November 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:1938-1: moderate: Recommended update for gnome-software
by maintenance＠opensuse.org 09 Nov '15

09 Nov '15

openSUSE Recommended Update: Recommended update for gnome-software ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1938-1 Rating: moderate References: #906598 #906687 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for gnome-software fixes the following issues: - Add gnome-software-xterm-is-not-removable.patch: XTerm is a system dependency and must not be removable (boo#906598, boo#906687). As Leap is based on SLE, we did not inherit the split of xterm and xterm-bin. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-713=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gnome-software-3.16.6-4.1 gnome-software-debuginfo-3.16.6-4.1 gnome-software-debugsource-3.16.6-4.1 - openSUSE Leap 42.1 (noarch): gnome-software-lang-3.16.6-4.1 References: https://bugzilla.suse.com/906598 https://bugzilla.suse.com/906687

1 0

openSUSE-RU-2015:1937-1: moderate: Recommended update for pithos
by maintenance＠opensuse.org 09 Nov '15

09 Nov '15

openSUSE Recommended Update: Recommended update for pithos ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1937-1 Rating: moderate References: #907701 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 1.0.1 for pithos: - Update to version 1.0.1: + Automatically install missing codecs if supported. + Save window position between sessions. + Fix saving last station on quit. + Fix pacparser support. + Improve pandora module docs. + Add setup.py command to build docs. + Add appdata file. + Notification_icon: Make toggling visibility more reliable. + mpris: Fix exception when querying positon. + mpris: Implement setting volume. - Update fixes Pandora stream and hangs at "loading songs" This occurs randomly, sometimes very frequently (boo#907701). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-715=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): pithos-1.0.1-3.1 References: https://bugzilla.suse.com/907701

1 0

openSUSE-RU-2015:1936-1: moderate: Recommended update for php5
by maintenance＠opensuse.org 09 Nov '15

09 Nov '15

openSUSE Recommended Update: Recommended update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1936-1 Rating: moderate References: #949134 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update reenables the suhosin extension that was disabled by mistake in the previous update. [bnc#949134] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-717=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-38.1 apache2-mod_php5-debuginfo-5.5.14-38.1 php5-5.5.14-38.1 php5-bcmath-5.5.14-38.1 php5-bcmath-debuginfo-5.5.14-38.1 php5-bz2-5.5.14-38.1 php5-bz2-debuginfo-5.5.14-38.1 php5-calendar-5.5.14-38.1 php5-calendar-debuginfo-5.5.14-38.1 php5-ctype-5.5.14-38.1 php5-ctype-debuginfo-5.5.14-38.1 php5-curl-5.5.14-38.1 php5-curl-debuginfo-5.5.14-38.1 php5-dba-5.5.14-38.1 php5-dba-debuginfo-5.5.14-38.1 php5-debuginfo-5.5.14-38.1 php5-debugsource-5.5.14-38.1 php5-devel-5.5.14-38.1 php5-dom-5.5.14-38.1 php5-dom-debuginfo-5.5.14-38.1 php5-enchant-5.5.14-38.1 php5-enchant-debuginfo-5.5.14-38.1 php5-exif-5.5.14-38.1 php5-exif-debuginfo-5.5.14-38.1 php5-fastcgi-5.5.14-38.1 php5-fastcgi-debuginfo-5.5.14-38.1 php5-fileinfo-5.5.14-38.1 php5-fileinfo-debuginfo-5.5.14-38.1 php5-firebird-5.5.14-38.1 php5-firebird-debuginfo-5.5.14-38.1 php5-fpm-5.5.14-38.1 php5-fpm-debuginfo-5.5.14-38.1 php5-ftp-5.5.14-38.1 php5-ftp-debuginfo-5.5.14-38.1 php5-gd-5.5.14-38.1 php5-gd-debuginfo-5.5.14-38.1 php5-gettext-5.5.14-38.1 php5-gettext-debuginfo-5.5.14-38.1 php5-gmp-5.5.14-38.1 php5-gmp-debuginfo-5.5.14-38.1 php5-iconv-5.5.14-38.1 php5-iconv-debuginfo-5.5.14-38.1 php5-imap-5.5.14-38.1 php5-imap-debuginfo-5.5.14-38.1 php5-intl-5.5.14-38.1 php5-intl-debuginfo-5.5.14-38.1 php5-json-5.5.14-38.1 php5-json-debuginfo-5.5.14-38.1 php5-ldap-5.5.14-38.1 php5-ldap-debuginfo-5.5.14-38.1 php5-mbstring-5.5.14-38.1 php5-mbstring-debuginfo-5.5.14-38.1 php5-mcrypt-5.5.14-38.1 php5-mcrypt-debuginfo-5.5.14-38.1 php5-mssql-5.5.14-38.1 php5-mssql-debuginfo-5.5.14-38.1 php5-mysql-5.5.14-38.1 php5-mysql-debuginfo-5.5.14-38.1 php5-odbc-5.5.14-38.1 php5-odbc-debuginfo-5.5.14-38.1 php5-opcache-5.5.14-38.1 php5-opcache-debuginfo-5.5.14-38.1 php5-openssl-5.5.14-38.1 php5-openssl-debuginfo-5.5.14-38.1 php5-pcntl-5.5.14-38.1 php5-pcntl-debuginfo-5.5.14-38.1 php5-pdo-5.5.14-38.1 php5-pdo-debuginfo-5.5.14-38.1 php5-pgsql-5.5.14-38.1 php5-pgsql-debuginfo-5.5.14-38.1 php5-phar-5.5.14-38.1 php5-phar-debuginfo-5.5.14-38.1 php5-posix-5.5.14-38.1 php5-posix-debuginfo-5.5.14-38.1 php5-pspell-5.5.14-38.1 php5-pspell-debuginfo-5.5.14-38.1 php5-readline-5.5.14-38.1 php5-readline-debuginfo-5.5.14-38.1 php5-shmop-5.5.14-38.1 php5-shmop-debuginfo-5.5.14-38.1 php5-snmp-5.5.14-38.1 php5-snmp-debuginfo-5.5.14-38.1 php5-soap-5.5.14-38.1 php5-soap-debuginfo-5.5.14-38.1 php5-sockets-5.5.14-38.1 php5-sockets-debuginfo-5.5.14-38.1 php5-sqlite-5.5.14-38.1 php5-sqlite-debuginfo-5.5.14-38.1 php5-suhosin-5.5.14-38.1 php5-suhosin-debuginfo-5.5.14-38.1 php5-sysvmsg-5.5.14-38.1 php5-sysvmsg-debuginfo-5.5.14-38.1 php5-sysvsem-5.5.14-38.1 php5-sysvsem-debuginfo-5.5.14-38.1 php5-sysvshm-5.5.14-38.1 php5-sysvshm-debuginfo-5.5.14-38.1 php5-tidy-5.5.14-38.1 php5-tidy-debuginfo-5.5.14-38.1 php5-tokenizer-5.5.14-38.1 php5-tokenizer-debuginfo-5.5.14-38.1 php5-wddx-5.5.14-38.1 php5-wddx-debuginfo-5.5.14-38.1 php5-xmlreader-5.5.14-38.1 php5-xmlreader-debuginfo-5.5.14-38.1 php5-xmlrpc-5.5.14-38.1 php5-xmlrpc-debuginfo-5.5.14-38.1 php5-xmlwriter-5.5.14-38.1 php5-xmlwriter-debuginfo-5.5.14-38.1 php5-xsl-5.5.14-38.1 php5-xsl-debuginfo-5.5.14-38.1 php5-zip-5.5.14-38.1 php5-zip-debuginfo-5.5.14-38.1 php5-zlib-5.5.14-38.1 php5-zlib-debuginfo-5.5.14-38.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-38.1 References: https://bugzilla.suse.com/949134

