- openSUSE Security Announce

[security-announce] openSUSE-SU-2012:0039-2: important: MozillaFirefox
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0039-2 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox Version 9 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5577 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.25 and 9.0]: MozillaFirefox-9.0-0.2.1 MozillaFirefox-branding-upstream-9.0-0.2.1 MozillaFirefox-buildsymbols-9.0-0.2.1 MozillaFirefox-devel-9.0-0.2.1 MozillaFirefox-translations-common-9.0-0.2.1 MozillaFirefox-translations-other-9.0-0.2.1 mozilla-js192-1.9.2.25-0.2.1 mozilla-xulrunner192-1.9.2.25-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.25-0.2.1 mozilla-xulrunner192-devel-1.9.2.25-0.2.1 mozilla-xulrunner192-gnome-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.25-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.25]: mozilla-js192-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.25-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0206-1: important: kernel: security and bugfix update.
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0206-1 Rating: important References: #691052 #692498 #698450 #699709 #700879 #702037 #707288 #709764 #710235 #726788 #728661 #735612 #736149 Cross-References: CVE-2011-1576 CVE-2011-1770 CVE-2011-2203 CVE-2011-2213 CVE-2011-2525 CVE-2011-2534 CVE-2011-2699 CVE-2011-2723 CVE-2011-2898 CVE-2011-4081 CVE-2011-4604 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has two fixes is now available. It includes one version update. Description: The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2011-4604: If root does read() on a specific socket, it's possible to corrupt (kernel) memory over network, with an ICMP packet, if the B.A.T.M.A.N. mesh protocol is used. CVE-2011-2525: A flaw allowed the tc_fill_qdisc() function in the Linux kernels packet scheduler API implementation to be called on built-in qdisc structures. A local, unprivileged user could have used this flaw to trigger a NULL pointer dereference, resulting in a denial of service. CVE-2011-2699: Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service. CVE-2011-2213: The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880. CVE-2011-1576: The Generic Receive Offload (GRO) implementation in the Linux kernel allowed remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478. CVE-2011-2534: Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel might have allowed local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character. CVE-2011-1770: Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel allowed remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggered a buffer over-read. CVE-2011-2723: The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel, when Generic Receive Offload (GRO) is enabled, reset certain fields in incorrect situations, which allowed remote attackers to cause a denial of service (system crash) via crafted network traffic. CVE-2011-2898: A kernel information leak in the AF_PACKET protocol was fixed which might have allowed local attackers to read kernel memory. CVE-2011-2203: A NULL ptr dereference on mounting corrupt hfs filesystems was fixed which could be used by local attackers to crash the kernel. CVE-2011-4081: Using the crypto interface a local user could Oops the kernel by writing to a AF_ALG socket. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-5605 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.10]: kernel-debug-2.6.34.10-0.6.1 kernel-debug-base-2.6.34.10-0.6.1 kernel-debug-devel-2.6.34.10-0.6.1 kernel-default-2.6.34.10-0.6.1 kernel-default-base-2.6.34.10-0.6.1 kernel-default-devel-2.6.34.10-0.6.1 kernel-desktop-2.6.34.10-0.6.1 kernel-desktop-base-2.6.34.10-0.6.1 kernel-desktop-devel-2.6.34.10-0.6.1 kernel-ec2-2.6.34.10-0.6.1 kernel-ec2-base-2.6.34.10-0.6.1 kernel-ec2-devel-2.6.34.10-0.6.1 kernel-ec2-extra-2.6.34.10-0.6.1 kernel-syms-2.6.34.10-0.6.1 kernel-trace-2.6.34.10-0.6.1 kernel-trace-base-2.6.34.10-0.6.1 kernel-trace-devel-2.6.34.10-0.6.1 kernel-vanilla-2.6.34.10-0.6.1 kernel-vanilla-base-2.6.34.10-0.6.1 kernel-vanilla-devel-2.6.34.10-0.6.1 kernel-xen-2.6.34.10-0.6.1 kernel-xen-base-2.6.34.10-0.6.1 kernel-xen-devel-2.6.34.10-0.6.1 preload-kmp-default-1.1_k2.6.34.10_0.6-19.1.37 preload-kmp-desktop-1.1_k2.6.34.10_0.6-19.1.37 - openSUSE 11.3 (noarch) [New Version: 2.6.34.10]: kernel-devel-2.6.34.10-0.6.1 kernel-source-2.6.34.10-0.6.1 kernel-source-vanilla-2.6.34.10-0.6.1 - openSUSE 11.3 (i586) [New Version: 2.6.34.10]: kernel-pae-2.6.34.10-0.6.1 kernel-pae-base-2.6.34.10-0.6.1 kernel-pae-devel-2.6.34.10-0.6.1 kernel-vmi-2.6.34.10-0.6.1 kernel-vmi-base-2.6.34.10-0.6.1 kernel-vmi-devel-2.6.34.10-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-1576.html http://support.novell.com/security/cve/CVE-2011-1770.html http://support.novell.com/security/cve/CVE-2011-2203.html http://support.novell.com/security/cve/CVE-2011-2213.html http://support.novell.com/security/cve/CVE-2011-2525.html http://support.novell.com/security/cve/CVE-2011-2534.html http://support.novell.com/security/cve/CVE-2011-2699.html http://support.novell.com/security/cve/CVE-2011-2723.html http://support.novell.com/security/cve/CVE-2011-2898.html http://support.novell.com/security/cve/CVE-2011-4081.html http://support.novell.com/security/cve/CVE-2011-4604.html https://bugzilla.novell.com/691052 https://bugzilla.novell.com/692498 https://bugzilla.novell.com/698450 https://bugzilla.novell.com/699709 https://bugzilla.novell.com/700879 https://bugzilla.novell.com/702037 https://bugzilla.novell.com/707288 https://bugzilla.novell.com/709764 https://bugzilla.novell.com/710235 https://bugzilla.novell.com/726788 https://bugzilla.novell.com/728661 https://bugzilla.novell.com/735612 https://bugzilla.novell.com/736149 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0198-1: important: Security update for Mozilla XULrunner
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

