- openSUSE Security Announce

[security-announce] openSUSE-SU-2012:1412-1: important: Mozilla Suite: Update to 16.0.2
by opensuse-security＠opensuse.org 30 Oct '12

30 Oct '12

openSUSE Security Update: Mozilla Suite: Update to 16.0.2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1412-1 Rating: important References: #786522 Cross-References: CVE-2012-4194 CVE-2012-4195 CVE-2012-4196 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Mozilla Firefox, Thunderbird and XULRunner were updated to 16.0.2. Mozilla Seamonkey was updated to 2.13.2. Tracker bug: bnc#786522 A security issues was fixed: * MFSA 2012-90/CVE-2012-4194/CVE-2012-4195/CVE-2012-4196 (bmo#800666, bmo#793121, bmo#802557) Fixes for Location object issues The update also brings back Obsoletes for libproxy's mozjs plugin for distributions before 12.2 to avoid crashes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-745 - openSUSE 12.1: zypper in -t patch openSUSE-2012-745 - openSUSE 11.4: zypper in -t patch openSUSE-2012-745 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): MozillaFirefox-16.0.2-2.21.1 MozillaFirefox-branding-upstream-16.0.2-2.21.1 MozillaFirefox-buildsymbols-16.0.2-2.21.1 MozillaFirefox-debuginfo-16.0.2-2.21.1 MozillaFirefox-debugsource-16.0.2-2.21.1 MozillaFirefox-devel-16.0.2-2.21.1 MozillaFirefox-translations-common-16.0.2-2.21.1 MozillaFirefox-translations-other-16.0.2-2.21.1 MozillaThunderbird-16.0.2-49.19.1 MozillaThunderbird-buildsymbols-16.0.2-49.19.1 MozillaThunderbird-debuginfo-16.0.2-49.19.1 MozillaThunderbird-debugsource-16.0.2-49.19.1 MozillaThunderbird-devel-16.0.2-49.19.1 MozillaThunderbird-devel-debuginfo-16.0.2-49.19.1 MozillaThunderbird-translations-common-16.0.2-49.19.1 MozillaThunderbird-translations-other-16.0.2-49.19.1 enigmail-1.4.5.+16.0.2-49.19.1 enigmail-debuginfo-1.4.5.+16.0.2-49.19.1 mozilla-js-16.0.2-2.18.1 mozilla-js-debuginfo-16.0.2-2.18.1 seamonkey-2.13.2-2.22.1 seamonkey-debuginfo-2.13.2-2.22.1 seamonkey-debugsource-2.13.2-2.22.1 seamonkey-dom-inspector-2.13.2-2.22.1 seamonkey-irc-2.13.2-2.22.1 seamonkey-translations-common-2.13.2-2.22.1 seamonkey-translations-other-2.13.2-2.22.1 seamonkey-venkman-2.13.2-2.22.1 xulrunner-16.0.2-2.18.1 xulrunner-buildsymbols-16.0.2-2.18.1 xulrunner-debuginfo-16.0.2-2.18.1 xulrunner-debugsource-16.0.2-2.18.1 xulrunner-devel-16.0.2-2.18.1 xulrunner-devel-debuginfo-16.0.2-2.18.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-16.0.2-2.18.1 mozilla-js-debuginfo-32bit-16.0.2-2.18.1 xulrunner-32bit-16.0.2-2.18.1 xulrunner-debuginfo-32bit-16.0.2-2.18.1 - openSUSE 12.1 (i586 x86_64): MozillaFirefox-16.0.2-2.50.1 MozillaFirefox-branding-upstream-16.0.2-2.50.1 MozillaFirefox-buildsymbols-16.0.2-2.50.1 MozillaFirefox-debuginfo-16.0.2-2.50.1 MozillaFirefox-debugsource-16.0.2-2.50.1 MozillaFirefox-devel-16.0.2-2.50.1 MozillaFirefox-translations-common-16.0.2-2.50.1 MozillaFirefox-translations-other-16.0.2-2.50.1 MozillaThunderbird-16.0.2-33.39.1 MozillaThunderbird-buildsymbols-16.0.2-33.39.1 MozillaThunderbird-debuginfo-16.0.2-33.39.1 MozillaThunderbird-debugsource-16.0.2-33.39.1 MozillaThunderbird-devel-16.0.2-33.39.1 MozillaThunderbird-devel-debuginfo-16.0.2-33.39.1 MozillaThunderbird-translations-common-16.0.2-33.39.1 MozillaThunderbird-translations-other-16.0.2-33.39.1 enigmail-1.4.5.+16.0.2-33.39.1 enigmail-debuginfo-1.4.5.+16.0.2-33.39.1 mozilla-js-16.0.2-2.45.1 mozilla-js-debuginfo-16.0.2-2.45.1 seamonkey-2.13.2-2.41.1 seamonkey-debuginfo-2.13.2-2.41.1 seamonkey-debugsource-2.13.2-2.41.1 seamonkey-dom-inspector-2.13.2-2.41.1 seamonkey-irc-2.13.2-2.41.1 seamonkey-translations-common-2.13.2-2.41.1 seamonkey-translations-other-2.13.2-2.41.1 seamonkey-venkman-2.13.2-2.41.1 xulrunner-16.0.2-2.45.1 xulrunner-buildsymbols-16.0.2-2.45.1 xulrunner-debuginfo-16.0.2-2.45.1 xulrunner-debugsource-16.0.2-2.45.1 xulrunner-devel-16.0.2-2.45.1 xulrunner-devel-debuginfo-16.0.2-2.45.1 - openSUSE 12.1 (x86_64): mozilla-js-32bit-16.0.2-2.45.1 mozilla-js-debuginfo-32bit-16.0.2-2.45.1 xulrunner-32bit-16.0.2-2.45.1 xulrunner-debuginfo-32bit-16.0.2-2.45.1 - openSUSE 12.1 (ia64): mozilla-js-debuginfo-x86-16.0.2-2.45.1 mozilla-js-x86-16.0.2-2.45.1 xulrunner-debuginfo-x86-16.0.2-2.45.1 xulrunner-x86-16.0.2-2.45.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-16.0.2-45.1 MozillaFirefox-branding-upstream-16.0.2-45.1 MozillaFirefox-buildsymbols-16.0.2-45.1 MozillaFirefox-debuginfo-16.0.2-45.1 MozillaFirefox-debugsource-16.0.2-45.1 MozillaFirefox-devel-16.0.2-45.1 MozillaFirefox-translations-common-16.0.2-45.1 MozillaFirefox-translations-other-16.0.2-45.1 MozillaThunderbird-16.0.2-37.1 MozillaThunderbird-buildsymbols-16.0.2-37.1 MozillaThunderbird-debuginfo-16.0.2-37.1 MozillaThunderbird-debugsource-16.0.2-37.1 MozillaThunderbird-devel-16.0.2-37.1 MozillaThunderbird-devel-debuginfo-16.0.2-37.1 MozillaThunderbird-translations-common-16.0.2-37.1 MozillaThunderbird-translations-other-16.0.2-37.1 enigmail-1.4.5.+16.0.2-37.1 enigmail-debuginfo-1.4.5.+16.0.2-37.1 seamonkey-2.13.2-41.1 seamonkey-debuginfo-2.13.2-41.1 seamonkey-debugsource-2.13.2-41.1 seamonkey-dom-inspector-2.13.2-41.1 seamonkey-irc-2.13.2-41.1 seamonkey-translations-common-2.13.2-41.1 seamonkey-translations-other-2.13.2-41.1 seamonkey-venkman-2.13.2-41.1 References: http://support.novell.com/security/cve/CVE-2012-4194.html http://support.novell.com/security/cve/CVE-2012-4195.html http://support.novell.com/security/cve/CVE-2012-4196.html https://bugzilla.novell.com/786522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1404-1: critical: exim: overflow in DKIM handling fixed