1 0

openSUSE-SU-2015:1930-1: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 06 Nov '15

06 Nov '15

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1930-1 Rating: low References: #951960 Cross-References: CVE-2015-7873 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: phpMyAdmin was updated to fix one security issue. This security issue was fixed: - CVE-2015-7873: The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allowed remote attackers to spoof content via the url parameter (bsc#951960). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-712=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.1-3.1 References: https://www.suse.com/security/cve/CVE-2015-7873.html https://bugzilla.suse.com/951960

1 0

openSUSE-SU-2015:1929-1: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 06 Nov '15

06 Nov '15

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1929-1 Rating: low References: #951960 Cross-References: CVE-2015-7873 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: phpMyAdmin was updated to version 4.4.15.1 to fix one security issue. This security issue was fixed: - CVE-2015-7873: The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allowed remote attackers to spoof content via the url parameter (bsc#951960). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-710=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-710=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15.1-17.1 - openSUSE 13.1 (noarch): phpMyAdmin-4.4.15.1-37.1 References: https://www.suse.com/security/cve/CVE-2015-7873.html https://bugzilla.suse.com/951960

1 0

openSUSE-SU-2015:1928-1: important: Security update for krb5
by opensuse-security＠opensuse.org 06 Nov '15

06 Nov '15

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1928-1 Rating: important References: #952188 #952189 #952190 Cross-References: CVE-2015-2695 CVE-2015-2696 CVE-2015-2697 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: krb5 was updated to fix three security issues. These security issues were fixed: - CVE-2015-2695: Applications which call gss_inquire_context() on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process crash. (bsc#952188). - CVE-2015-2696: Applications which call gss_inquire_context() on a partially-established IAKERB context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process crash. (bsc#952189). - CVE-2015-2697: Incorrect string handling in build_principal_va can lead to DOS (bsc#952190). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-709=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-709=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): krb5-1.12.2-15.1 krb5-client-1.12.2-15.1 krb5-client-debuginfo-1.12.2-15.1 krb5-debuginfo-1.12.2-15.1 krb5-debugsource-1.12.2-15.1 krb5-devel-1.12.2-15.1 krb5-doc-1.12.2-15.1 krb5-mini-1.12.2-15.1 krb5-mini-debuginfo-1.12.2-15.1 krb5-mini-debugsource-1.12.2-15.1 krb5-mini-devel-1.12.2-15.1 krb5-plugin-kdb-ldap-1.12.2-15.1 krb5-plugin-kdb-ldap-debuginfo-1.12.2-15.1 krb5-plugin-preauth-otp-1.12.2-15.1 krb5-plugin-preauth-otp-debuginfo-1.12.2-15.1 krb5-plugin-preauth-pkinit-1.12.2-15.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.2-15.1 krb5-server-1.12.2-15.1 krb5-server-debuginfo-1.12.2-15.1 - openSUSE 13.2 (x86_64): krb5-32bit-1.12.2-15.1 krb5-debuginfo-32bit-1.12.2-15.1 krb5-devel-32bit-1.12.2-15.1 - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.21.1 krb5-client-1.11.3-3.21.1 krb5-client-debuginfo-1.11.3-3.21.1 krb5-debuginfo-1.11.3-3.21.1 krb5-debugsource-1.11.3-3.21.1 krb5-devel-1.11.3-3.21.1 krb5-doc-1.11.3-3.21.1 krb5-mini-1.11.3-3.21.1 krb5-mini-debuginfo-1.11.3-3.21.1 krb5-mini-debugsource-1.11.3-3.21.1 krb5-mini-devel-1.11.3-3.21.1 krb5-plugin-kdb-ldap-1.11.3-3.21.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.21.1 krb5-plugin-preauth-pkinit-1.11.3-3.21.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.21.1 krb5-server-1.11.3-3.21.1 krb5-server-debuginfo-1.11.3-3.21.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.21.1 krb5-debuginfo-32bit-1.11.3-3.21.1 krb5-devel-32bit-1.11.3-3.21.1 References: https://www.suse.com/security/cve/CVE-2015-2695.html https://www.suse.com/security/cve/CVE-2015-2696.html https://www.suse.com/security/cve/CVE-2015-2697.html https://bugzilla.suse.com/952188 https://bugzilla.suse.com/952189 https://bugzilla.suse.com/952190

