October 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1781-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 19 Oct '15

19 Oct '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1781-1 Rating: critical References: #941239 #946880 #950169 #950474 Cross-References: CVE-2015-3107 CVE-2015-5124 CVE-2015-5125 CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5567 CVE-2015-5568 CVE-2015-5569 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579 CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584 CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 CVE-2015-7645 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 71 vulnerabilities is now available. Description: This security issue was fixed: - CVE-2015-7645: Critical vulnerability affecting 11.2.202.535 used in Pawn Storm (APSA15-05) (bsc#950474). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-670=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.540-176.1 flash-player-gnome-11.2.202.540-176.1 flash-player-kde4-11.2.202.540-176.1 References: https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-5124.html https://www.suse.com/security/cve/CVE-2015-5125.html https://www.suse.com/security/cve/CVE-2015-5127.html https://www.suse.com/security/cve/CVE-2015-5128.html https://www.suse.com/security/cve/CVE-2015-5129.html https://www.suse.com/security/cve/CVE-2015-5130.html https://www.suse.com/security/cve/CVE-2015-5131.html https://www.suse.com/security/cve/CVE-2015-5132.html https://www.suse.com/security/cve/CVE-2015-5133.html https://www.suse.com/security/cve/CVE-2015-5134.html https://www.suse.com/security/cve/CVE-2015-5539.html https://www.suse.com/security/cve/CVE-2015-5540.html https://www.suse.com/security/cve/CVE-2015-5541.html https://www.suse.com/security/cve/CVE-2015-5544.html https://www.suse.com/security/cve/CVE-2015-5545.html https://www.suse.com/security/cve/CVE-2015-5546.html https://www.suse.com/security/cve/CVE-2015-5547.html https://www.suse.com/security/cve/CVE-2015-5548.html https://www.suse.com/security/cve/CVE-2015-5549.html https://www.suse.com/security/cve/CVE-2015-5550.html https://www.suse.com/security/cve/CVE-2015-5551.html https://www.suse.com/security/cve/CVE-2015-5552.html https://www.suse.com/security/cve/CVE-2015-5553.html https://www.suse.com/security/cve/CVE-2015-5554.html https://www.suse.com/security/cve/CVE-2015-5555.html https://www.suse.com/security/cve/CVE-2015-5556.html https://www.suse.com/security/cve/CVE-2015-5557.html https://www.suse.com/security/cve/CVE-2015-5558.html https://www.suse.com/security/cve/CVE-2015-5559.html https://www.suse.com/security/cve/CVE-2015-5560.html https://www.suse.com/security/cve/CVE-2015-5561.html https://www.suse.com/security/cve/CVE-2015-5562.html https://www.suse.com/security/cve/CVE-2015-5563.html https://www.suse.com/security/cve/CVE-2015-5567.html https://www.suse.com/security/cve/CVE-2015-5568.html https://www.suse.com/security/cve/CVE-2015-5569.html https://www.suse.com/security/cve/CVE-2015-5570.html https://www.suse.com/security/cve/CVE-2015-5571.html https://www.suse.com/security/cve/CVE-2015-5572.html https://www.suse.com/security/cve/CVE-2015-5573.html https://www.suse.com/security/cve/CVE-2015-5574.html https://www.suse.com/security/cve/CVE-2015-5575.html https://www.suse.com/security/cve/CVE-2015-5576.html https://www.suse.com/security/cve/CVE-2015-5577.html https://www.suse.com/security/cve/CVE-2015-5578.html https://www.suse.com/security/cve/CVE-2015-5579.html https://www.suse.com/security/cve/CVE-2015-5580.html https://www.suse.com/security/cve/CVE-2015-5581.html https://www.suse.com/security/cve/CVE-2015-5582.html https://www.suse.com/security/cve/CVE-2015-5584.html https://www.suse.com/security/cve/CVE-2015-5587.html https://www.suse.com/security/cve/CVE-2015-5588.html https://www.suse.com/security/cve/CVE-2015-6676.html https://www.suse.com/security/cve/CVE-2015-6677.html https://www.suse.com/security/cve/CVE-2015-6678.html https://www.suse.com/security/cve/CVE-2015-6679.html https://www.suse.com/security/cve/CVE-2015-6682.html https://www.suse.com/security/cve/CVE-2015-7625.html https://www.suse.com/security/cve/CVE-2015-7626.html https://www.suse.com/security/cve/CVE-2015-7627.html https://www.suse.com/security/cve/CVE-2015-7628.html https://www.suse.com/security/cve/CVE-2015-7629.html https://www.suse.com/security/cve/CVE-2015-7630.html https://www.suse.com/security/cve/CVE-2015-7631.html https://www.suse.com/security/cve/CVE-2015-7632.html https://www.suse.com/security/cve/CVE-2015-7633.html https://www.suse.com/security/cve/CVE-2015-7634.html https://www.suse.com/security/cve/CVE-2015-7643.html https://www.suse.com/security/cve/CVE-2015-7644.html https://www.suse.com/security/cve/CVE-2015-7645.html https://bugzilla.suse.com/941239 https://bugzilla.suse.com/946880 https://bugzilla.suse.com/950169 https://bugzilla.suse.com/950474