by opensuse-security＠opensuse.org 27 Oct '12

27 Oct '12

openSUSE Security Update: exim: overflow in DKIM handling fixed ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1404-1 Rating: critical References: #670711 #786652 Cross-References: CVE-2011-1764 CVE-2012-5671 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes a remotely exploitable overflow in DKIM handling. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-738 - openSUSE 12.1: zypper in -t patch openSUSE-2012-738 - openSUSE 11.4: zypper in -t patch openSUSE-2012-738 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): exim-4.80.1-2.4.1 exim-debuginfo-4.80.1-2.4.1 exim-debugsource-4.80.1-2.4.1 eximon-4.80.1-2.4.1 eximon-debuginfo-4.80.1-2.4.1 eximstats-html-4.80.1-2.4.1 - openSUSE 12.1 (i586 x86_64): exim-4.80.1-5.4.1 exim-debuginfo-4.80.1-5.4.1 exim-debugsource-4.80.1-5.4.1 eximon-4.80.1-5.4.1 eximon-debuginfo-4.80.1-5.4.1 eximstats-html-4.80.1-5.4.1 - openSUSE 11.4 (i586 x86_64): exim-4.80.1-23.1 exim-debuginfo-4.80.1-23.1 exim-debugsource-4.80.1-23.1 eximon-4.80.1-23.1 eximon-debuginfo-4.80.1-23.1 eximstats-html-4.80.1-23.1 References: http://support.novell.com/security/cve/CVE-2011-1764.html http://support.novell.com/security/cve/CVE-2012-5671.html https://bugzilla.novell.com/670711 https://bugzilla.novell.com/786652 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1203-2: important: Security update for qemu
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1203-2 Rating: important References: #777084 Cross-References: CVE-2012-3515 Affected Products: SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17). This has been fixed. Security Issue reference: * CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515 > Package List: - SLE SDK 10 SP4 (i586 ia64 x86_64): qemu-0.8.2-37.14.1 References: http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/777084 http://download.novell.com/patch/finder/?keywords=30f612a13ba8c3e5184ba89d4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1398-1: important: Security update for OpenJDK
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for OpenJDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1398-1 Rating: important References: #785433 Cross-References: CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-3143 CVE-2012-3159 CVE-2012-3216 CVE-2012-4416 CVE-2012-4681 CVE-2012-5067 CVE-2012-5068 CVE-2012-5069 CVE-2012-5070 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5074 CVE-2012-5075 CVE-2012-5076 CVE-2012-5077 CVE-2012-5078 CVE-2012-5079 CVE-2012-5080 CVE-2012-5081 CVE-2012-5082 CVE-2012-5083 CVE-2012-5084 CVE-2012-5085 CVE-2012-5086 CVE-2012-5087 CVE-2012-5088 CVE-2012-5089 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: java-openjdk was upgraded to version 1.11.5 to fix various security and non-security issues. Security Issue references: * CVE-2012-4681 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4681 > * CVE-2012-5083 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5083 > * CVE-2012-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1531 > * CVE-2012-5086 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5086 > * CVE-2012-5087 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5087 > * CVE-2012-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1533 > * CVE-2012-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1532 > * CVE-2012-5076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5076 > * CVE-2012-3143 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3143 > * CVE-2012-5088 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5088 > * CVE-2012-5078 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5078 > * CVE-2012-5089 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5089 > * CVE-2012-5084 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5084 > * CVE-2012-5080 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5080 > * CVE-2012-3159 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3159 > * CVE-2012-5068 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5068 > * CVE-2012-4416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4416 > * CVE-2012-5074 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5074 > * CVE-2012-5071 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5071 > * CVE-2012-5069 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5069 > * CVE-2012-5067 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5067 > * CVE-2012-5070 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5070 > * CVE-2012-5075 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5075 > * CVE-2012-5073 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5073 > * CVE-2012-5079 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5079 > * CVE-2012-5072 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5072 > * CVE-2012-5081 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5081 > * CVE-2012-5082 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5082 > * CVE-2012-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3216 > * CVE-2012-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5077 > * CVE-2012-5085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5085 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-java-1_6_0-openjdk-6987 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b24.1.11.5-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b24.1.11.5-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b24.1.11.