November 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1907-1: moderate: Security update for postgresql93
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1907-1 Rating: moderate References: #949669 #949670 Cross-References: CVE-2015-5288 CVE-2015-5289 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: postgresql93 was updated to version 9.3.10 to fix two security issues. These security issues were fixed: - CVE-2015-5288: Unchecked JSON input can crash the server (bsc#949669). - CVE-2015-5289: Memory leak in crypt() function (bsc#949670). For the full release notes, please see: http://www.postgresql.org/docs/current/static/release-9-3-10.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-701=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.10-2.7.1 libecpg6-debuginfo-9.3.10-2.7.1 libpq5-9.3.10-2.7.1 libpq5-debuginfo-9.3.10-2.7.1 postgresql93-9.3.10-2.7.1 postgresql93-contrib-9.3.10-2.7.1 postgresql93-contrib-debuginfo-9.3.10-2.7.1 postgresql93-debuginfo-9.3.10-2.7.1 postgresql93-debugsource-9.3.10-2.7.1 postgresql93-devel-9.3.10-2.7.1 postgresql93-devel-debuginfo-9.3.10-2.7.1 postgresql93-libs-debugsource-9.3.10-2.7.1 postgresql93-plperl-9.3.10-2.7.1 postgresql93-plperl-debuginfo-9.3.10-2.7.1 postgresql93-plpython-9.3.10-2.7.1 postgresql93-plpython-debuginfo-9.3.10-2.7.1 postgresql93-pltcl-9.3.10-2.7.1 postgresql93-pltcl-debuginfo-9.3.10-2.7.1 postgresql93-server-9.3.10-2.7.1 postgresql93-server-debuginfo-9.3.10-2.7.1 postgresql93-test-9.3.10-2.7.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.10-2.7.1 libecpg6-debuginfo-32bit-9.3.10-2.7.1 libpq5-32bit-9.3.10-2.7.1 libpq5-debuginfo-32bit-9.3.10-2.7.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.10-2.7.1 References: https://www.suse.com/security/cve/CVE-2015-5288.html https://www.suse.com/security/cve/CVE-2015-5289.html https://bugzilla.suse.com/949669 https://bugzilla.suse.com/949670

1 0

openSUSE-SU-2015:1906-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1906-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4903 CVE-2015-4911 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JAXP (bsc#951376). - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#951376). - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect integrity via unknown vectors related to Security (bsc#951376). - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883 (bsc#951376). - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#951376). - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860 (bsc#951376). - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911 (bsc#951376). - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893 (bsc#951376). - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect availability via vectors related to CORBA (bsc#951376). - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376). - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JGSS (bsc#951376). - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization (bsc#951376). - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911 (bsc#951376). - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376). - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to RMI (bsc#951376). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-697=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.91-24.24.1 java-1_7_0-openjdk-accessibility-1.7.0.91-24.24.1 java-1_7_0-openjdk-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-debugsource-1.7.0.91-24.24.1 java-1_7_0-openjdk-demo-1.7.0.91-24.24.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-devel-1.7.0.91-24.24.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-headless-1.7.0.91-24.24.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-24.24.1 java-1_7_0-openjdk-src-1.7.0.91-24.24.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.91-24.24.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://bugzilla.suse.com/951376

1 0

openSUSE-SU-2015:1905-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1905-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to fix 24 security issues. These security issues were fixed: - CVE-2015-4734: A remote user can exploit a flaw in the Embedded JGSS component to partially access data - CVE-2015-4803: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4805: A remote user can exploit a flaw in the Embedded Serialization component to gain elevated privileges - CVE-2015-4806: A remote user can exploit a flaw in the Java SE Embedded Libraries component to partially access and partially modify data - CVE-2015-4835: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4842: A remote user can exploit a flaw in the Embedded JAXP component to partially access data - CVE-2015-4843: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4844: A remote user can exploit a flaw in the Embedded 2D component to gain elevated privileges - CVE-2015-4860: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4872: A remote user can exploit a flaw in the JRockit Security component to partially modify data []. - CVE-2015-4881: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4882: A remote user can exploit a flaw in the Embedded CORBA component to cause partial denial of service conditions - CVE-2015-4883: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4893: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4902: A remote user can exploit a flaw in the Java SE Deployment component to partially modify data - CVE-2015-4903: A remote user can exploit a flaw in the Embedded RMI component to partially access data - CVE-2015-4911: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4810: A local user can exploit a flaw in the Java SE Deployment component to gain elevated privileges - CVE-2015-4840: A remote user can exploit a flaw in the Embedded 2D component to partially access data - CVE-2015-4868: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4901: A remote user can exploit a flaw in the JavaFX component to gain elevated privileges - CVE-2015-4906: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4908: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4916: A remote user can exploit a flaw in the JavaFX component to partially access data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-696=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.65-18.1 java-1_8_0-openjdk-accessibility-1.8.0.65-18.1 java-1_8_0-openjdk-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-debugsource-1.8.0.65-18.1 java-1_8_0-openjdk-demo-1.8.0.65-18.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-devel-1.8.0.65-18.1 java-1_8_0-openjdk-headless-1.8.0.65-18.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.65-18.1 java-1_8_0-openjdk-src-1.8.0.65-18.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.65-18.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4868.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4901.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4906.html https://www.suse.com/security/cve/CVE-2015-4908.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-4916.html https://bugzilla.suse.com/951376