1 0

openSUSE-RU-2015:1779-1: moderate: Recommended update for mdadm
by maintenance＠opensuse.org 19 Oct '15

19 Oct '15

openSUSE Recommended Update: Recommended update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1779-1 Rating: moderate References: #930417 #939748 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: mdadm was updated to fix two bugs: * Fix DDF handling on newer controllers (boo#930417) * Don't assemble IMSM array if disabled in BIOS, preventing possible data loss (boo#939748) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-668=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): mdadm-3.3.1-5.17.1 mdadm-debuginfo-3.3.1-5.17.1 mdadm-debugsource-3.3.1-5.17.1 References: https://bugzilla.suse.com/930417 https://bugzilla.suse.com/939748

1 0

openSUSE-RU-2015:1778-1: moderate: Recommended update for squid
by maintenance＠opensuse.org 19 Oct '15

19 Oct '15

openSUSE Recommended Update: Recommended update for squid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1778-1 Rating: moderate References: #819982 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: squid was update to fix an issue that caused squid to terminate frequently. * boo#819982: fix regular assertion in squid Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-667=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-667=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): squid-3.4.4-3.10.1 squid-debuginfo-3.4.4-3.10.1 squid-debugsource-3.4.4-3.10.1 - openSUSE 13.1 (i586 x86_64): squid-3.3.13-2.20.1 squid-debuginfo-3.3.13-2.20.1 squid-debugsource-3.3.13-2.20.1 References: https://bugzilla.suse.com/819982

1 0

openSUSE-RU-2015:1777-1: moderate: Recommended update for xdm
by maintenance＠opensuse.org 19 Oct '15

19 Oct '15

openSUSE Recommended Update: Recommended update for xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1777-1 Rating: moderate References: #939594 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: xdm was updated to fix occasional startup problems of the graphical user interface. * Only fix permissions and ownership of the console if display manager has crashed or was killed. This should avoid races with systemd-logind which modifies the permissions as well. * Only create the link to the PID file if the DM has started successfully. (boo#939594). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-669=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xdm-1.1.11-3.11.1 xdm-debuginfo-1.1.11-3.11.1 xdm-debugsource-1.1.11-3.11.1 References: https://bugzilla.suse.com/939594

1 0

openSUSE-SU-2015:1773-1: moderate: Security update for docker
by opensuse-security＠opensuse.org 17 Oct '15

17 Oct '15

openSUSE Security Update: Security update for docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1773-1 Rating: moderate References: #949660 Cross-References: CVE-2014-8178 CVE-2014-8179 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Docker was updated to 1.8.3 to fix two security issues. The following vulnerabilities were fixed: * CVE-2014-8178: layer IDs lead to local graph poisoning (boo#949660) * CVE-2014-8179: manifest validation and parsing logic errors allow pull-by-digest validation bypass In addition, the following change is included: * --disable-legacy-registry to prevent a daemon from using a v1 registry Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-666=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): docker-1.8.3-43.1 docker-debuginfo-1.8.3-43.1 docker-debugsource-1.8.3-43.1 - openSUSE 13.2 (noarch): docker-bash-completion-1.8.3-43.1 docker-test-1.8.3-43.1 docker-zsh-completion-1.8.3-43.1 References: https://www.suse.com/security/cve/CVE-2014-8178.html https://www.suse.com/security/cve/CVE-2014-8179.html https://bugzilla.suse.com/949660

1 0

openSUSE-SU-2015:1768-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 16 Oct '15

16 Oct '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1768-1 Rating: critical References: #950474 Cross-References: CVE-2015-7645 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2015-7645: Critical vulnerability affecting 11.2.202.535 used in Pawn Storm (APSA15-05) (bsc#950474). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-665=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-665=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.540-2.76.1 flash-player-gnome-11.2.202.540-2.76.1 flash-player-kde4-11.2.202.540-2.76.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.540-141.1 flash-player-gnome-11.2.202.540-141.1 flash-player-kde4-11.2.202.540-141.1 References: https://www.suse.com/security/cve/CVE-2015-7645.html https://bugzilla.suse.com/950474

1 0

openSUSE-SU-2015:1752-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 15 Oct '15

15 Oct '15

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1752-1 Rating: moderate References: #898513 #900914 #922710 Cross-References: CVE-2014-8242 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: rsync was updated to fix one security issue. This security issue was fixed: - CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914). This non-security issue was fixed: - reintroduce "use slp" directive (bsc#922710) * disable it by default * slp doesn't seem to be used much and it often caused problems (eg boo#898513, bsc#922710) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-659=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-659=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rsync-3.1.1-2.7.1 rsync-debuginfo-3.1.1-2.7.1 rsync-debugsource-3.1.1-2.7.1 - openSUSE 13.1 (i586 x86_64): rsync-3.1.0-21.15.1 rsync-debuginfo-3.1.0-21.15.1 rsync-debugsource-3.1.0-21.15.1 References: https://www.suse.com/security/cve/CVE-2014-8242.html https://bugzilla.suse.com/898513 https://bugzilla.suse.com/900914 https://bugzilla.suse.com/922710