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-1531.html http://support.novell.com/security/cve/CVE-2012-1532.html http://support.novell.com/security/cve/CVE-2012-1533.html http://support.novell.com/security/cve/CVE-2012-3143.html http://support.novell.com/security/cve/CVE-2012-3159.html http://support.novell.com/security/cve/CVE-2012-3216.html http://support.novell.com/security/cve/CVE-2012-4416.html http://support.novell.com/security/cve/CVE-2012-4681.html http://support.novell.com/security/cve/CVE-2012-5067.html http://support.novell.com/security/cve/CVE-2012-5068.html http://support.novell.com/security/cve/CVE-2012-5069.html http://support.novell.com/security/cve/CVE-2012-5070.html http://support.novell.com/security/cve/CVE-2012-5071.html http://support.novell.com/security/cve/CVE-2012-5072.html http://support.novell.com/security/cve/CVE-2012-5073.html http://support.novell.com/security/cve/CVE-2012-5074.html http://support.novell.com/security/cve/CVE-2012-5075.html http://support.novell.com/security/cve/CVE-2012-5076.html http://support.novell.com/security/cve/CVE-2012-5077.html http://support.novell.com/security/cve/CVE-2012-5078.html http://support.novell.com/security/cve/CVE-2012-5079.html http://support.novell.com/security/cve/CVE-2012-5080.html http://support.novell.com/security/cve/CVE-2012-5081.html http://support.novell.com/security/cve/CVE-2012-5082.html http://support.novell.com/security/cve/CVE-2012-5083.html http://support.novell.com/security/cve/CVE-2012-5084.html http://support.novell.com/security/cve/CVE-2012-5085.html http://support.novell.com/security/cve/CVE-2012-5086.html http://support.novell.com/security/cve/CVE-2012-5087.html http://support.novell.com/security/cve/CVE-2012-5088.html http://support.novell.com/security/cve/CVE-2012-5089.html https://bugzilla.novell.com/785433 http://download.novell.com/patch/finder/?keywords=c230e2b1023ded8fd1041aa18… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1391-1: important: Security update for Linux kernel
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1391-1 Rating: important References: #674284 #703156 #734056 #738400 #738528 #747576 #755546 #758985 #760974 #762581 #763526 #765102 #765320 #767277 #767504 #767766 #767939 #769784 #770507 #770697 #772409 #773272 #773831 #776888 #777575 #783058 Cross-References: CVE-2011-1044 CVE-2011-4110 CVE-2012-2136 CVE-2012-2663 CVE-2012-2744 CVE-2012-3510 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 20 fixes is now available. Description: This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed: * CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another users password (a side channel attack). * CVE-2012-2744: net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel, when the nf_conntrack_ipv6 module is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets. * CVE-2012-3510: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel allowed local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command. * CVE-2011-4110: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allowed local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and updating a negative key into a fully instantiated key. * CVE-2011-1044: The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel did not initialize a certain response buffer, which allowed local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649. * CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. * CVE-2012-2136: The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel did not properly validate a certain length value, which allowed local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device. * CVE-2012-2663: A small denial of service leak in dropping syn+fin messages was fixed. The following non-security issues have been fixed: Packaging: * kbuild: Fix gcc -x syntax (bnc#773831). NFS: * knfsd: An assortment of little fixes to the sunrpc cache code (bnc#767766). * knfsd: Unexport cache_fresh and fix a small race (bnc#767766). * knfsd: nfsd: do not drop silently on upcall deferral (bnc#767766). * knfsd: svcrpc: remove another silent drop from deferral code (bnc#767766). * sunrpc/cache: simplify cache_fresh_locked and cache_fresh_unlocked (bnc#767766). * sunrpc/cache: recheck cache validity after cache_defer_req (bnc#767766). * sunrpc/cache: use list_del_init for the list_head entries in cache_deferred_req (bnc#767766). * sunrpc/cache: avoid variable over-loading in cache_defer_req (bnc#767766). * sunrpc/cache: allow thread to block while waiting for cache update (bnc#767766). * sunrpc/cache: Fix race in sunrpc/cache introduced by patch to allow thread to block while waiting for cache update (bnc#767766). * sunrpc/cache: Another fix for race problem with sunrpc cache deferal (bnc#767766). * knfsd: nfsd: make all exp_finding functions return -errnos on err (bnc#767766). * Fix kabi breakage in previous nfsd patch series (bnc#767766). * nfsd: Work around incorrect return type for wait_for_completion_interruptible_timeout (bnc#767766). * nfs: Fix a potential file corruption issue when writing (bnc#773272). * nfs: Allow sync writes to be multiple pages (bnc#763526). * nfs: fix reference counting for NFSv4 callback thread (bnc#767504). * nfs: flush signals before taking down callback thread (bnc#767504). * nfsv4: Ensure nfs_callback_down() calls svc_destroy() (bnc#767504). SCSI: * SCSI/ch: Check NULL for kmalloc() return (bnc#783058). * drivers/scsi/aic94xx/aic94xx_init.c: correct the size argument to kmalloc (bnc#783058). * block: fail SCSI passthrough ioctls on partition devices (bnc#738400). * dm: do not forward ioctls from logical volumes to the underlying device (bnc#738400). * vmware: Fix VMware hypervisor detection (bnc#777575, bnc#770507). S/390: * lgr: Make lgr_page static (bnc#772409,LTC#83520). * zfcp: Fix oops in _blk_add_trace() (bnc#772409,LTC#83510). * kernel: Add z/VM LGR detection (bnc#767277,LTC#RAS1203). * be2net: Fix EEH error reset before a flash dump completes (bnc#755546). * mptfusion: fix msgContext in mptctl_hp_hostinfo (bnc#767939). * PCI: Fix bus resource assignment on 32 bits with 64b resources. (bnc#762581) * PCI: fix up setup-bus.c #ifdef. (bnc#762581) * x86: powernow-k8: Fix indexing issue (bnc#758985). * net: Fix race condition about network device name allocation (bnc#747576). XEN: * smpboot: adjust ordering of operations. * xen/x86-64: provide a memset() that can deal with 4Gb or above at a time (bnc#738528). * xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53 (bnc#760974). * xen/gntdev: fix multi-page slot allocation (bnc#760974). Security Issues: * CVE-2011-1044 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044 > * CVE-2011-4110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110 > * CVE-2012-2136 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2136 > * CVE-2012-2663 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2663 > * CVE-2012-2744 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2744 > * CVE-2012-3510 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3510 > Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): kernel-default-2.6.16.60-0.99.1 kernel-source-2.6.16.60-0.99.1 kernel-syms-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 x86_64): kernel-smp-2.6.16.60-0.99.1 kernel-xen-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.99.1 kernel-kdumppae-2.6.16.60-0.99.1 kernel-vmi-2.6.16.60-0.99.1 kernel-vmipae-2.6.16.60-0.99.1 kernel-xenpae-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): kernel-iseries64-2.6.16.60-0.99.1 kernel-ppc64-2.6.16.60-0.99.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): kernel-default-2.6.16.60-0.99.1 kernel-smp-2.6.16.60-0.99.1 kernel-source-2.6.16.60-0.99.1 kernel-syms-2.6.16.60-0.99.1 kernel-xen-2.6.16.60-0.99.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.99.1 kernel-xenpae-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 x86_64): kernel-xen-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586): kernel-xenpae-2.6.16.60-0.99.1 References: http://support.novell.com/security/cve/CVE-2011-1044.html http://support.novell.com/security/cve/CVE-2011-4110.html http://support.novell.com/security/cve/CVE-2012-2136.html http://support.novell.com/security/cve/CVE-2012-2663.html http://support.novell.com/security/cve/CVE-2012-2744.html http://support.novell.com/security/cve/CVE-2012-3510.html https://bugzilla.novell.com/674284 https://bugzilla.novell.com/703156 https://bugzilla.novell.com/734056 https://bugzilla.novell.com/738400 https://bugzilla.novell.com/738528 https://bugzilla.novell.com/747576 https://bugzilla.novell.com/755546 https://bugzilla.novell.com/758985 https://bugzilla.novell.com/760974 https://bugzilla.novell.com/762581 https://bugzilla.novell.com/763526 https://bugzilla.novell.com/765102 https://bugzilla.novell.com/765320 https://bugzilla.novell.com/767277 https://bugzilla.novell.com/767504 https://bugzilla.novell.com/767766 https://bugzilla.novell.com/767939 https://bugzilla.novell.com/769784 https://bugzilla.novell.com/770507 https://bugzilla.novell.com/770697 https://bugzilla.novell.com/772409 https://bugzilla.novell.com/773272 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/776888 https://bugzilla.novell.com/777575 https://bugzilla.novell.com/783058 http://download.novell.com/patch/finder/?keywords=118cf41af33f48911c473f3bd… http://download.novell.com/patch/finder/?keywords=1d5bd8295622191606c935851… http://download.novell.com/patch/finder/?keywords=3b3320a96f49fe4615b35ba22… http://download.novell.com/patch/finder/?keywords=9dc087603b172b449aa9a07b5… http://download.novell.com/patch/finder/?keywords=c77cfcc87d8e54df006cb42c1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1390-2: important: Security update for bind