1 0

openSUSE-SU-2015:1904-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1904-1 Rating: moderate References: #938840 #952006 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: roundcubemail was updated to version 1.0.7 to fix two security issues. These security issues were fixed: - XSS issue in drag-n-drop file uploads - Disallow unwanted access on files in the file system. The apache2 configuration file for roundcubemail allowed access to the roundcubemail/bin folder and possibly /logs, /config and /temp, if these were not symlinks (this was only the case when the configuration was manually changed) (bsc#952006) The package comes with a fixed configuration. If you modified the file "/etc/apache2/conf.d/roundcubemail.conf", please replace it with the configuration "roundcubemail.conf.rpmnew" and reapply your changes. After that, a restart of apache2 is requried. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-699=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-699=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.7-14.1 - openSUSE 13.1 (noarch): roundcubemail-1.0.7-2.24.1 References: https://bugzilla.suse.com/938840 https://bugzilla.suse.com/952006

1 0

openSUSE-SU-2015:1903-1: Security update for audiofile
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for audiofile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1903-1 Rating: low References: #949399 Cross-References: CVE-2015-7747 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: audiofile was updated to fix one security issue. This security issue was fixed: - CVE-2015-7747: Overflow when changing both number of channels and sample format (bsc#949399). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-698=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-698=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-698=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): audiofile-0.3.6-9.1 audiofile-debuginfo-0.3.6-9.1 audiofile-debugsource-0.3.6-9.1 audiofile-devel-0.3.6-9.1 audiofile-doc-0.3.6-9.1 libaudiofile1-0.3.6-9.1 libaudiofile1-debuginfo-0.3.6-9.1 - openSUSE Leap 42.1 (x86_64): audiofile-devel-32bit-0.3.6-9.1 libaudiofile1-32bit-0.3.6-9.1 libaudiofile1-debuginfo-32bit-0.3.6-9.1 - openSUSE 13.2 (i586 x86_64): audiofile-0.3.6-6.3.1 audiofile-debuginfo-0.3.6-6.3.1 audiofile-debugsource-0.3.6-6.3.1 audiofile-devel-0.3.6-6.3.1 audiofile-doc-0.3.6-6.3.1 libaudiofile1-0.3.6-6.3.1 libaudiofile1-debuginfo-0.3.6-6.3.1 - openSUSE 13.2 (x86_64): audiofile-devel-32bit-0.3.6-6.3.1 libaudiofile1-32bit-0.3.6-6.3.1 libaudiofile1-debuginfo-32bit-0.3.6-6.3.1 - openSUSE 13.1 (i586 x86_64): audiofile-0.3.6-2.3.1 audiofile-debuginfo-0.3.6-2.3.1 audiofile-debugsource-0.3.6-2.3.1 audiofile-devel-0.3.6-2.3.1 audiofile-doc-0.3.6-2.3.1 libaudiofile1-0.3.6-2.3.1 libaudiofile1-debuginfo-0.3.6-2.3.1 - openSUSE 13.1 (x86_64): audiofile-devel-32bit-0.3.6-2.3.1 libaudiofile1-32bit-0.3.6-2.3.1 libaudiofile1-debuginfo-32bit-0.3.6-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-7747.html https://bugzilla.suse.com/949399