1 0

openSUSE-SU-2015:1927-1: moderate: Security update for polkit
by opensuse-security＠opensuse.org 06 Nov '15

06 Nov '15

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1927-1 Rating: moderate References: #912889 #933922 #935119 #939246 #943816 #950114 Cross-References: CVE-2015-3218 CVE-2015-3255 CVE-2015-3256 CVE-2015-4625 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: polkit was updated to the 0.113 release, fixing security issues and bugs. Security issues fixed: * Fixes CVE-2015-4625, a local privilege escalation due to predictable authentication session cookie values. Thanks to Tavis Ormandy, Google Project Zero for reporting this issue. For the future, authentication agents are encouraged to use PolkitAgentSession instead of using the D-Bus agent response API directly. (bsc#935119) * Fixes CVE-2015-3256, various memory corruption vulnerabilities in use of the JavaScript interpreter, possibly leading to local privilege escalation. (bsc#943816) * Fixes CVE-2015-3255, a memory corruption vulnerability in handling duplicate action IDs, possibly leading to local privilege escalation. Thanks to Laurent Bigonville for reporting this issue. (bsc#939246) * Fixes CVE-2015-3218, which allowed any local user to crash polkitd. Thanks to Tavis Ormandy, Google Project Zero, for reporting this issue. (bsc#933922) Other issues fixed: * On systemd-213 and later, the "active" state is shared across all sessions of an user, instead of being tracked separately. * pkexec, when not given a program to execute, runs the users shell by default. * Fixed shutdown problems on powerpc64le (bsc#950114) * polkit had a memory leak (bsc#912889) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-711=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libpolkit0-0.113-6.1 libpolkit0-debuginfo-0.113-6.1 polkit-0.113-6.1 polkit-debuginfo-0.113-6.1 polkit-debugsource-0.113-6.1 polkit-devel-0.113-6.1 polkit-devel-debuginfo-0.113-6.1 typelib-1_0-Polkit-1_0-0.113-6.1 - openSUSE Leap 42.1 (x86_64): libpolkit0-32bit-0.113-6.1 libpolkit0-debuginfo-32bit-0.113-6.1 - openSUSE Leap 42.1 (noarch): polkit-doc-0.113-6.1 References: https://www.suse.com/security/cve/CVE-2015-3218.html https://www.suse.com/security/cve/CVE-2015-3255.html https://www.suse.com/security/cve/CVE-2015-3256.html https://www.suse.com/security/cve/CVE-2015-4625.html https://bugzilla.suse.com/912889 https://bugzilla.suse.com/933922 https://bugzilla.suse.com/935119 https://bugzilla.suse.com/939246 https://bugzilla.suse.com/943816 https://bugzilla.suse.com/950114

1 0

openSUSE-SU-2015:1920-1: moderate: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 05 Nov '15

05 Nov '15

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1920-1 Rating: moderate References: #937419 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: wpa_supplicant was updated to fix one security issue. This security issue was fixed: - bsc#937419: Incomplete WPS and P2P NFC NDEF record payload length validation. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-707=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wpa_supplicant-2.0-3.17.1 wpa_supplicant-debuginfo-2.0-3.17.1 wpa_supplicant-debugsource-2.0-3.17.1 wpa_supplicant-gui-2.0-3.17.1 wpa_supplicant-gui-debuginfo-2.0-3.17.1 References: https://bugzilla.suse.com/937419

1 0

openSUSE-SU-2015:1919-1: moderate: Security update for postgresql92
by opensuse-security＠opensuse.org 05 Nov '15

05 Nov '15

openSUSE Security Update: Security update for postgresql92 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1919-1 Rating: moderate References: #949669 Cross-References: CVE-2015-5288 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: postgresql92 was updated to version 9.2.14 to fix one security issue. This security issue was fixed: - CVE-2015-5288: The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allowed attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt (bsc#949669). For the full release notes see: http://www.postgresql.org/docs/current/static/release-9-2-14.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-708=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libecpg6-9.2.14-4.7.1 libecpg6-debuginfo-9.2.14-4.7.1 libpq5-9.2.14-4.7.1 libpq5-debuginfo-9.2.14-4.7.1 postgresql92-9.2.14-4.7.2 postgresql92-contrib-9.2.14-4.7.2 postgresql92-contrib-debuginfo-9.2.14-4.7.2 postgresql92-debuginfo-9.2.14-4.7.2 postgresql92-debugsource-9.2.14-4.7.2 postgresql92-devel-9.2.14-4.7.1 postgresql92-devel-debuginfo-9.2.14-4.7.1 postgresql92-libs-debugsource-9.2.14-4.7.1 postgresql92-plperl-9.2.14-4.7.2 postgresql92-plperl-debuginfo-9.2.14-4.7.2 postgresql92-plpython-9.2.14-4.7.2 postgresql92-plpython-debuginfo-9.2.14-4.7.2 postgresql92-pltcl-9.2.14-4.7.2 postgresql92-pltcl-debuginfo-9.2.14-4.7.2 postgresql92-server-9.2.14-4.7.2 postgresql92-server-debuginfo-9.2.14-4.7.2 - openSUSE 13.1 (x86_64): libecpg6-32bit-9.2.14-4.7.1 libecpg6-debuginfo-32bit-9.2.14-4.7.1 libpq5-32bit-9.2.14-4.7.1 libpq5-debuginfo-32bit-9.2.14-4.7.1 - openSUSE 13.1 (noarch): postgresql92-docs-9.2.14-4.7.2 References: https://www.suse.com/security/cve/CVE-2015-5288.html https://bugzilla.suse.com/949669