SUSE Security Update: Security update for Mozilla XULrunner ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0198-1 Rating: important References: #737533 #744275 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Mozilla XULrunner was updated to 1.9.2.26 security update, fixing security issues and bugs. The following security bugs have been fixed: * MFSA 2012-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References * CVE-2012-0442: Jesse Ruderman and Bob Clary reported memory safety problems that were fixed in both Firefox 10 and Firefox 3.6.26. * MFSA 2012-02/CVE-2011-3670: For historical reasons Firefox has been generous in its interpretation of web addresses containing square brackets around the host. If this host was not a valid IPv6 literal address, Firefox attempted to interpret the host as a regular domain name. Gregory Fleischer reported that requests made using IPv6 syntax using XMLHttpRequest objects through a proxy may generate errors depending on proxy configuration for IPv6. The resulting error messages from the proxy may disclose sensitive data because Same-Origin Policy (SOP) will allow the XMLHttpRequest object to read these error messages, allowing user privacy to be eroded. Firefox now enforces RFC 3986 IPv6 literal syntax and that may break links written using the non-standard Firefox-only forms that were previously accepted. This was fixed previously for Firefox 7.0, Thunderbird 7.0, and SeaMonkey 2.4 but only fixed in Firefox 3.6.26 and Thunderbird 3.1.18 during 2012. * MFSA 2012-04/CVE-2011-3659: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that removed child nodes of nsDOMAttribute can be accessed under certain circumstances because of a premature notification of AttributeChildRemoved. This use-after-free of the child nodes could possibly allow for for remote code execution. * MFSA 2012-07/CVE-2012-0444: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution. * MFSA 2012-08/CVE-2012-0449: Security researchers Nicolas Gregoire and Aki Helin independently reported that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to a memory corruption. While there is no evidence that this is directly exploitable, there is a possibility of remote code execution. Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-mozilla-xulrunner192-5764 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-mozilla-xulrunner192-5764 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-mozilla-xulrunner192-5764 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-mozilla-xulrunner192-5764 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-devel-1.9.2.26-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-gnome-32bit-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-32bit-1.9.2.26-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ia64) [New Version: 1.9.2.26]: mozilla-xulrunner192-gnome-x86-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-x86-1.9.2.26-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): mozilla-xulrunner192-1.9.2.26-0.3.1 mozilla-xulrunner192-gnome-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-1.9.2.26-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): mozilla-xulrunner192-32bit-1.9.2.26-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-1.9.2.26-0.3.1 mozilla-xulrunner192-gnome-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-1.9.2.26-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-32bit-1.9.2.26-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 1.9.2.26]: mozilla-xulrunner192-x86-1.9.2.26-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-1.9.2.26-0.3.1 mozilla-xulrunner192-gnome-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-1.9.2.26-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 1.9.2.26]: mozilla-xulrunner192-32bit-1.9.2.26-0.3.1 mozilla-xulrunner192-gnome-32bit-1.9.2.26-0.3.1 mozilla-xulrunner192-translations-32bit-1.9.2.26-0.3.1 References: https://bugzilla.novell.com/737533 https://bugzilla.novell.com/744275 http://download.novell.com/patch/finder/?keywords=f3ea71cad4a071175c0025555… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0155-1: important: Security update for tomcat6
by opensuse-security＠opensuse.org 07 Feb '12

07 Feb '12

SUSE Security Update: Security update for tomcat6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0155-1 Rating: important References: #735343 #742477 Cross-References: CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 Affected Products: SUSE Manager 1.2 for SLE 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update fixes a regression in parameter passing (in urldecoding of parameters that contain spaces). In addition, multiple weaknesses in HTTP DIGESTS have been fixed (CVE-2011-1184): * CVE-2011-5062: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33 and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. * CVE-2011-5063: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. * CVE-2011-5064: DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. Security Issue references: * CVE-2011-1184 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1184 > * CVE-2011-5062 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5062 > * CVE-2011-5063 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5063 > * CVE-2011-5064 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5064 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-tomcat6-5759 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-tomcat6-5759 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-tomcat6-5759 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.2 for SLE 11 SP1 (noarch): tomcat6-6.0.18-20.35.36.1 tomcat6-jsp-2_1-api-6.0.18-20.35.36.1 tomcat6-lib-6.0.18-20.35.36.1 tomcat6-servlet-2_5-api-6.0.18-20.35.36.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (noarch): tomcat6-6.0.18-20.35.36.1 tomcat6-admin-webapps-6.0.18-20.35.36.1 tomcat6-docs-webapp-6.0.18-20.35.36.1 tomcat6-javadoc-6.0.18-20.35.36.1 tomcat6-jsp-2_1-api-6.0.18-20.35.36.1 tomcat6-lib-6.0.18-20.35.36.1 tomcat6-servlet-2_5-api-6.0.18-20.35.36.1 tomcat6-webapps-6.0.18-20.35.36.1 - SUSE Linux Enterprise Server 11 SP1 (noarch): tomcat6-6.0.18-20.35.36.1 tomcat6-admin-webapps-6.0.18-20.35.36.1 tomcat6-docs-webapp-6.0.18-20.35.36.1 tomcat6-javadoc-6.0.18-20.35.36.1 tomcat6-jsp-2_1-api-6.0.18-20.35.36.1 tomcat6-lib-6.0.18-20.35.36.1 tomcat6-servlet-2_5-api-6.0.18-20.35.36.1 tomcat6-webapps-6.0.18-20.35.36.1 References: http://support.novell.com/security/cve/CVE-2011-1184.html http://support.novell.com/security/cve/CVE-2011-5062.html http://support.novell.com/security/cve/CVE-2011-5063.html http://support.novell.com/security/cve/CVE-2011-5064.html https://bugzilla.novell.com/735343 https://bugzilla.novell.com/742477 http://download.novell.com/patch/finder/?keywords=0caaafb09da77d4c28b53eeb1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0153-2: important: Security update for Linux kernel
by opensuse-security＠opensuse.org 06 Feb '12

