SUSE Security Update: Security update for SUSE Manager Server 1.7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0928-1 Rating: important References: #799068 #809927 #814954 #864246 #870159 #879904 #881111 #896238 #896244 #898426 #900956 #901108 #902915 #903723 #906850 #912886 #922525 Cross-References: CVE-2014-7811 CVE-2014-7812 CVE-2014-8162 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 14 fixes is now available. It includes 9 new package versions. Description: This collective update for SUSE Manager 1.7 provides several fixes and enhancements. smdba: * Space reclamation caused ORA-00942 (table or view does not exist). (bsc#906850) * Optimized space reclamation for Oracle. * Implement fully hot operations for PostgreSQL. * System check breaks backup and other configuration. * Implement rotating PostgreSQL backup feature. (bsc#896244) * Set PostgreSQL max connections to the same value as for Oracle. sm-ncc-sync-data: * Add ATI and nVidia channels for SLED11-SP3. (bsc#901108) spacecmd: * Fix call to setCustomOptions(). (bsc#879904) spacewalk-backend: * Fix encoding of submit message. * Trigger generation of metadata if the repository contains no packages. (bsc#870159) spacewalk-branding: * Update default Spacewalk entitlement certificate. spacewalk-java: * Introduce improved parser for xmlrpc. (CVE-2014-8162, bsc#922525) * Fix more cross-site scripting bugs. (CVE-2014-7811, bsc#902915) * Ffix CVE audit in case of multiversion package installed and patch in multi channels. (bsc#903723) * Fix automatic configuration file deployment via snippet. (bsc#898426) * Download CSV button does not export all columns ("Base Channel" missing). (bsc#896238) * Fix cross-site scripting in system-group. (CVE-2014-7812, bsc#912886) spacewalk-setup: * Fix XML RPC API External Entities file disclosure. (CVE-2014-8162, bsc#922525) * No activation if db population should be skipped. (bsc#900956) susemanager-schema: * Fix evr_t schema upgrade. (bsc#881111) susemanager: * Add tool to update the spacewalk public cert in the DB. * Fix the test for the mirror credentials. (bsc#864246) How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Upgrade the database schema with spacewalk-schema-upgrade 5. Start the Spacewalk service: spacewalk-service start Security Issues: * CVE-2014-7811 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7811> * CVE-2014-7812 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7812> * CVE-2014-8162 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8162> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-sm-ncc-sync-data=10671 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64) [New Version: 1.5,1.7.1.13,1.7.30,1.7.38.34 and 1.7.7.12]: smdba-1.5-0.6.2.1 spacecmd-1.7.7.12-0.5.1 spacewalk-backend-1.7.38.34-0.5.1 spacewalk-backend-app-1.7.38.34-0.5.1 spacewalk-backend-applet-1.7.38.34-0.5.1 spacewalk-backend-config-files-1.7.38.34-0.5.1 spacewalk-backend-config-files-common-1.7.38.34-0.5.1 spacewalk-backend-config-files-tool-1.7.38.34-0.5.1 spacewalk-backend-iss-1.7.38.34-0.5.1 spacewalk-backend-iss-export-1.7.38.34-0.5.1 spacewalk-backend-libs-1.7.38.34-0.5.1 spacewalk-backend-package-push-server-1.7.38.34-0.5.1 spacewalk-backend-server-1.7.38.34-0.5.1 spacewalk-backend-sql-1.7.38.34-0.5.1 spacewalk-backend-sql-oracle-1.7.38.34-0.5.1 spacewalk-backend-sql-postgresql-1.7.38.34-0.5.1 spacewalk-backend-tools-1.7.38.34-0.5.1 spacewalk-backend-xml-export-libs-1.7.38.34-0.5.1 spacewalk-backend-xmlrpc-1.7.38.34-0.5.1 spacewalk-backend-xp-1.7.38.34-0.5.1 spacewalk-branding-1.7.1.13-0.5.1 susemanager-1.7.30-0.5.2 susemanager-tools-1.7.30-0.5.2 - SUSE Manager 1.7 for SLE 11 SP2 (noarch) [New Version: 1.7.21,1.7.54.34,1.7.56.24 and 1.7.9.12]: sm-ncc-sync-data-1.7.21-0.5.1 spacewalk-java-1.7.54.34-0.5.1 spacewalk-java-config-1.7.54.34-0.5.1 spacewalk-java-lib-1.7.54.34-0.5.1 spacewalk-java-oracle-1.7.54.34-0.5.1 spacewalk-java-postgresql-1.7.54.34-0.5.1 spacewalk-setup-1.7.9.12-0.5.1 spacewalk-taskomatic-1.7.54.34-0.5.1 susemanager-schema-1.7.56.24-0.7.1 References: https://www.suse.com/security/cve/CVE-2014-7811.html https://www.suse.com/security/cve/CVE-2014-7812.html https://www.suse.com/security/cve/CVE-2014-8162.html https://bugzilla.suse.com/799068 https://bugzilla.suse.com/809927 https://bugzilla.suse.com/814954 https://bugzilla.suse.com/864246 https://bugzilla.suse.com/870159 https://bugzilla.suse.com/879904 https://bugzilla.suse.com/881111 https://bugzilla.suse.com/896238 https://bugzilla.suse.com/896244 https://bugzilla.suse.com/898426 https://bugzilla.suse.com/900956 https://bugzilla.suse.com/901108 https://bugzilla.suse.com/902915 https://bugzilla.suse.com/903723 https://bugzilla.suse.com/906850 https://bugzilla.suse.com/912886 https://bugzilla.suse.com/922525 https://download.suse.com/patch/finder/?keywords=8028a25587947641ad45132e499... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org