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-2 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE Linux Enterprise Server 10 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following issue has been fixed: * Specially crafted RDATA could have caused bind to lockup. This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Package List: - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64): bind-9.3.4-1.31.33.1 bind-chrootenv-9.3.4-1.31.33.1 bind-devel-9.3.4-1.31.33.1 bind-doc-9.3.4-1.31.33.1 bind-libs-9.3.4-1.31.33.1 bind-utils-9.3.4-1.31.33.1 - SUSE Linux Enterprise Server 10 SP2 (s390x x86_64): bind-libs-32bit-9.3.4-1.31.33.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=a8e673632571bbd76e46ad336… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1390-1: important: Security update for bind
by opensuse-security＠opensuse.org 23 Oct '12

23 Oct '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-1 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The following issue has been fixed: * Specially crafted RDATA could have caused bind to lockup. This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-bind-6944 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-bind-6944 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-bind-6944 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-bind-6980 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bind-6944 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-devel-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64) [New Version: 9.6ESVR7P4]: bind-devel-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.8.1 bind-chrootenv-9.6ESVR7P4-0.8.1 bind-doc-9.6ESVR7P4-0.8.1 bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.8.1 bind-chrootenv-9.6ESVR7P4-0.8.1 bind-doc-9.6ESVR7P4-0.8.1 bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.6ESVR7P4]: bind-libs-x86-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.2.3.1 bind-chrootenv-9.6ESVR7P4-0.2.3.1 bind-doc-9.6ESVR7P4-0.2.3.1 bind-libs-9.6ESVR7P4-0.2.3.1 bind-utils-9.6ESVR7P4-0.2.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.2.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.7.1 bind-chrootenv-9.6ESVR7P4-0.7.1 bind-devel-9.6ESVR7P4-0.7.1 bind-doc-9.6ESVR7P4-0.7.1 bind-libs-9.6ESVR7P4-0.7.1 bind-utils-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 9.6ESVR7P4]: bind-libs-x86-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 9.6ESVR7P4]: bind-devel-64bit-9.6ESVR7P4-0.7.1 bind-libs-64bit-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bind-9.3.4-1.42.1 bind-chrootenv-9.3.4-1.42.1 bind-devel-9.3.4-1.42.1 bind-doc-9.3.4-1.42.1 bind-libs-9.3.4-1.42.1 bind-utils-9.3.4-1.42.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): bind-libs-32bit-9.3.4-1.42.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-libs-9.6ESVR7P4-0.7.1 bind-utils-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.7.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.7.1 bind-chrootenv-9.6ESVR7P4-0.7.1 bind-devel-9.6ESVR7P4-0.7.1 bind-doc-9.6ESVR7P4-0.7.1 - SLE SDK 10 SP4 (ppc) [New Version: 9.6ESVR7P4]: bind-devel-64bit-9.6ESVR7P4-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=0491290854c3af020f68ff0d5… http://download.novell.com/patch/finder/?keywords=43e6060a96c82b013f497e12b… http://download.novell.com/patch/finder/?keywords=746fd176e23d559fd877814c8… http://download.novell.com/patch/finder/?keywords=b317f08d89c8077faca5bab8b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1376-1: important: update for chromium
by opensuse-security＠opensuse.org 22 Oct '12

22 Oct '12

openSUSE Security Update: update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1376-1 Rating: important References: #782257 Cross-References: CVE-2012-2874 CVE-2012-2876 CVE-2012-2877 CVE-2012-2878 CVE-2012-2879 CVE-2012-2880 CVE-2012-2881 CVE-2012-2882 CVE-2012-2883 CVE-2012-2884 CVE-2012-2885 CVE-2012-2886 CVE-2012-2887 CVE-2012-2888 CVE-2012-2889 CVE-2012-2891 CVE-2012-2892 CVE-2012-2893 CVE-2012-2894 CVE-2012-2896 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: Chromium was upgraded to version 24.0.1290 which fixed multiple security flaws. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-721 - openSUSE 12.1: zypper in -t patch openSUSE-2012-721 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): chromedriver-24.0.1290.0-1.19.1 chromedriver-debuginfo-24.0.1290.0-1.19.1 chromium-24.0.1290.0-1.19.1 chromium-debuginfo-24.0.1290.0-1.19.1 chromium-debugsource-24.0.1290.0-1.19.1 chromium-desktop-gnome-24.0.1290.0-1.19.1 chromium-desktop-kde-24.0.1290.0-1.19.1 chromium-suid-helper-24.0.1290.0-1.19.1 chromium-suid-helper-debuginfo-24.0.1290.0-1.19.1 - openSUSE 12.1 (i586 x86_64): chromedriver-24.0.1290.0-1.39.1 chromedriver-debuginfo-24.0.1290.0-1.39.1 chromium-24.0.1290.0-1.39.1 chromium-debuginfo-24.0.1290.0-1.39.1 chromium-debugsource-24.0.1290.0-1.39.1 chromium-desktop-gnome-24.0.1290.0-1.39.1 chromium-desktop-kde-24.0.1290.0-1.39.1 chromium-suid-helper-24.0.1290.0-1.39.1 chromium-suid-helper-debuginfo-24.0.1290.0-1.39.1 References: http://support.novell.com/security/cve/CVE-2012-2874.html http://support.novell.com/security/cve/CVE-2012-2876.html http://support.novell.com/security/cve/CVE-2012-2877.html http://support.novell.com/security/cve/CVE-2012-2878.html http://support.novell.com/security/cve/CVE-2012-2879.html http://support.novell.com/security/cve/CVE-2012-2880.html