06 Feb '12

SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0153-2 Rating: important References: #651219 #653260 #668872 #671479 #688996 #694945 #697920 #703156 #706973 #707288 #708625 #711378 #716023 #722910 #724734 #725709 #726600 #726788 #728339 #728626 #729854 #730118 #731004 #731770 #732296 #732677 #733146 #733863 #734056 #735216 #735446 #735453 #735635 #736018 #738400 #740535 #740703 #740867 #742270 Cross-References: CVE-2010-3873 CVE-2010-4164 CVE-2011-2494 CVE-2011-2699 CVE-2011-4077 CVE-2011-4081 CVE-2011-4110 CVE-2011-4127 CVE-2011-4132 CVE-2012-0038 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise High Availability Extension 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 29 fixes is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 SP1 kernel was updated to 2.6.32.54, fixing lots of bugs and security issues. The following security issues have been fixed: * CVE-2011-4127: A potential hypervisor escape by issuing SG_IO commands to partitiondevices was fixed by restricting access to these commands. * CVE-2011-4110: KEYS: Fix a NULL pointer deref in the user-defined key type, which allowed local attackers to Oops the kernel. * CVE-2011-4081: Avoid potential NULL pointer deref in ghash, which allowed local attackers to Oops the kernel. * CVE-2011-4077: Fixed a memory corruption possibility in xfs readlink, which could be used by local attackers to crash the system or potentially execute code by mounting a prepared xfs filesystem image. * CVE-2012-0038: A overflow in the xfs acl handling was fixed that could be used by local attackers to crash the system or potentially execute code by mounting a prepared xfs filesystem image. * CVE-2011-4132: A flaw in the ext3/ext4 filesystem allowed a local attacker to crash the kernel by getting a prepared ext3/ext4 filesystem mounted. * CVE-2011-2494: Access to the taskstats /proc file was restricted to avoid local attackers gaining knowledge of IO of other users (and so effecting side-channel attacks for e.g. guessing passwords by typing speed). * CVE-2010-3873: When using X.25 communication a malicious sender could corrupt data structures, causing crashes or potential code execution. Please note that X.25 needs to be setup to make this effective, which these days is usually not the case. * CVE-2010-4164: When using X.25 communication a malicious sender could make the machine leak memory, causing crashes. Please note that X.25 needs to be setup to make this effective, which these days is usually not the case. * CVE-2011-2699: A remote denial of service due to a NULL pointer dereference by using IPv6 fragments was fixed. The following non-security issues have been fixed: * elousb: Fixed bug in USB core API usage, code cleanup (bnc#733863). * cifs: overhaul cifs_revalidate and rename to cifs_revalidate_dentry (bnc#735453). * cifs: set server_eof in cifs_fattr_to_inode (bnc#735453). * xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink() (bnc#726600). * block: add and use scsi_blk_cmd_ioctl (bnc#738400 CVE-2011-4127). * block: fail SCSI passthrough ioctls on partition devices (bnc#738400 CVE-2011-4127). * dm: do not forward ioctls from logical volumes to the underlying device (bnc#738400 CVE-2011-4127). * Silence some warnings about ioctls on partitions. * netxen: Remove all references to unified firmware file (bnc#708625). * bonding: send out gratuitous arps even with no address configured (bnc#742270). * patches.fixes/ocfs2-serialize_unaligned_aio.patch: ocfs2: serialize unaligned aio (bnc#671479). * patches.fixes/bonding-check-if-clients-MAC-addr-has-changed. patch: Update references (bnc#729854, bnc#731004). * xfs: Fix wait calculations on lock acquisition and use milliseconds instead of jiffies to print the wait time. * ipmi: reduce polling when interrupts are available (bnc#740867). * ipmi: reduce polling (bnc#740867). * Linux 2.6.32.54. * export shrink_dcache_for_umount_subtree. * patches.suse/stack-unwind: Fix more 2.6.29 merge problems plus a glue code problem (bnc#736018). * PM / Sleep: Fix race between CPU hotplug and freezer (bnc#740535). * jbd: Issue cache flush after checkpointing (bnc#731770). * lpfc: make sure job exists when processing BSG (bnc#735635). * Linux 2.6.32.53. * blktap: fix locking (again) (bnc#724734). * xen: Update Xen patches to 2.6.32.52. * Linux 2.6.32.52. * Linux 2.6.32.51. * Linux 2.6.32.50. * reiserfs: Lock buffers unconditionally in reiserfs_write_full_page() (bnc#716023). * writeback: Include all dirty inodes in background writeback (bnc#716023). * reiserfs: Fix quota mount option parsing (bnc#728626). * bonding: check if clients MAC addr has changed (bnc#729854). * rpc client can not deal with ENOSOCK, so translate it into ENOCONN (bnc#733146). * st: modify tape driver to allow writing immediate filemarks (bnc#688996). * xfs: fix for xfssyncd failure to wake (bnc#722910). * ipmi: Fix deadlock in start_next_msg(). * net: bind() fix error return on wrong address family (bnc#735216). * net: ipv4: relax AF_INET check in bind() (bnc#735216). * net/ipv6: check for mistakenly passed in non-AF_INET6 sockaddrs (bnc#735216). * Bluetooth: Fixed Atheros AR3012 Maryann PID/VID supported (bnc#732296). * percpu: fix chunk range calculation (bnc#668872). * x86, UV: Fix kdump reboot (bnc#735446). * dm: Use done_bytes for io_completion (bnc#711378). * Bluetooth: Add Atheros AR3012 Maryann PID/VID supported. (bnc#732296) * Bluetooth: Add Atheros AR3012 one PID/VID supported. (bnc#732296) * fix