1 0

openSUSE-RU-2015:1917-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 05 Nov '15

05 Nov '15

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1917-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: clamav database refresh for november 3rd. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-706=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201511031116-3.1 References:

1 0

openSUSE-SU-2015:1913-1: moderate: Security update for sudo
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1913-1 Rating: moderate References: #917806 Cross-References: CVE-2014-9680 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: sudo was updated to fix one security issue. This security issue was fixed: - CVE-2014-9680: Unsafe handling of TZ environment variable (bsc#917806). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-703=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-703=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): sudo-1.8.10p3-2.7.1 sudo-debuginfo-1.8.10p3-2.7.1 sudo-debugsource-1.8.10p3-2.7.1 sudo-devel-1.8.10p3-2.7.1 sudo-test-1.8.10p3-2.7.1 - openSUSE 13.1 (i586 x86_64): sudo-1.8.10p3-5.16.1 sudo-debuginfo-1.8.10p3-5.16.1 sudo-debugsource-1.8.10p3-5.16.1 sudo-devel-1.8.10p3-5.16.1 References: https://www.suse.com/security/cve/CVE-2014-9680.html https://bugzilla.suse.com/917806

1 0

openSUSE-SU-2015:1912-1: moderate: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1912-1 Rating: moderate References: #937419 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: wpa_supplicant was updated to fix one security issue. This security issue was fixed: - bsc#937419: Incomplete WPS and P2P NFC NDEF record payload length validation. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-700=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wpa_supplicant-2.2-5.10.1 wpa_supplicant-debuginfo-2.2-5.10.1 wpa_supplicant-debugsource-2.2-5.10.1 wpa_supplicant-gui-2.2-5.10.1 wpa_supplicant-gui-debuginfo-2.2-5.10.1 References: https://bugzilla.suse.com/937419

1 0

openSUSE-SU-2015:1911-1: important: Security update for bouncycastle
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1911-1 Rating: important References: #951727 Cross-References: CVE-2015-7940 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bouncycastle was updated to version 1.53 to fix one security issue. This security issue was fixed: - CVE-2015-7940: Invalid curve attack (bsc#951727). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-705=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-705=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-705=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): bouncycastle-1.53-16.1 bouncycastle-javadoc-1.53-16.1 - openSUSE 13.2 (noarch): bouncycastle-1.53-13.3.1 bouncycastle-javadoc-1.53-13.3.1 - openSUSE 13.1 (noarch): bouncycastle-1.53-8.3.1 bouncycastle-javadoc-1.53-8.3.1 References: https://www.suse.com/security/cve/CVE-2015-7940.html https://bugzilla.suse.com/951727

