suse.com/956411 https://bugzilla.suse.com/956592 https://bugzilla.suse.com/956832 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/958007 https://bugzilla.suse.com/958009 https://bugzilla.suse.com/958493 https://bugzilla.suse.com/958523 https://bugzilla.suse.com/958918 https://bugzilla.suse.com/959006 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0123-1: important: Security update for xen
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0123-1 Rating: important References: #954018 #956408 #956409 #956411 #956592 #956832 #957988 #958007 #958009 #958493 #958523 #958918 #959006 #959387 Cross-References: CVE-2015-5307 CVE-2015-7504 CVE-2015-7549 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for xen fixes the following security issues: - CVE-2015-8568 CVE-2015-8567: xen: qemu: net: vmxnet3: host memory leakage (boo#959387) - CVE-2015-8550: xen: paravirtualized drivers incautious about shared memory contents (XSA-155, boo#957988) - CVE-2015-8558: xen: qemu: usb: infinite loop in ehci_advance_state results in DoS (boo#959006) - CVE-2015-7549: xen: qemu pci: null pointer dereference issue (boo#958918) - CVE-2015-8504: xen: qemu: ui: vnc: avoid floating point exception (boo#958493) - CVE-2015-8554: xen: qemu-dm buffer overrun in MSI-X handling (XSA-164, boo#958007) - CVE-2015-8555: xen: information leak in legacy x86 FPU/XMM initialization (XSA-165, boo#958009) - boo#958523: xen: ioreq handling possibly susceptible to multiple read issue (XSA-166) - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156, boo#954018) - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list (boo#956832) - boo#956592: xen: virtual PMU is unsupported (XSA-163) - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159, boo#956408) - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160, boo#956409) - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162, boo#956411) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-35=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.3_08-36.1 xen-devel-4.4.3_08-36.1 xen-libs-4.4.3_08-36.1 xen-libs-debuginfo-4.4.3_08-36.1 xen-tools-domU-4.4.3_08-36.1 xen-tools-domU-debuginfo-4.4.3_08-36.1 - openSUSE 13.2 (x86_64): xen-4.4.3_08-36.1 xen-doc-html-4.4.3_08-36.1 xen-kmp-default-4.4.3_08_k3.16.7_29-36.1 xen-kmp-default-debuginfo-4.4.3_08_k3.16.7_29-36.1 xen-kmp-desktop-4.4.3_08_k3.16.7_29-36.1 xen-kmp-desktop-debuginfo-4.4.3_08_k3.16.7_29-36.1 xen-libs-32bit-4.4.3_08-36.1 xen-libs-debuginfo-32bit-4.4.3_08-36.1 xen-tools-4.4.3_08-36.1 xen-tools-debuginfo-4.4.3_08-36.1 References: https://www.suse.com/security/cve/CVE-2015-5307.html https://www.suse.com/security/cve/CVE-2015-7504.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-8339.html https://www.suse.com/security/cve/CVE-2015-8340.html https://www.suse.com/security/cve/CVE-2015-8341.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8554.html https://www.suse.com/security/cve/CVE-2015-8555.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8567.html https://www.suse.com/security/cve/CVE-2015-8568.html https://bugzilla.suse.com/954018 https://bugzilla.suse.com/956408 https://bugzilla.suse.com/956409 https://bugzilla.suse.com/956411 https://bugzilla.suse.com/956592 https://bugzilla.suse.com/956832 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/958007 https://bugzilla.suse.com/958009 https://bugzilla.suse.com/958493 https://bugzilla.suse.com/958523 https://bugzilla.suse.com/958918 https://bugzilla.suse.com/959006 https://bugzilla.suse.com/959387 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0120-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0120-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openssh-2016011302-12326=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-openssh-2016011302-12326=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssh-2016011302-12326=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssh-6.6p1-16.1 openssh-askpass-gnome-6.6p1-16.4 openssh-fips-6.6p1-16.1 openssh-helpers-6.6p1-16.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): openssh-6.6p1-16.1 openssh-askpass-gnome-6.6p1-16.4 openssh-helpers-6.6p1-16.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.6p1-16.4 openssh-debuginfo-6.6p1-16.1 openssh-debugsource-6.6p1-16.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0119-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0119-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-openssh-2016011301-12325=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssh-2016011301-12325=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): openssh-6.2p2-0.24.1 openssh-askpass-6.2p2-0.24.1 openssh-askpass-gnome-6.2p2-0.24.3 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.2p2-0.24.3 openssh-debuginfo-6.2p2-0.24.1 openssh-debugsource-6.2p2-0.24.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0118-1: critical: Security update for openssh
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0118-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-85=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2016-85=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-85=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-85=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-fips-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 - SUSE Linux Enterprise Desktop 12 (x86_64): openssh-6.6p1-33.1 openssh-askpass-gnome-6.6p1-33.1 openssh-askpass-gnome-debuginfo-6.6p1-33.1 openssh-debuginfo-6.6p1-33.1 openssh-debugsource-6.6p1-33.1 openssh-helpers-6.6p1-33.1 openssh-helpers-debuginfo-6.6p1-33.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0117-1: critical: Security update for openssh-openssl1
by opensuse-security＠opensuse.org 14 Jan '16