missing hunk in oplock break patch (bnc#706973). * patches.arch/s390-34-01-pfault-cpu-hotplug.patch: Refresh. Surrounded s390x lowcore change with __GENKSYMS__ (bnc#728339) * patches.xen/xen3-patch-2.6.30: Refresh. * sched, x86: Avoid unnecessary overflow in sched_clock (bnc#725709). * ACPI thermal: Do not invalidate thermal zone if critical trip point is bad. Security Issue references: * CVE-2010-3873 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3873 > * CVE-2010-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4164 > * CVE-2011-2494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2494 > * CVE-2011-2699 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2699 > * CVE-2011-4077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4077 > * CVE-2011-4081 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4081 > * CVE-2011-4110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110 > * CVE-2011-4127 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4127 > * CVE-2011-4132 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4132 > * CVE-2012-0038 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0038 > Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-kernel-5732 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-kernel-5732 - SUSE Linux Enterprise High Availability Extension 11 SP1: zypper in -t patch sleshasp1-kernel-5732 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-kernel-5732 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 ext4dev-kmp-default-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-trace-0_2.6.32.54_0.3-7.9.40 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-trace-0_2.6.32.54_0.3-0.18.3 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-2.6.32.54-0.3.1 kernel-trace-base-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (x86_64) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-xen-0_2.6.32.54_0.3-0.3.73 ext4dev-kmp-default-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-trace-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-xen-0_2.6.32.54_0.3-7.9.40 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-trace-0_2.6.32.54_0.3-0.18.3 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-ec2-2.6.32.54-0.3.1 kernel-ec2-base-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-2.6.32.54-0.3.1 kernel-trace-base-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 kernel-xen-2.6.32.54-0.3.1 kernel-xen-base-2.6.32.54-0.3.1 kernel-xen-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise High Availability Extension 11 SP1 (x86_64): cluster-network-kmp-default-1.4_2.6.32.54_0.3-2.5.25 cluster-network-kmp-trace-1.4_2.6.32.54_0.3-2.5.25 cluster-network-kmp-xen-1.4_2.6.32.54_0.3-2.5.25 gfs2-kmp-default-2_2.6.32.54_0.3-0.2.72 gfs2-kmp-trace-2_2.6.32.54_0.3-0.2.72 gfs2-kmp-xen-2_2.6.32.54_0.3-0.2.72 ocfs2-kmp-default-1.6_2.6.32.54_0.3-0.4.2.25 ocfs2-kmp-trace-1.6_2.6.32.54_0.3-0.4.2.25 ocfs2-kmp-xen-1.6_2.6.32.54_0.3-0.4.2.25 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-xen-0_2.6.32.54_0.3-0.3.73 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-default-extra-2.6.32.54-0.3.1 kernel-desktop-devel-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 kernel-xen-2.6.32.54-0.3.1 kernel-xen-base-2.6.32.54-0.3.1 kernel-xen-devel-2.6.32.54-0.3.1 kernel-xen-extra-2.6.32.54-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-3873.html http://support.novell.com/security/cve/CVE-2010-4164.html http://support.novell.com/security/cve/CVE-2011-2494.html http://support.novell.com/security/cve/CVE-2011-2699.html http://support.novell.com/security/cve/CVE-2011-4077.html http://support.novell.com/security/cve/CVE-2011-4081.html http://support.novell.com/security/cve/CVE-2011-4110.html http://support.novell.com/security/cve/CVE-2011-4127.html http://support.novell.com/security/cve/CVE-2011-4132.html http://support.novell.com/security/cve/CVE-2012-0038.html https://bugzilla.novell.com/651219 https://bugzilla.novell.com/653260 https://bugzilla.novell.com/668872 https://bugzilla.novell.com/671479 https://bugzilla.novell.com/688996 https://bugzilla.novell.com/694945 https://bugzilla.novell.com/697920 https://bugzilla.novell.com/703156 https://bugzilla.novell.com/706973 https://bugzilla.novell.com/707288 https://bugzilla.novell.com/708625 https://bugzilla.novell.com/711378 https://bugzilla.novell.com/716023 https://bugzilla.novell.com/722910 https://bugzilla.novell.com/724734 https://bugzilla.novell.com/725709 https://bugzilla.novell.com/726600 https://bugzilla.novell.com/726788 https://bugzilla.novell.com/728339 https://bugzilla.novell.com/728626 https://bugzilla.novell.com/729854 https://bugzilla.novell.com/730118 https://bugzilla.novell.com/731004 https://bugzilla.novell.com/731770 https://bugzilla.novell.com/732296 https://bugzilla.novell.com/732677 https://bugzilla.novell.com/733146 https://bugzilla.novell.com/733863 https://bugzilla.novell.com/734056 https://bugzilla.novell.com/735216 https://bugzilla.novell.com/735446 https://bugzilla.novell.com/735453 https://bugzilla.novell.com/735635 https://bugzilla.novell.com/736018 https://bugzilla.novell.com/738400 https://bugzilla.novell.com/740535 https://bugzilla.novell.com/740703 https://bugzilla.novell.com/740867 https://bugzilla.novell.com/742270 http://download.novell.com/patch/finder/?keywords=3b09a8aade4545cf047616287… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0153-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Feb '12