http://support.novell.com/security/cve/CVE-2012-2881.html http://support.novell.com/security/cve/CVE-2012-2882.html http://support.novell.com/security/cve/CVE-2012-2883.html http://support.novell.com/security/cve/CVE-2012-2884.html http://support.novell.com/security/cve/CVE-2012-2885.html http://support.novell.com/security/cve/CVE-2012-2886.html http://support.novell.com/security/cve/CVE-2012-2887.html http://support.novell.com/security/cve/CVE-2012-2888.html http://support.novell.com/security/cve/CVE-2012-2889.html http://support.novell.com/security/cve/CVE-2012-2891.html http://support.novell.com/security/cve/CVE-2012-2892.html http://support.novell.com/security/cve/CVE-2012-2893.html http://support.novell.com/security/cve/CVE-2012-2894.html http://support.novell.com/security/cve/CVE-2012-2896.html https://bugzilla.novell.com/782257 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1372-1: important: bind: Specially crafted DNS data can cause a lockup in named.
by opensuse-security＠opensuse.org 19 Oct '12

19 Oct '12

openSUSE Security Update: bind: Specially crafted DNS data can cause a lockup in named. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1372-1 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The bind nameserver was updated to fix specially crafted DNS data can cause a lockup in named. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-716 - openSUSE 12.1: zypper in -t patch openSUSE-2012-716 - openSUSE 11.4: zypper in -t patch openSUSE-2012-716 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): bind-9.9.1P4-1.8.1 bind-chrootenv-9.9.1P4-1.8.1 bind-debuginfo-9.9.1P4-1.8.1 bind-debugsource-9.9.1P4-1.8.1 bind-devel-9.9.1P4-1.8.1 bind-libs-9.9.1P4-1.8.1 bind-libs-debuginfo-9.9.1P4-1.8.1 bind-lwresd-9.9.1P4-1.8.1 bind-lwresd-debuginfo-9.9.1P4-1.8.1 bind-utils-9.9.1P4-1.8.1 bind-utils-debuginfo-9.9.1P4-1.8.1 - openSUSE 12.2 (x86_64): bind-libs-32bit-9.9.1P4-1.8.1 bind-libs-debuginfo-32bit-9.9.1P4-1.8.1 - openSUSE 12.2 (noarch): bind-doc-9.9.1P4-1.8.1 - openSUSE 12.1 (i586 x86_64): bind-9.8.3P4-4.24.1 bind-chrootenv-9.8.3P4-4.24.1 bind-debuginfo-9.8.3P4-4.24.1 bind-debugsource-9.8.3P4-4.24.1 bind-devel-9.8.3P4-4.24.1 bind-libs-9.8.3P4-4.24.1 bind-libs-debuginfo-9.8.3P4-4.24.1 bind-lwresd-9.8.3P4-4.24.1 bind-lwresd-debuginfo-9.8.3P4-4.24.1 bind-utils-9.8.3P4-4.24.1 bind-utils-debuginfo-9.8.3P4-4.24.1 - openSUSE 12.1 (x86_64): bind-libs-32bit-9.8.3P4-4.24.1 bind-libs-debuginfo-32bit-9.8.3P4-4.24.1 - openSUSE 12.1 (noarch): bind-doc-9.8.3P4-4.24.1 - openSUSE 12.1 (ia64): bind-libs-debuginfo-x86-9.8.3P4-4.24.1 bind-libs-x86-9.8.3P4-4.24.1 - openSUSE 11.4 (i586 x86_64): bind-9.7.6P4-0.41.1 bind-chrootenv-9.7.6P4-0.41.1 bind-debuginfo-9.7.6P4-0.41.1 bind-debugsource-9.7.6P4-0.41.1 bind-devel-9.7.6P4-0.41.1 bind-libs-9.7.6P4-0.41.1 bind-libs-debuginfo-9.7.6P4-0.41.1 bind-lwresd-9.7.6P4-0.41.1 bind-lwresd-debuginfo-9.7.6P4-0.41.1 bind-utils-9.7.6P4-0.41.1 bind-utils-debuginfo-9.7.6P4-0.41.1 - openSUSE 11.4 (x86_64): bind-libs-32bit-9.7.6P4-0.41.1 bind-libs-debuginfo-32bit-9.7.6P4-0.41.1 - openSUSE 11.4 (noarch): bind-doc-9.7.6P4-0.41.1 - openSUSE 11.4 (ia64): bind-libs-debuginfo-x86-9.7.6P4-0.41.1 bind-libs-x86-9.7.6P4-0.41.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1351-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 16 Oct '12

16 Oct '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1351-1 Rating: important References: #783533 Cross-References: CVE-2012-3977 CVE-2012-3982 CVE-2012-3983 CVE-2012-3984 CVE-2012-3985 CVE-2012-3986 CVE-2012-3987 CVE-2012-3988 CVE-2012-3989 CVE-2012-3990 CVE-2012-3991 CVE-2012-3992 CVE-2012-3993 CVE-2012-3994 CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4181 CVE-2012-4182 CVE-2012-4183 CVE-2012-4184 CVE-2012-4185 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 CVE-2012-4192 CVE-2012-4193 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. It includes two new package versions. Description: MozillaFirefox was updated to the 10.0.9ESR security release which fixes bugs and security issues: * MFSA 2012-73 / CVE-2012-3977: Security researchers Thai Duong and Juliano Rizzo reported that SPDY's request header compression leads to information leakage, which can allow the extraction of private data such as session cookies, even over an encrypted SSL connection. (This does not affect Firefox 10 as it does not feature the SPDY extension. It was silently fixed for Firefox 15.) * MFSA 2012-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * CVE-2012-3983: Henrik Skupin, Jesse Ruderman and moz_bug_r_a4 reported memory safety problems and crashes that affect Firefox 15. * CVE-2012-3982: Christian Holler and Jesse Ruderman reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 15. * MFSA 2012-75 / CVE-2012-3984: Security researcher David Bloom of Cue discovered that "select" elements are always-on-top chromeless windows and that navigation away from a page with an active "select" menu does not remove this window.When another menu is opened programmatically on a new page, the original "select" menu can be retained and arbitrary HTML content within it rendered, allowing an attacker to cover arbitrary portions of the new page through absolute positioning/scrolling, leading to spoofing attacks. Security researcher Jordi Chancel found a variation that would allow for click-jacking attacks was well. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References Navigation away from a page with an active "select" dropdown menu can be used for URL spoofing, other evil Firefox 10.0.1 : Navigation away from a page with multiple active "select" dropdown menu can be used for Spoofing And ClickJacking with XPI using window.open and geolocalisation * MFSA 2012-76 / CVE-2012-3985: Security researcher Collin Jackson reported a violation of the HTML5 specifications for document.domain behavior. Specified behavior requires pages to only have access to windows in a new document.domain but the observed violation allowed pages to retain access to windows from the page's initial origin in addition to the new document.domain. This could potentially lead to cross-site scripting (XSS) attacks. * MFSA 2012-77 / CVE-2012-3986: Mozilla developer Johnny Stenback discovered that several methods of a feature used for testing (DOMWindowUtils) are not protected by existing security checks, allowing these methods to be called through script by web pages. This was addressed by adding the existing security checks to these methods. * MFSA 2012-78 / CVE-2012-3987: Security researcher Warren He reported that when a page is transitioned into Reader Mode in Firefox for Android, the resulting page has chrome privileges and its content is not thoroughly sanitized. A successful attack requires user enabling of reader mode for a malicious page, which could then perform an attack similar to cross-site scripting (XSS) to gain the privileges allowed to Firefox on an Android device. This has been fixed by changing the Reader Mode page into an unprivileged page. This vulnerability only affects Firefox for Android. * MFSA 2012-79 / CVE-2012-3988: Security researcher Soroush Dalili reported that a combination of invoking full screen mode and navigating backwards in history could, in some circumstances, cause a hang or crash due to a timing dependent use-after-free pointer reference. This crash may be potentially exploitable. * MFSA 2012-80 / CVE-2012-3989: Mozilla community member Ms2ger reported a crash due to an invalid cast when using the instanceof operator on certain types of JavaScript objects. This can lead to a potentially exploitable crash. * MFSA 2012-81 / CVE-2012-3991: Mozilla community member Alice White reported that when the GetProperty function is invoked through JSAPI, security checking can be bypassed when getting cross-origin properties. This potentially allowed for arbitrary code execution. * MFSA 2012-82 / CVE-2012-3994: Security researcher Mariusz Mlynski reported that the location property can be accessed by binary plugins through top.location and top can be shadowed by Object.defineProperty as well. This can allow for possible cross-site scripting (XSS) attacks through plugins. * MFSA 2012-83: Security researcher Mariusz Mlynski reported that when InstallTrigger fails, it throws an error wrapped in a Chrome Object Wrapper (COW) that fails to specify exposed properties. These can then be added to the resulting object by an attacker, allowing access to chrome privileged functions through script. While investigating this issue, Mozilla security researcher moz_bug_r_a4 found that COW did not disallow accessing of properties from a standard prototype in some situations, even when the original issue had been fixed. These issues could allow for a cross-site scripting (XSS) attack or arbitrary code execution. * CVE-2012-3993: XrayWrapper pollution via unsafe COW * CVE-2012-4184: ChromeObjectWrapper is not implemented as intended * MFSA 2012-84 / CVE-2012-3992: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, writes to location.hash can be used in concert with scripted history navigation to cause a specific website to be loaded into the history object. The baseURI can then be changed to this stored site, allowing an attacker to inject a script or intercept posted data posted to a location specified with a relative path. * MFSA 2012-85: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series of use-after-free, buffer overflow, and out of bounds read issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting two additional use-after-free flaws introduced during Firefox 16 development and fixed before general release. * CVE-2012-3995: Out of bounds read in IsCSSWordSpacingSpace * CVE-2012-4179: Heap-use-after-free in nsHTMLCSSUtils::CreateCSSPropertyTxn * CVE-2012-4180: Heap-buffer-overflow in nsHTMLEditor::IsPrevCharInNodeWhitespace * CVE-2012-4181: Heap-use-after-free in nsSMILAnimationController::DoSample * CVE-2012-4182: Heap-use-after-free in nsTextEditRules::WillInsert * CVE-2012-4183: Heap-use-after-free in DOMSVGTests::GetRequiredFeatures * MFSA 2012-86: Security researcher Atte Kettunen from OUSPG reported several heap memory corruption issues found using the Address Sanitizer tool. These issues are potentially exploitable, allowing for remote code execution. * CVE-2012-4185: Global-buffer-overflow in nsCharTraits::length * CVE-2012-4186: Heap-buffer-overflow in nsWaveReader::DecodeAudioData * CVE-2012-4187: Crash with ASSERTION: insPos