1 0

openSUSE-SU-2015:1910-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1910-1 Rating: moderate References: #903440 #949754 Cross-References: CVE-2015-5218 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: util-linux was updated to fix one security issue. This security issue was fixed: - CVE-2015-5218: Prevent colcrt buffer overflow (bsc#949754). This non-security issue was fixed: - bsc#903440: Calendar "cal" crash with segmentation fault when execute in background. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-702=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-702=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-702=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libblkid-devel-2.25-9.4 libblkid1-2.25-9.4 libblkid1-debuginfo-2.25-9.4 libmount-devel-2.25-9.4 libmount1-2.25-9.4 libmount1-debuginfo-2.25-9.4 libsmartcols-devel-2.25-9.4 libsmartcols1-2.25-9.4 libsmartcols1-debuginfo-2.25-9.4 libuuid-devel-2.25-9.4 libuuid1-2.25-9.4 libuuid1-debuginfo-2.25-9.4 python-libmount-2.25-9.5 python-libmount-debuginfo-2.25-9.5 python-libmount-debugsource-2.25-9.5 util-linux-2.25-9.4 util-linux-debuginfo-2.25-9.4 util-linux-debugsource-2.25-9.4 util-linux-systemd-2.25-9.1 util-linux-systemd-debuginfo-2.25-9.1 util-linux-systemd-debugsource-2.25-9.1 uuidd-2.25-9.1 uuidd-debuginfo-2.25-9.1 - openSUSE Leap 42.1 (x86_64): libblkid-devel-32bit-2.25-9.4 libblkid1-32bit-2.25-9.4 libblkid1-debuginfo-32bit-2.25-9.4 libmount-devel-32bit-2.25-9.4 libmount1-32bit-2.25-9.4 libmount1-debuginfo-32bit-2.25-9.4 libuuid-devel-32bit-2.25-9.4 libuuid1-32bit-2.25-9.4 libuuid1-debuginfo-32bit-2.25-9.4 - openSUSE Leap 42.1 (noarch): util-linux-lang-2.25-9.4 - openSUSE 13.2 (i586 x86_64): libblkid-devel-2.25.1-20.1 libblkid-devel-static-2.25.1-20.1 libblkid1-2.25.1-20.1 libblkid1-debuginfo-2.25.1-20.1 libmount-devel-2.25.1-20.1 libmount-devel-static-2.25.1-20.1 libmount1-2.25.1-20.1 libmount1-debuginfo-2.25.1-20.1 libsmartcols-devel-2.25.1-20.1 libsmartcols-devel-static-2.25.1-20.1 libsmartcols1-2.25.1-20.1 libsmartcols1-debuginfo-2.25.1-20.1 libuuid-devel-2.25.1-20.1 libuuid-devel-static-2.25.1-20.1 libuuid1-2.25.1-20.1 libuuid1-debuginfo-2.25.1-20.1 python-libmount-2.25.1-20.2 python-libmount-debuginfo-2.25.1-20.2 python-libmount-debugsource-2.25.1-20.2 util-linux-2.25.1-20.1 util-linux-debuginfo-2.25.1-20.1 util-linux-debugsource-2.25.1-20.1 util-linux-systemd-2.25.1-20.1 util-linux-systemd-debuginfo-2.25.1-20.1 util-linux-systemd-debugsource-2.25.1-20.1 uuidd-2.25.1-20.1 uuidd-debuginfo-2.25.1-20.1 - openSUSE 13.2 (x86_64): libblkid-devel-32bit-2.25.1-20.1 libblkid1-32bit-2.25.1-20.1 libblkid1-debuginfo-32bit-2.25.1-20.1 libmount-devel-32bit-2.25.1-20.1 libmount1-32bit-2.25.1-20.1 libmount1-debuginfo-32bit-2.25.1-20.1 libuuid-devel-32bit-2.25.1-20.1 libuuid1-32bit-2.25.1-20.1 libuuid1-debuginfo-32bit-2.25.1-20.1 - openSUSE 13.2 (noarch): util-linux-lang-2.25.1-20.1 - openSUSE 13.1 (i586 x86_64): libblkid-devel-2.23.2-34.1 libblkid1-2.23.2-34.1 libblkid1-debuginfo-2.23.2-34.1 libmount-devel-2.23.2-34.1 libmount1-2.23.2-34.1 libmount1-debuginfo-2.23.2-34.1 libuuid-devel-2.23.2-34.1 libuuid1-2.23.2-34.1 libuuid1-debuginfo-2.23.2-34.1 util-linux-2.23.2-34.1 util-linux-debuginfo-2.23.2-34.1 util-linux-debugsource-2.23.2-34.1 uuidd-2.23.2-34.1 uuidd-debuginfo-2.23.2-34.1 - openSUSE 13.1 (x86_64): libblkid-devel-32bit-2.23.2-34.1 libblkid1-32bit-2.23.2-34.1 libblkid1-debuginfo-32bit-2.23.2-34.1 libmount-devel-32bit-2.23.2-34.1 libmount1-32bit-2.23.2-34.1 libmount1-debuginfo-32bit-2.23.2-34.1 libuuid-devel-32bit-2.23.2-34.1 libuuid1-32bit-2.23.2-34.1 libuuid1-debuginfo-32bit-2.23.2-34.1 - openSUSE 13.1 (noarch): util-linux-lang-2.23.2-34.1 References: https://www.suse.com/security/cve/CVE-2015-5218.html https://bugzilla.suse.com/903440 https://bugzilla.suse.com/949754

1 0

openSUSE-SU-2015:1909-1: moderate: Security update for potrace
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for potrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1909-1 Rating: moderate References: #924904 Cross-References: CVE-2013-7437 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: potrace was updated to fix one security issue. This security issue was fixed: - CVE-2013-7437: Multiple integer overflows in potrace 1.11 allowed remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a buffer overflow (bsc#924904). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-704=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-704=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-704=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libpotrace0-1.13-5.1 libpotrace0-debuginfo-1.13-5.1 potrace-1.13-5.1 potrace-debuginfo-1.13-5.1 potrace-debugsource-1.13-5.1 potrace-devel-1.13-5.1 - openSUSE 13.2 (i586 x86_64): libpotrace0-1.13-4.7.1 libpotrace0-debuginfo-1.13-4.7.1 potrace-1.13-4.7.1 potrace-debuginfo-1.13-4.7.1 potrace-debugsource-1.13-4.7.1 potrace-devel-1.13-4.7.1 - openSUSE 13.1 (i586 x86_64): libpotrace0-1.13-2.7.1 libpotrace0-debuginfo-1.13-2.7.1 potrace-1.13-2.7.1 potrace-debuginfo-1.13-2.7.1 potrace-debugsource-1.13-2.7.1 potrace-devel-1.13-2.7.1 References: https://www.suse.com/security/cve/CVE-2013-7437.html https://bugzilla.suse.com/924904