06 Feb '12

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0153-1 Rating: important References: #651219 #653260 #668872 #671479 #688996 #694945 #697920 #703156 #706973 #707288 #708625 #711378 #716023 #722910 #724734 #725709 #726600 #726788 #728339 #728626 #729854 #730118 #731004 #731770 #732296 #732677 #733146 #733863 #734056 #735216 #735446 #735453 #735635 #736018 #738400 #740535 #740703 #740867 #742270 Cross-References: CVE-2010-3873 CVE-2010-4164 CVE-2011-2494 CVE-2011-2699 CVE-2011-4077 CVE-2011-4081 CVE-2011-4110 CVE-2011-4127 CVE-2011-4132 CVE-2012-0038 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise High Availability Extension 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 29 fixes is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 SP1 kernel has been updated to 2.6.32.54, fixing numerous bugs and security issues. The following security issues have been fixed: * A potential hypervisor escape by issuing SG_IO commands to partitiondevices was fixed by restricting access to these commands. ( CVE-2011-4127 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4127 > ) * KEYS: Fix a NULL pointer deref in the user-defined key type, which allowed local attackers to Oops the kernel. (CVE-2011-4110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110 > ) * Avoid potential NULL pointer deref in ghash, which allowed local attackers to Oops the kernel. (CVE-2011-4081 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4081 > ) * Fixed a memory corruption possibility in xfs readlink, which could be used by local attackers to crash the system or potentially execute code by mounting a prepared xfs filesystem image. (CVE-2011-4077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4077 > ) * A overflow in the xfs acl handling was fixed that could be used by local attackers to crash the system or potentially execute code by mounting a prepared xfs filesystem image. (CVE-2012-0038 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0038 > ) * A flaw in the ext3/ext4 filesystem allowed a local attacker to crash the kernel by getting a prepared ext3/ext4 filesystem mounted. ( CVE-2011-4132 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4132 > ) * Access to the taskstats /proc file was restricted to avoid local attackers gaining knowledge of IO of other users (and so effecting side-channel attacks for e.g. guessing passwords by typing speed). ( CVE-2011-2494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2494 > ) * When using X.25 communication a malicious sender could corrupt data structures, causing crashes or potential code execution. Please note that X.25 needs to be setup to make this effective, which these days is usually not the case. (CVE-2010-3873 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3873 > ) * When using X.25 communication a malicious sender could make the machine leak memory, causing crashes. Please note that X.25 needs to be setup to make this effective, which these days is usually not the case. (CVE-2010-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4164 > ) * A remote denial of service due to a NULL pointer dereference by using IPv6 fragments was fixed. (CVE-2011-2699 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2699 > ) The following non-security issues have been fixed (excerpt from changelog): * elousb: Fixed bug in USB core API usage, code cleanup. * cifs: overhaul cifs_revalidate and rename to cifs_revalidate_dentry. * cifs: set server_eof in cifs_fattr_to_inode. * xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink(). * Silence some warnings about ioctls on partitions. * netxen: Remove all references to unified firmware file. * bonding: send out gratuitous arps even with no address configured. * patches.fixes/ocfs2-serialize_unaligned_aio.patch: ocfs2: serialize unaligned aio. * patches.fixes/bonding-check-if-clients-MAC-addr-has-changed. patch: Update references. * xfs: Fix wait calculations on lock acquisition and use milliseconds instead of jiffies to print the wait time. * ipmi: reduce polling when interrupts are available. * ipmi: reduce polling. * export shrink_dcache_for_umount_subtree. * patches.suse/stack-unwind: Fix more 2.6.29 merge problems plus a glue code problem. * PM / Sleep: Fix race between CPU hotplug and freezer. * jbd: Issue cache flush after checkpointing. * lpfc: make sure job exists when processing BSG. * blktap: fix locking (again). * xen: Update Xen patches to 2.6.32.52. * reiserfs: Lock buffers unconditionally in reiserfs_write_full_page(). * writeback: Include all dirty inodes in background writeback. * reiserfs: Fix quota mount option parsing. * bonding: check if clients MAC addr has changed. * rpc client can not deal with ENOSOCK, so translate it into ENOCONN. * st: modify tape driver to allow writing immediate filemarks. * xfs: fix for xfssyncd failure to wake. * ipmi: Fix deadlock in start_next_msg(). * net: bind() fix error return on wrong address family. * net: ipv4: relax AF_INET check in bind(). * net/ipv6: check for mistakenly passed in non-AF_INET6 sockaddrs. * Bluetooth: Fixed Atheros AR3012 Maryann PID/VID supported. * percpu: fix chunk range calculation. * x86, UV: Fix kdump reboot. * dm: Use done_bytes for io_completion. * Bluetooth: Add Atheros AR3012 Maryann PID/VID supported. * Bluetooth: Add Atheros AR3012 one PID/VID supported. * fix missing hunk in oplock break patch. * patches.arch/s390-34-01-pfault-cpu-hotplug.patch: Refresh. * Surrounded s390x lowcore change with __GENKSYMS__ * patches.xen/xen3-patch-2.6.30: Refresh. * sched, x86: Avoid unnecessary overflow in sched_clock. * ACPI thermal: Do not invalidate thermal zone if critical trip point is bad. Indications: Everyone using the Linux Kernel on x86 (32 bit) architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-kernel-5723 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-kernel-5723 slessp1-kernel-5724 slessp1-kernel-5725 slessp1-kernel-5729 - SUSE Linux Enterprise High Availability Extension 11 SP1: zypper in -t patch sleshasp1-kernel-5723 sleshasp1-kernel-5724 