14 Jan '16

SUSE Security Update: Security update for openssh-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0117-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh-openssl1 fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openssh-openssl1-12327=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openssh-openssl1-6.6p1-10.1 openssh-openssl1-helpers-6.6p1-10.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/961642 https://bugzilla.suse.com/961645 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0113-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 13 Jan '16

13 Jan '16

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0113-1 Rating: important References: #955131 #960286 #960402 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This version update for java-1_6_0-ibm to version 6.0.16.15 fixes the following issues: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 For more information please visit: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_Nove mber_2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_Nov ember_2015> Security Issues: * CVE-2015-4734 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4734> * CVE-2015-4803 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4803> * CVE-2015-4805 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4805> * CVE-2015-4806 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4806> * CVE-2015-4810 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4810> * CVE-2015-4835 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4835> * CVE-2015-4840 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4840> * CVE-2015-4842 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4842> * CVE-2015-4843 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4843> * CVE-2015-4844 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4844> * CVE-2015-4860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4860> * CVE-2015-4871 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4871> * CVE-2015-4872 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4872> * CVE-2015-4882 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4882> * CVE-2015-4883 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4883> * CVE-2015-4893 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4893> * CVE-2015-4902 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4902> * CVE-2015-4903 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4903> * CVE-2015-4911 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4911> * CVE-2015-5006 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5006> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-devel-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-fonts-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.15-0.16.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.15-0.16.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.15-0.16.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-5006.html https://bugzilla.suse.com/955131 https://bugzilla.suse.com/960286 https://bugzilla.suse.com/960402 https://download.suse.com/patch/finder/?keywords=750c96f801a1b590f58f15adc3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0089-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 12 Jan '16

12 Jan '16

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0089-1 Rating: important References: #960383 #960384 #960385 Cross-References: CVE-2015-8661 CVE-2015-8662 CVE-2015-8663 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to ffmpeg 2.8.4 fixes the following issues: * CVE-2015-8661: Denial of service via crafted .mov file [boo#960385] * CVE-2015-8662: Denial of service via crafted JPEG 2000 data [boo#960384] * CVE-2015-8663: Denial of service via crafted H.264 data [boo#960383] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-26=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffmpeg-2.8.4-9.1 ffmpeg-debuginfo-2.8.4-9.1 ffmpeg-debugsource-2.8.4-9.1 ffmpeg-devel-2.8.4-9.1 libavcodec-devel-2.8.4-9.1 libavcodec56-2.8.4-9.1 libavcodec56-debuginfo-2.8.4-9.1 libavdevice-devel-2.8.4-9.1 libavdevice56-2.8.4-9.1 libavdevice56-debuginfo-2.8.4-9.1 libavfilter-devel-2.8.4-9.1 libavfilter5-2.8.4-9.1 libavfilter5-debuginfo-2.8.4-9.1 libavformat-devel-2.8.4-9.1 libavformat56-2.8.4-9.1 libavformat56-debuginfo-2.8.4-9.1 libavresample-devel-2.8.4-9.1 libavresample2-2.8.4-9.1 libavresample2-debuginfo-2.8.4-9.1 libavutil-devel-2.8.4-9.1 libavutil54-2.8.4-9.1 libavutil54-debuginfo-2.8.4-9.1 libpostproc-devel-2.8.4-9.1 libpostproc53-2.8.4-9.1 libpostproc53-debuginfo-2.8.4-9.1 libswresample-devel-2.8.4-9.1 libswresample1-2.8.4-9.1 libswresample1-debuginfo-2.8.4-9.1 libswscale-devel-2.8.4-9.1 libswscale3-2.8.4-9.1 libswscale3-debuginfo-2.8.4-9.1 - openSUSE Leap 42.1 (x86_64): libavcodec56-32bit-2.8.4-9.1 libavcodec56-debuginfo-32bit-2.8.4-9.1 libavdevice56-32bit-2.8.4-9.1 libavdevice56-debuginfo-32bit-2.8.4-9.1 libavfilter5-32bit-2.8.4-9.1 libavfilter5-debuginfo-32bit-2.8.4-9.1 libavformat56-32bit-2.8.4-9.1 libavformat56-debuginfo-32bit-2.8.4-9.1 libavresample2-32bit-2.8.4-9.1 libavresample2-debuginfo-32bit-2.8.4-9.1 libavutil54-32bit-2.8.4-9.1 libavutil54-debuginfo-32bit-2.8.4-9.1 libpostproc53-32bit-2.8.4-9.1 libpostproc53-debuginfo-32bit-2.8.4-9.1 libswresample1-32bit-2.8.4-9.1 libswresample1-debuginfo-32bit-2.8.4-9.1 libswscale3-32bit-2.8.4-9.1 libswscale3-debuginfo-32bit-2.8.4-9.1 References: https://www.suse.com/security/cve/CVE-2015-8661.html https://www.suse.com/security/cve/CVE-2015-8662.html https://www.suse.com/security/cve/CVE-2015-8663.html https://bugzilla.suse.com/960383 https://bugzilla.suse.com/960384 https://bugzilla.suse.com/960385 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0