1 0

openSUSE-SU-2015:1907-1: moderate: Security update for postgresql93
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1907-1 Rating: moderate References: #949669 #949670 Cross-References: CVE-2015-5288 CVE-2015-5289 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: postgresql93 was updated to version 9.3.10 to fix two security issues. These security issues were fixed: - CVE-2015-5288: Unchecked JSON input can crash the server (bsc#949669). - CVE-2015-5289: Memory leak in crypt() function (bsc#949670). For the full release notes, please see: http://www.postgresql.org/docs/current/static/release-9-3-10.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-701=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.10-2.7.1 libecpg6-debuginfo-9.3.10-2.7.1 libpq5-9.3.10-2.7.1 libpq5-debuginfo-9.3.10-2.7.1 postgresql93-9.3.10-2.7.1 postgresql93-contrib-9.3.10-2.7.1 postgresql93-contrib-debuginfo-9.3.10-2.7.1 postgresql93-debuginfo-9.3.10-2.7.1 postgresql93-debugsource-9.3.10-2.7.1 postgresql93-devel-9.3.10-2.7.1 postgresql93-devel-debuginfo-9.3.10-2.7.1 postgresql93-libs-debugsource-9.3.10-2.7.1 postgresql93-plperl-9.3.10-2.7.1 postgresql93-plperl-debuginfo-9.3.10-2.7.1 postgresql93-plpython-9.3.10-2.7.1 postgresql93-plpython-debuginfo-9.3.10-2.7.1 postgresql93-pltcl-9.3.10-2.7.1 postgresql93-pltcl-debuginfo-9.3.10-2.7.1 postgresql93-server-9.3.10-2.7.1 postgresql93-server-debuginfo-9.3.10-2.7.1 postgresql93-test-9.3.10-2.7.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.10-2.7.1 libecpg6-debuginfo-32bit-9.3.10-2.7.1 libpq5-32bit-9.3.10-2.7.1 libpq5-debuginfo-32bit-9.3.10-2.7.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.10-2.7.1 References: https://www.suse.com/security/cve/CVE-2015-5288.html https://www.suse.com/security/cve/CVE-2015-5289.html https://bugzilla.suse.com/949669 https://bugzilla.suse.com/949670

1 0

openSUSE-SU-2015:1906-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1906-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4903 CVE-2015-4911 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JAXP (bsc#951376). - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#951376). - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect integrity via unknown vectors related to Security (bsc#951376). - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883 (bsc#951376). - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#951376). - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860 (bsc#951376). - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911 (bsc#951376). - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893 (bsc#951376). - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect availability via vectors related to CORBA (bsc#951376). - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376). - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JGSS (bsc#951376). - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization (bsc#951376). - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911 (bsc#951376). - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376). - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to RMI (bsc#951376). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-697=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.91-24.24.1 java-1_7_0-openjdk-accessibility-1.7.0.91-24.24.1 java-1_7_0-openjdk-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-debugsource-1.7.0.91-24.24.1 java-1_7_0-openjdk-demo-1.7.0.91-24.24.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-devel-1.7.0.91-24.24.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-headless-1.7.0.91-24.24.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-src-1.7.0.91-24.24.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.91-24.24.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://bugzilla.suse.com/951376

1 0

openSUSE-SU-2015:1905-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1905-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to fix 24 security issues. These security issues were fixed: - CVE-2015-4734: A remote user can exploit a flaw in the Embedded JGSS component to partially access data - CVE-2015-4803: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4805: A remote user can exploit a flaw in the Embedded Serialization component to gain elevated privileges - CVE-2015-4806: A remote user can exploit a flaw in the Java SE Embedded Libraries component to partially access and partially modify data - CVE-2015-4835: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4842: A remote user can exploit a flaw in the Embedded JAXP component to partially access data - CVE-2015-4843: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4844: A remote user can exploit a flaw in the Embedded 2D component to gain elevated privileges - CVE-2015-4860: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4872: A remote user can exploit a flaw in the JRockit Security component to partially modify data []. - CVE-2015-4881: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4882: A remote user can exploit a flaw in the Embedded CORBA component to cause partial denial of service conditions - CVE-2015-4883: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4893: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4902: A remote user can exploit a flaw in the Java SE Deployment component to partially modify data - CVE-2015-4903: A remote user can exploit a flaw in the Embedded RMI component to partially access data - CVE-2015-4911: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4810: A local user can exploit a flaw in the Java SE Deployment component to gain elevated privileges - CVE-2015-4840: A remote user can exploit a flaw in the Embedded 2D component to partially access data - CVE-2015-4868: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4901: A remote user can exploit a flaw in the JavaFX component to gain elevated privileges - CVE-2015-4906: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4908: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4916: A remote user can exploit a flaw in the JavaFX component to partially access data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-696=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.65-18.1 java-1_8_0-openjdk-accessibility-1.8.0.65-18.1 java-1_8_0-openjdk-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-debugsource-1.8.0.65-18.1 java-1_8_0-openjdk-demo-1.8.0.65-18.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-devel-1.8.0.65-18.1 java-1_8_0-openjdk-headless-1.8.0.65-18.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-src-1.8.0.65-18.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.65-18.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4868.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4901.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4906.html https://www.suse.com/security/cve/CVE-2015-4908.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-4916.html https://bugzilla.suse.com/951376

1 0

openSUSE-SU-2015:1904-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1904-1 Rating: moderate References: #938840 #952006 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: roundcubemail was updated to version 1.0.7 to fix two security issues. These security issues were fixed: - XSS issue in drag-n-drop file uploads - Disallow unwanted access on files in the file system. The apache2 configuration file for roundcubemail allowed access to the roundcubemail/bin folder and possibly /logs, /config and /temp, if these were not symlinks (this was only the case when the configuration was manually changed) (bsc#952006) The package comes with a fixed configuration. If you modified the file "/etc/apache2/conf.d/roundcubemail.conf", please replace it with the configuration "roundcubemail.conf.rpmnew" and reapply your changes. After that, a restart of apache2 is requried. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-699=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-699=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.7-14.1 - openSUSE 13.1 (noarch): roundcubemail-1.0.7-2.24.1 References: https://bugzilla.suse.com/938840 https://bugzilla.suse.com/952006