sleshasp1-kernel-5725 sleshasp1-kernel-5729 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-kernel-5723 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware (i586) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-pae-0_2.6.32.54_0.3-0.3.73 ext4dev-kmp-default-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-pae-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-trace-0_2.6.32.54_0.3-7.9.40 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-pae-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-trace-0_2.6.32.54_0.3-0.18.3 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-pae-2.6.32.54-0.3.1 kernel-pae-base-2.6.32.54-0.3.1 kernel-pae-devel-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-2.6.32.54-0.3.1 kernel-trace-base-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 ext4dev-kmp-default-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-trace-0_2.6.32.54_0.3-7.9.40 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-2.6.32.54-0.3.1 kernel-trace-base-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (s390x) [New Version: 2.6.32.54]: kernel-default-man-2.6.32.54-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64) [New Version: 2.6.32.54]: ext4dev-kmp-ppc64-0_2.6.32.54_0.3-7.9.40 kernel-ppc64-2.6.32.54-0.3.1 kernel-ppc64-base-2.6.32.54-0.3.1 kernel-ppc64-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586) [New Version: 2.6.32.54]: btrfs-kmp-pae-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-xen-0_2.6.32.54_0.3-0.3.73 ext4dev-kmp-pae-0_2.6.32.54_0.3-7.9.40 ext4dev-kmp-xen-0_2.6.32.54_0.3-7.9.40 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-pae-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-trace-0_2.6.32.54_0.3-0.18.3 kernel-ec2-2.6.32.54-0.3.1 kernel-ec2-base-2.6.32.54-0.3.1 kernel-pae-2.6.32.54-0.3.1 kernel-pae-base-2.6.32.54-0.3.1 kernel-pae-devel-2.6.32.54-0.3.1 kernel-xen-2.6.32.54-0.3.1 kernel-xen-base-2.6.32.54-0.3.1 kernel-xen-devel-2.6.32.54-0.3.1 - SUSE Linux Enterprise High Availability Extension 11 SP1 (i586 ia64 ppc64 s390x): cluster-network-kmp-default-1.4_2.6.32.54_0.3-2.5.25 cluster-network-kmp-trace-1.4_2.6.32.54_0.3-2.5.25 gfs2-kmp-default-2_2.6.32.54_0.3-0.2.72 gfs2-kmp-trace-2_2.6.32.54_0.3-0.2.72 ocfs2-kmp-default-1.6_2.6.32.54_0.3-0.4.2.25 ocfs2-kmp-trace-1.6_2.6.32.54_0.3-0.4.2.25 - SUSE Linux Enterprise High Availability Extension 11 SP1 (ppc64): cluster-network-kmp-ppc64-1.4_2.6.32.54_0.3-2.5.25 gfs2-kmp-ppc64-2_2.6.32.54_0.3-0.2.72 ocfs2-kmp-ppc64-1.6_2.6.32.54_0.3-0.4.2.25 - SUSE Linux Enterprise High Availability Extension 11 SP1 (i586): cluster-network-kmp-pae-1.4_2.6.32.54_0.3-2.5.25 cluster-network-kmp-xen-1.4_2.6.32.54_0.3-2.5.25 gfs2-kmp-pae-2_2.6.32.54_0.3-0.2.72 gfs2-kmp-xen-2_2.6.32.54_0.3-0.2.72 ocfs2-kmp-pae-1.6_2.6.32.54_0.3-0.4.2.25 ocfs2-kmp-xen-1.6_2.6.32.54_0.3-0.4.2.25 - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 2.6.32.54]: btrfs-kmp-default-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-pae-0_2.6.32.54_0.3-0.3.73 btrfs-kmp-xen-0_2.6.32.54_0.3-0.3.73 hyper-v-kmp-default-0_2.6.32.54_0.3-0.18.3 hyper-v-kmp-pae-0_2.6.32.54_0.3-0.18.3 kernel-default-2.6.32.54-0.3.1 kernel-default-base-2.6.32.54-0.3.1 kernel-default-devel-2.6.32.54-0.3.1 kernel-default-extra-2.6.32.54-0.3.1 kernel-desktop-devel-2.6.32.54-0.3.1 kernel-pae-2.6.32.54-0.3.1 kernel-pae-base-2.6.32.54-0.3.1 kernel-pae-devel-2.6.32.54-0.3.1 kernel-pae-extra-2.6.32.54-0.3.1 kernel-source-2.6.32.54-0.3.1 kernel-syms-2.6.32.54-0.3.1 kernel-trace-devel-2.6.32.54-0.3.1 kernel-xen-2.6.32.54-0.3.1 kernel-xen-base-2.6.32.54-0.3.1 kernel-xen-devel-2.6.32.54-0.3.1 kernel-xen-extra-2.6.32.54-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-3873.html http://support.novell.com/security/cve/CVE-2010-4164.html http://support.novell.com/security/cve/CVE-2011-2494.html http://support.novell.com/security/cve/CVE-2011-2699.html http://support.novell.com/security/cve/CVE-2011-4077.html http://support.novell.com/security/cve/CVE-2011-4081.html http://support.novell.com/security/cve/CVE-2011-4110.html http://support.novell.com/security/cve/CVE-2011-4127.html http://support.novell.com/security/cve/CVE-2011-4132.html http://support.novell.com/security/cve/CVE-2012-0038.html https://bugzilla.novell.com/651219 https://bugzilla.novell.com/653260 https://bugzilla.novell.com/668872 https://bugzilla.novell.com/671479 https://bugzilla.novell.com/688996 https://bugzilla.novell.com/694945 https://bugzilla.novell.com/697920 https://bugzilla.novell.com/703156 https://bugzilla.novell.com/706973 https://bugzilla.novell.com/707288 https://bugzilla.novell.com/708625 https://bugzilla.novell.com/711378 https://bugzilla.novell.com/716023 https://bugzilla.novell.com/722910 https://bugzilla.novell.com/724734 https://bugzilla.novell.com/725709 https://bugzilla.novell.com/726600 https://bugzilla.novell.com/726788 https://bugzilla.novell.com/728339 https://bugzilla.novell.com/728626 https://bugzilla.novell.com/729854 https://bugzilla.novell.com/730118 https://bugzilla.novell.com/731004 https://bugzilla.novell.com/731770 https://bugzilla.novell.com/732296 https://bugzilla.novell.com/732677 https://bugzilla.novell.com/733146 https://bugzilla.novell.com/733863 https://bugzilla.novell.com/734056 https://bugzilla.novell.com/735216 https://bugzilla.novell.com/735446 https://bugzilla.novell.com/735453 https://bugzilla.novell.com/735635 https://bugzilla.novell.com/736018 https://bugzilla.novell.com/738400 https://bugzilla.novell.com/740535 https://bugzilla.novell.com/740703 https://bugzilla.novell.com/740867 https://bugzilla.novell.com/742270 http://download.novell.com/patch/finder/?keywords=5246b1b1109a84332cefb2393… http://download.novell.com/patch/finder/?keywords=63890e46f07aad0805351305c… http://download.novell.com/patch/finder/?keywords=71cd114b345abf41eee10c920… http://download.novell.com/patch/finder/?keywords=7560cd30aac0aa208a5dfb2a1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0122-1: important: Security update for IBM Java 1.4.2
by opensuse-security＠opensuse.org 26 Jan '12