too small * CVE-2012-4188: Heap-buffer-overflow in Convolve3x3 * MFSA 2012-87 / CVE-2012-3990: Security researcher miaubiz used the Address Sanitizer tool to discover a use-after-free in the IME State Manager code. This could lead to a potentially exploitable crash. * MFSA 2012-89 / CVE-2012-4192 / CVE-2012-4193: Mozilla security researcher moz_bug_r_a4 reported a regression where security wrappers are unwrapped without doing a security check in defaultValue(). This can allow for improper access access to the Location object. In versions 15 and earlier of affected products, there was also the potential for arbitrary code execution. Security Issue reference: * CVE-2012-3977 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3977 > * CVE-2012-3982 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3982 > * CVE-2012-3983 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3983 > * CVE-2012-3984 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3984 > * CVE-2012-3985 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3985 > * CVE-2012-3986 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3986 > * CVE-2012-3987 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3987 > * CVE-2012-3988 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3988 > * CVE-2012-3989 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3989 > * CVE-2012-3990 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3990 > * CVE-2012-3991 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3991 > * CVE-2012-3992 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3992 > * CVE-2012-3993 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3993 > * CVE-2012-3994 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3994 > * CVE-2012-3995 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3995 > * CVE-2012-4179 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4179 > * CVE-2012-4180 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4180 > * CVE-2012-4181 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4181 > * CVE-2012-4182 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4182 > * CVE-2012-4183 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4183 > * CVE-2012-4184 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4184 > * CVE-2012-4185 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4185 > * CVE-2012-4186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4186 > * CVE-2012-4187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4187 > * CVE-2012-4188 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4188 > * CVE-2012-4192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4192 > * CVE-2012-4193 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4193 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201210-6951 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201210-6951 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201210-6951 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.85 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x) [New Version: 7]: MozillaFirefox-10.0.9-0.5.1 MozillaFirefox-branding-SLED-7-0.8.35 MozillaFirefox-translations-10.0.9-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.85 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 7]: MozillaFirefox-10.0.9-0.5.1 MozillaFirefox-branding-SLED-7-0.8.35 MozillaFirefox-translations-10.0.9-0.5.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-10.0.9-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-3977.html http://support.novell.com/security/cve/CVE-2012-3982.html http://support.novell.com/security/cve/CVE-2012-3983.html http://support.novell.com/security/cve/CVE-2012-3984.html http://support.novell.com/security/cve/CVE-2012-3985.html http://support.novell.com/security/cve/CVE-2012-3986.html http://support.novell.com/security/cve/CVE-2012-3987.html http://support.novell.com/security/cve/CVE-2012-3988.html http://support.novell.com/security/cve/CVE-2012-3989.html http://support.novell.com/security/cve/CVE-2012-3990.html http://support.novell.com/security/cve/CVE-2012-3991.html http://support.novell.com/security/cve/CVE-2012-3992.html http://support.novell.com/security/cve/CVE-2012-3993.html http://support.novell.com/security/cve/CVE-2012-3994.html http://support.novell.com/security/cve/CVE-2012-3995.html http://support.novell.com/security/cve/CVE-2012-4179.html http://support.novell.com/security/cve/CVE-2012-4180.html http://support.novell.com/security/cve/CVE-2012-4181.html http://support.novell.com/security/cve/CVE-2012-4182.html http://support.novell.com/security/cve/CVE-2012-4183.html http://support.novell.com/security/cve/CVE-2012-4184.html http://support.novell.com/security/cve/CVE-2012-4185.html http://support.novell.com/security/cve/CVE-2012-4186.html http://support.novell.com/security/cve/CVE-2012-4187.html http://support.novell.com/security/cve/CVE-2012-4188.html http://support.novell.com/security/cve/CVE-2012-4192.html http://support.novell.com/security/cve/CVE-2012-4193.html https://bugzilla.novell.com/783533 http://download.novell.com/patch/finder/?keywords=9df8424f201589e4fca1abdc2… http://download.novell.com/patch/finder/?keywords=b54051bb7b93d9b879c04f373… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0