1 0

openSUSE-SU-2015:1903-1: Security update for audiofile
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for audiofile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1903-1 Rating: low References: #949399 Cross-References: CVE-2015-7747 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: audiofile was updated to fix one security issue. This security issue was fixed: - CVE-2015-7747: Overflow when changing both number of channels and sample format (bsc#949399). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-698=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-698=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-698=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): audiofile-0.3.6-9.1 audiofile-debuginfo-0.3.6-9.1 audiofile-debugsource-0.3.6-9.1 audiofile-devel-0.3.6-9.1 audiofile-doc-0.3.6-9.1 libaudiofile1-0.3.6-9.1 libaudiofile1-debuginfo-0.3.6-9.1 - openSUSE Leap 42.1 (x86_64): audiofile-devel-32bit-0.3.6-9.1 libaudiofile1-32bit-0.3.6-9.1 libaudiofile1-debuginfo-32bit-0.3.6-9.1 - openSUSE 13.2 (i586 x86_64): audiofile-0.3.6-6.3.1 audiofile-debuginfo-0.3.6-6.3.1 audiofile-debugsource-0.3.6-6.3.1 audiofile-devel-0.3.6-6.3.1 audiofile-doc-0.3.6-6.3.1 libaudiofile1-0.3.6-6.3.1 libaudiofile1-debuginfo-0.3.6-6.3.1 - openSUSE 13.2 (x86_64): audiofile-devel-32bit-0.3.6-6.3.1 libaudiofile1-32bit-0.3.6-6.3.1 libaudiofile1-debuginfo-32bit-0.3.6-6.3.1 - openSUSE 13.1 (i586 x86_64): audiofile-0.3.6-2.3.1 audiofile-debuginfo-0.3.6-2.3.1 audiofile-debugsource-0.3.6-2.3.1 audiofile-devel-0.3.6-2.3.1 audiofile-doc-0.3.6-2.3.1 libaudiofile1-0.3.6-2.3.1 libaudiofile1-debuginfo-0.3.6-2.3.1 - openSUSE 13.1 (x86_64): audiofile-devel-32bit-0.3.6-2.3.1 libaudiofile1-32bit-0.3.6-2.3.1 libaudiofile1-debuginfo-32bit-0.3.6-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-7747.html https://bugzilla.suse.com/949399

1 0

openSUSE-SU-2015:1902-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1902-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4903 CVE-2015-4911 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JAXP (bsc#951376). - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#951376). - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect integrity via unknown vectors related to Security (bsc#951376). - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883 (bsc#951376). - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#951376). - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860 (bsc#951376). - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911 (bsc#951376). - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893 (bsc#951376). - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect availability via vectors related to CORBA (bsc#951376). - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376). - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JGSS (bsc#951376). - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization (bsc#951376). - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911 (bsc#951376). - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376). - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to RMI (bsc#951376). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-695=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.91-13.1 java-1_7_0-openjdk-accessibility-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-debugsource-1.7.0.91-13.1 java-1_7_0-openjdk-demo-1.7.0.91-13.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-devel-1.7.0.91-13.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-headless-1.7.0.91-13.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-src-1.7.0.91-13.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.91-13.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://bugzilla.suse.com/951376

1 0

openSUSE-RU-2015:1901-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1901-1 Rating: moderate References: #899985 #916035 #925276 #927309 #928459 #939142 #940239 #941611 #941964 #942278 #947542 #948423 #950333 #951315 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This recommended update provides version 0.6.27 of wicked: - vesion 0.6.27 - spec: disabled teamd support for SLE-12-GA/13.2, not available - nanny: fix policy file reading and objects references (boo#916035) - ovs: use --may-exist option in add-port (bsc#951315) commands to avoid error messages when the port is already in the db. - netconfig: do not refresh unrelated details in supplicants - service: fixed wicked client and nanny dependencies (bsc#950333). - service: restart wickedd* on dbus restart (bsc#941964) - fsm: do not follow link-up checks on configured master devices not involved in the current ifup operation (bsc#948423). - client: added more comfortable "wicked test dhcp[46]" commands executing the wickedd-dhcp[46] in their --test mode (bsc#942278) - version 0.6.26 - nanny: add link device references to policy match (bsc#941611) This causes, that nanny checks and waits until the configuration for link references is applied by ifup (master device worker is available) in order to not start managing ports/slaves and fail on unresolvable requirements with "document error" first. Unavailable reference matches caused a timing race, where nanny omits to enslave ports into master (e.g. a dummy into ovsbr), but was not limited to ovs setups. - dhcp4: fix to request offer by default in --test (bsc#942278) - teamd: adjust permissions of the teamd interface config to be owned by teamd user if available and to always re-read dbus busname from the service file (bsc#947542) - version 0.6.25 - compat: read complete sysctl file set (bsc#928459) - wireless: fixed to parse/format hex escapes in essid (bsc#928459) - version 0.6.24 - auto4: initial autoip and dhcp4 fallback fix (bsc#899985) - ethtool: update to the most recent ethtool.h, fixed advertised mode and flags (bsc#927309) - dhcp4: verify received client-id, accept hex encoded id - ovs: fixes for ovs bridge handling - make: fixed to add linux header copies as noinst - version 0.6.23 - ovs: initial openvswitch bridge support (fate#318840) - team: fix segfault on discovery failure - nanny: register device object also on device-up event - version 0.6.22 - fsm: do not run post-up scripts when leases defer (bsc#940239) - team: configurable teamd support and ctl detection (fate#318389) [- 0001-teamd-create-teamd-run-directory-when-missed.patch] - Add 0001-teamd-create-teamd-run-directory-when-missed.patch: Make sure /run/teamd directory is created on config generation. - version 0.6.21 - team: initial team device support (fate#318389) - ifstatus: fixed error return code and quiet option (bsc#939142) - version 0.6.20 - spec: ensure nanny use is disabled on SLE-12-GA - ifconfig: handle link up of externally enslaved devices - ifcfg: generate link master from master config, added MASTER_DEVICE variable - fsm: master/slave transition dependency and state check fixes - fsm: improve subordinate device relation updating and logging - fsm: reference count config nodes to avoid memleaks - ethtool: fix option tables terminator (bsc#925276) - scripts: fixed typo breaking wicked scheme scripts - sysfs: fixed memleak while reading device path - client: client: config parsing, origin processing, root-directory cleanup and memory leak fixes. - xml: fixes to memory leaks, location functions cleanup - firmware: properly extract discovery type and path Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-693=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libwicked-0-6-0.6.27-21.1 libwicked-0-6-debuginfo-0.6.27-21.1 wicked-0.6.27-21.1 wicked-debuginfo-0.6.27-21.1 wicked-debugsource-0.6.27-21.1 wicked-service-0.6.27-21.1 References: https://bugzilla.suse.com/899985 https://bugzilla.suse.com/916035 https://bugzilla.suse.com/925276 https://bugzilla.suse.com/927309 https://bugzilla.suse.com/928459 https://bugzilla.suse.com/939142 https://bugzilla.suse.com/940239 https://bugzilla.suse.com/941611 https://bugzilla.suse.com/941964 https://bugzilla.suse.com/942278 https://bugzilla.suse.com/947542 https://bugzilla.suse.com/948423 https://bugzilla.suse.com/950333 https://bugzilla.suse.com/951315