26 Jan '12

SUSE Security Update: Security update for IBM Java 1.4.2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0122-1 Rating: important References: #739256 Cross-References: CVE-2011-3389 CVE-2011-3545 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3552 CVE-2011-3556 CVE-2011-3557 CVE-2011-3560 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: IBM Java 1.4.2 SR13 FP11 has been released and contains various security fixes. http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.mozilla.org/en-US/firefox/10.0/releasenotes/ <http://www.mozilla.org/en-US/firefox/10.0/releasenotes/> (CVEs fixed: CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3552 CVE-2011-3545 CVE-2011-3556 CVE-2011-3557 CVE-2011-3389 CVE-2011-3560 ) Security Issues: * CVE-2011-3389 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389 > * CVE-2011-3545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3545 > * CVE-2011-3547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547 > * CVE-2011-3548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 > * CVE-2011-3549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3549 > * CVE-2011-3552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 > * CVE-2011-3556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556 > * CVE-2011-3557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557 > * CVE-2011-3560 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.11-0.10.1 java-1_4_2-ibm-devel-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.11-0.10.1 java-1_4_2-ibm-devel-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.11-0.10.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3560.html https://bugzilla.novell.com/739256 http://download.novell.com/patch/finder/?keywords=051986200790170b4eac52e27… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0117-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 24 Jan '12

24 Jan '12

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0117-1 Rating: important References: #739894 Cross-References: CVE-2011-3919 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. CVE-2011-3919 has been assigned. Security Issue reference: * CVE-2011-3919 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libxml2-5654 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libxml2-5654 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libxml2-5654 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libxml2-5654 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): libxml2-devel-2.7.6-0.13.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): libxml2-devel-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): libxml2-2.7.6-0.13.1 libxml2-doc-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): libxml2-2.7.6-0.13.1 libxml2-doc-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): libxml2-x86-2.7.6-0.13.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): libxml2-2.6.23-15.27.1 libxml2-devel-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): libxml2-32bit-2.6.23-15.27.1 libxml2-devel-32bit-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): libxml2-x86-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): libxml2-64bit-2.6.23-15.27.1 libxml2-devel-64bit-2.6.23-15.27.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): libxml2-2.7.6-0.13.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): libxml2-2.6.23-15.27.1 libxml2-devel-2.6.23-15.27.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): libxml2-32bit-2.6.23-15.27.1 libxml2-devel-32bit-2.6.23-15.27.1 References: http://support.novell.com/security/cve/CVE-2011-3919.html https://bugzilla.novell.com/739894 http://download.novell.com/patch/finder/?keywords=2a9a16773f62000d9967a5742… http://download.novell.com/patch/finder/?keywords=bdfcc7d229d9bdc2471a30fac… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0114-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 23 Jan '12