1 0

openSUSE-SU-2015:1751-1: moderate: Security update for jakarta-taglibs-standard
by opensuse-security＠opensuse.org 15 Oct '15

15 Oct '15

openSUSE Security Update: Security update for jakarta-taglibs-standard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1751-1 Rating: moderate References: #920813 Cross-References: CVE-2015-0254 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: jakarta-taglibs-standard was updated to fix one security issue. This security issue was fixed: - CVE-2015-0254: Apache Standard Taglibs before 1.2.3 allowed remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension (bsc#920813). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-658=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-658=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): jakarta-taglibs-standard-1.1.1-255.3.1 jakarta-taglibs-standard-javadoc-1.1.1-255.3.1 - openSUSE 13.1 (noarch): jakarta-taglibs-standard-1.1.1-252.3.1 jakarta-taglibs-standard-javadoc-1.1.1-252.3.1 xalan-j2-2.7.2-262.7.1 xalan-j2-demo-2.7.2-262.7.1 xalan-j2-manual-2.7.2-262.7.1 xalan-j2-xsltc-2.7.2-262.7.1 References: https://www.suse.com/security/cve/CVE-2015-0254.html https://bugzilla.suse.com/920813

1 0

openSUSE-SU-2015:1750-1: moderate: Security update for spice
by opensuse-security＠opensuse.org 15 Oct '15

15 Oct '15

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1750-1 Rating: moderate References: #848279 #944460 #944787 #948976 Cross-References: CVE-2013-4282 CVE-2015-3247 CVE-2015-5260 CVE-2015-5261 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Spice was updated to fix four security issues. The following vulnerabilities were fixed: * CVE-2015-3247: heap corruption in the spice server (bsc#944460) * CVE-2015-5261: Guest could have accessed host memory using crafted images (bsc#948976) * CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944460) * CVE-2013-4282: Buffer overflow in password handling (bsc#848279) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-657=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-657=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libspice-server-devel-0.12.4-4.6.1 libspice-server1-0.12.4-4.6.1 libspice-server1-debuginfo-0.12.4-4.6.1 spice-client-0.12.4-4.6.1 spice-client-debuginfo-0.12.4-4.6.1 spice-debugsource-0.12.4-4.6.1 - openSUSE 13.1 (i586 x86_64): libspice-server-devel-0.12.4-2.3.1 libspice-server1-0.12.4-2.3.1 libspice-server1-debuginfo-0.12.4-2.3.1 spice-client-0.12.4-2.3.1 spice-client-debuginfo-0.12.4-2.3.1 spice-debugsource-0.12.4-2.3.1 References: https://www.suse.com/security/cve/CVE-2013-4282.html https://www.suse.com/security/cve/CVE-2015-3247.html https://www.suse.com/security/cve/CVE-2015-5260.html https://www.suse.com/security/cve/CVE-2015-5261.html https://bugzilla.suse.com/848279 https://bugzilla.suse.com/944460 https://bugzilla.suse.com/944787 https://bugzilla.suse.com/948976

1 0

openSUSE-SU-2015:1744-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 14 Oct '15

14 Oct '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1744-1 Rating: important References: #950169 Cross-References: CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.535 to fix a number of security issues. (boo#950169, APSB15-25) The following vulnerabilities were fixed: * CVE-2015-7628: Vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-5569: Defense-in-depth feature in the Flash broker API * CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644: Use-after-free vulnerabilities that could lead to code execution * CVE-2015-7632: Buffer overflow vulnerability that could lead to code execution * CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634: Memory corruption vulnerabilities that could lead to code execution Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-656=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-656=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.535-2.73.2 flash-player-gnome-11.2.202.535-2.73.2 flash-player-kde4-11.2.202.535-2.73.2 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.535-138.2 flash-player-gnome-11.2.202.535-138.2 flash-player-kde4-11.2.202.535-138.2 References: https://www.suse.com/security/cve/CVE-2015-5569.html https://www.suse.com/security/cve/CVE-2015-7625.html https://www.suse.com/security/cve/CVE-2015-7626.html https://www.suse.com/security/cve/CVE-2015-7627.html https://www.suse.com/security/cve/CVE-2015-7628.html https://www.suse.com/security/cve/CVE-2015-7629.html https://www.suse.com/security/cve/CVE-2015-7630.html https://www.suse.com/security/cve/CVE-2015-7631.html https://www.suse.com/security/cve/CVE-2015-7632.html https://www.suse.com/security/cve/CVE-2015-7633.html https://www.suse.com/security/cve/CVE-2015-7634.html https://www.suse.com/security/cve/CVE-2015-7643.html https://www.suse.com/security/cve/CVE-2015-7644.html https://bugzilla.suse.com/950169

1 0