1 0

openSUSE-RU-2015:1900-1: moderate: Recommended update for bumblebee
by maintenance＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Recommended Update: Recommended update for bumblebee ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1900-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for bumblebee fixes the following issue: - Added patch to correctly load/unload nvidia-uvm and unload nvidia-modeset: * nvidia-uvm-modeset-support.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-694=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bumblebee-3.2.1-2.3.1 bumblebee-debuginfo-3.2.1-2.3.1 bumblebee-debugsource-3.2.1-2.3.1 References:

1 0

openSUSE-RU-2015:1891-1: moderate: Recommended update for the Software Stack
by maintenance＠opensuse.org 03 Nov '15

03 Nov '15

openSUSE Recommended Update: Recommended update for the Software Stack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1891-1 Rating: moderate References: #941453 #941463 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for the Software Stack fixes the following issues: - libzypp: + Update translations + Resolver allow tuning DUP mode solver flags (FATE#319128) + Fix setting dup_allow* solver options (bnc#941463) + Don't make zypper encode {} around repo vars (bnc#941453) + Support for MIPS architectures - zypper: + Update translations + Options to allow vendor locking for zypper dup (FATE#319128) + Fix handling of wchar errors + Add git-like subcommand support for zypper. * Zypper subcommands are standalone executables that live in the zypper exec dir or are available in your $PATH (see zypper(8)). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-692=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libzypp-14.40.2-29.2 libzypp-debuginfo-14.40.2-29.2 libzypp-debugsource-14.40.2-29.2 libzypp-devel-14.40.2-29.2 libzypp-devel-doc-14.40.2-29.2 zypper-1.11.34-25.2 zypper-debuginfo-1.11.34-25.2 zypper-debugsource-1.11.34-25.2 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.34-25.2 zypper-log-1.11.34-25.2 References: https://bugzilla.suse.com/941453 https://bugzilla.suse.com/941463

1 0

openSUSE-SU-2015:1887-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 02 Nov '15

02 Nov '15

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1887-1 Rating: moderate References: Cross-References: CVE-2015-1233 CVE-2015-1234 CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: - Update to Chromium 42.0.2311.90 * A number of new apps, extension and Web Platform APIs (including the Push API!) * Lots of under the hood changes for stability and performance * Security fixes, including: - CVE-2015-1235: Cross-origin-bypass in HTML parser - CVE-2015-1236: Cross-origin-bypass in Blink - CVE-2015-1237: Use-after-free in IPC - CVE-2015-1238: Out-of-bounds write in Skia - CVE-2015-1240: Out-of-bounds read in WebGL - CVE-2015-1241: Tap-Jacking - CVE-2015-1242: Type confusion in V8 - CVE-2015-1244: HSTS bypass in WebSockets - CVE-2015-1245: Use-after-free in PDFium - CVE-2015-1246: Out-of-bounds read in Blink - CVE-2015-1247: Scheme issues in OpenSearch - CVE-2015-1248: SafeBrowsing bypass - CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed - Update to Chromium 41.0.2272.118 Security fixes: * CVE-2015-1233: A combination of V8, Gamepad and IPC bugs that can lead to remote code execution outside of the sandbox * CVE-2015-1234: Buffer overflow via race condition in GPU Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2015-351=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-42.0.2311.135-5.1 chromium-42.0.2311.135-5.1 chromium-desktop-gnome-42.0.2311.135-5.1 chromium-desktop-kde-42.0.2311.135-5.1 chromium-ffmpegsumo-42.0.2311.135-5.1 References: https://www.suse.com/security/cve/CVE-2015-1233.html https://www.suse.com/security/cve/CVE-2015-1234.html https://www.suse.com/security/cve/CVE-2015-1235.html https://www.suse.com/security/cve/CVE-2015-1236.html https://www.suse.com/security/cve/CVE-2015-1237.html https://www.suse.com/security/cve/CVE-2015-1238.html https://www.suse.com/security/cve/CVE-2015-1240.html https://www.suse.com/security/cve/CVE-2015-1241.html https://www.suse.com/security/cve/CVE-2015-1242.html https://www.suse.com/security/cve/CVE-2015-1244.html https://www.suse.com/security/cve/CVE-2015-1245.html https://www.suse.com/security/cve/CVE-2015-1246.html https://www.suse.com/security/cve/CVE-2015-1247.html https://www.suse.com/security/cve/CVE-2015-1248.html https://www.suse.com/security/cve/CVE-2015-1249.html

1 0