23 Jan '12

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0114-1 Rating: important References: #739248 Cross-References: CVE-2011-3389 CVE-2011-3516 CVE-2011-3521 CVE-2011-3544 CVE-2011-3545 CVE-2011-3546 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3550 CVE-2011-3551 CVE-2011-3552 CVE-2011-3553 CVE-2011-3554 CVE-2011-3556 CVE-2011-3557 CVE-2011-3560 CVE-2011-3561 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: IBM Java 1.6.0 SR10 has been released fixing the following CVE's: * CVE-2011-3389 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389 > * CVE-2011-3516 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3516 > * CVE-2011-3521 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3521 > * CVE-2011-3544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544 > * CVE-2011-3545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3545 > * CVE-2011-3546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3546 > * CVE-2011-3547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547 > * CVE-2011-3548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 > * CVE-2011-3549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3549 > * CVE-2011-3550 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3550 > * CVE-2011-3551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3551 > * CVE-2011-3552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 > * CVE-2011-3553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3553 > * CVE-2011-3554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3554 > * CVE-2011-3556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556 > * CVE-2011-3557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557 > * CVE-2011-3560 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560 > * CVE-2011-3561 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3561 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_6_0-ibm-64bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Java 10 SP4 (x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.8.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3516.html http://support.novell.com/security/cve/CVE-2011-3521.html http://support.novell.com/security/cve/CVE-2011-3544.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3546.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3550.html http://support.novell.com/security/cve/CVE-2011-3551.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3553.html http://support.novell.com/security/cve/CVE-2011-3554.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3560.html http://support.novell.com/security/cve/CVE-2011-3561.html https://bugzilla.novell.com/739248 http://download.novell.com/patch/finder/?keywords=ea376c01db551281b5801fde1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.3 has reached end of SUSE support
by Marcus Meissner 23 Jan '12

23 Jan '12

Hi, (also announced by Benjamin on opensuse-announce) With the release of release-notes-openSUSE on Friday 20th of January SUSE has released the last update for openSUSE 11.3. openSUSE 11.3 is now officially discontinued and out of support by SUSE. Here are some security statistics: openSUSE 11.3 was released on July 15th 2010, making it 18 months of security and bugfix support. Some statistics on the released patches (compared to 11.2): Total updates: 581 (+92) Security: 358 (+41) Recommended: 221 (+49) Optional: 2 (+2) CVE Entries: 1212 (+78) Top issues (compared to 11.2 for issues down to 5) 14 seamonkey (+3) 12 MozillaFirefox (-6) 12 flash-player (+2) 11 MozillaThunderbird (+3) 10 opera (-3) 9 kernel (+4) 7 mozilla-xulrunner191 (+1) 7 libopenssl-devel (+2) 7 java-1_6_0-openjdk (+2) 6 krb5 (-3) 6 bind (+3) 6 acroread (-2) 5 wireshark (+1) 5 tomcat6 (0) 5 exim (+2) 5 dhcp (+4) 5 clamav (0) 5 apache2-mod_php5 (0) And top issues sorted by CVE (Common Vulnerability Enumeration) count down to 5) (compared to 11.2 for the top): 214 libwebkit (+34) 138 seamonkey (+18) 128 kernel (+22) 113 MozillaFirefox (-6) 111 MozillaThunderbird (-16) 96 mozilla-xulrunner191 (+12) 90 java-1_6_0-sun (-4) 86 acroread (-27) 82 flash-player (-1) 54 opera (+27) 51 java-1_6_0-openjdk (-43) 49 apache2-mod_php5 (+4) 32 wireshark (+6) 21 freetype2 (+3) 16 icedtea-web 13 krb5 (-2) 12 OpenOffice_org (0) 12 libopenssl-devel (+6) 11 tomcat6 (0) 10 apache2 (+8) 10 quagga 9 libmariadbclient16 8 rubygem-actionmailer 8 gimp (+2) 8 libmysqlclient-devel (-15) 8 perl (-1) 8 dhcp (+6) 8 libmysqlclusterclient16 8 clamav (-2) 8 bind (+2) 8 libmodplug (+7) 7 libtiff-devel (+2) 7 exim (+2) 7 libsvn_auth_gnome_keyring-1-0 (+4) 7 libvirt (+1) 7 finch (-5) 7 NetworkManager (+5) 6 ecryptfs-utils 6 libpng14 6 puppet (+5) 6 sysconfig (+2) 6 xorg-x11-Xvnc (+4) 6 sudo (0) 6 libpng12 6 python-feedparser (+1) 6 kvm (+5) 5 compat-openssl097g (+4) 5 otrs (+3) 5 glibc (-1) 5 libmoon-devel 5 radvd 5 evince (0) 5 libxml2 (+3) 5 libpcsclite1 (0) 5 cyrus-imapd # security updates by count # grep -l type..secur updateinfo-*|sed -e 's/^updateinfo-//;s/-[0-9]*.xml$//;'|sort|uniq -c|sort -n +0 -r|less # grep CVE- update* |perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l # for i in updateinfo-* ; do echo -n "$i " ; grep CVE- $i|perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l ; done |perl -e 'while (<>) { /^updateinfo-(\S*)-\d*.xml (\d*)$/; $cnt{$1}+=$2; } ; foreach (sort { $cnt{$b} <=> $cnt{$a} } keys %cnt) { print "$cnt{$_}\t\t$_\n";} ' -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0