1 0

openSUSE-SU-2015:1902-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1902-1 Rating: important References: #951376 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4903 CVE-2015-4911 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4843: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4842: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JAXP (bsc#951376). - CVE-2015-4840: Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#951376). - CVE-2015-4872: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect integrity via unknown vectors related to Security (bsc#951376). - CVE-2015-4860: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883 (bsc#951376). - CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#951376). - CVE-2015-4883: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860 (bsc#951376). - CVE-2015-4893: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911 (bsc#951376). - CVE-2015-4911: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893 (bsc#951376). - CVE-2015-4882: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect availability via vectors related to CORBA (bsc#951376). - CVE-2015-4881: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835 (bsc#951376). - CVE-2015-4734: Unspecified vulnerability in Oracle Java SE 6u101, 7u85 and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to JGSS (bsc#951376). - CVE-2015-4806: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries (bsc#951376). - CVE-2015-4805: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization (bsc#951376). - CVE-2015-4803: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allowed remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911 (bsc#951376). - CVE-2015-4835: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881 (bsc#951376). - CVE-2015-4903: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allowed remote attackers to affect confidentiality via vectors related to RMI (bsc#951376). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-695=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.91-13.1 java-1_7_0-openjdk-accessibility-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.91-13.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-debugsource-1.7.0.91-13.1 java-1_7_0-openjdk-demo-1.7.0.91-13.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-devel-1.7.0.91-13.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-headless-1.7.0.91-13.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.91-13.1 java-1_7_0-openjdk-src-1.7.0.91-13.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.91-13.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4911.html https://bugzilla.suse.com/951376

1 0

openSUSE-RU-2015:1901-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1901-1 Rating: moderate References: #899985 #916035 #925276 #927309 #928459 #939142 #940239 #941611 #941964 #942278 #947542 #948423 #950333 #951315 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This recommended update provides version 0.6.27 of wicked: - vesion 0.6.27 - spec: disabled teamd support for SLE-12-GA/13.2, not available - nanny: fix policy file reading and objects references (boo#916035) - ovs: use --may-exist option in add-port (bsc#951315) commands to avoid error messages when the port is already in the db. - netconfig: do not refresh unrelated details in supplicants - service: fixed wicked client and nanny dependencies (bsc#950333). - service: restart wickedd* on dbus restart (bsc#941964) - fsm: do not follow link-up checks on configured master devices not involved in the current ifup operation (bsc#948423). - client: added more comfortable "wicked test dhcp[46]" commands executing the wickedd-dhcp[46] in their --test mode (bsc#942278) - version 0.6.26 - nanny: add link device references to policy match (bsc#941611) This causes, that nanny checks and waits until the configuration for link references is applied by ifup (master device worker is available) in order to not start managing ports/slaves and fail on unresolvable requirements with "document error" first. Unavailable reference matches caused a timing race, where nanny omits to enslave ports into master (e.g. a dummy into ovsbr), but was not limited to ovs setups. - dhcp4: fix to request offer by default in --test (bsc#942278) - teamd: adjust permissions of the teamd interface config to be owned by teamd user if available and to always re-read dbus busname from the service file (bsc#947542) - version 0.6.25 - compat: read complete sysctl file set (bsc#928459) - wireless: fixed to parse/format hex escapes in essid (bsc#928459) - version 0.6.24 - auto4: initial autoip and dhcp4 fallback fix (bsc#899985) - ethtool: update to the most recent ethtool.h, fixed advertised mode and flags (bsc#927309) - dhcp4: verify received client-id, accept hex encoded id - ovs: fixes for ovs bridge handling - make: fixed to add linux header copies as noinst - version 0.6.23 - ovs: initial openvswitch bridge support (fate#318840) - team: fix segfault on discovery failure - nanny: register device object also on device-up event - version 0.6.22 - fsm: do not run post-up scripts when leases defer (bsc#940239) - team: configurable teamd support and ctl detection (fate#318389) [- 0001-teamd-create-teamd-run-directory-when-missed.patch] - Add 0001-teamd-create-teamd-run-directory-when-missed.patch: Make sure /run/teamd directory is created on config generation. - version 0.6.21 - team: initial team device support (fate#318389) - ifstatus: fixed error return code and quiet option (bsc#939142) - version 0.6.20 - spec: ensure nanny use is disabled on SLE-12-GA - ifconfig: handle link up of externally enslaved devices - ifcfg: generate link master from master config, added MASTER_DEVICE variable - fsm: master/slave transition dependency and state check fixes - fsm: improve subordinate device relation updating and logging - fsm: reference count config nodes to avoid memleaks - ethtool: fix option tables terminator (bsc#925276) - scripts: fixed typo breaking wicked scheme scripts - sysfs: fixed memleak while reading device path - client: client: config parsing, origin processing, root-directory cleanup and memory leak fixes. - xml: fixes to memory leaks, location functions cleanup - firmware: properly extract discovery type and path Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-693=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libwicked-0-6-0.6.27-21.1 libwicked-0-6-debuginfo-0.6.27-21.1 wicked-0.6.27-21.1 wicked-debuginfo-0.6.27-21.1 wicked-debugsource-0.6.27-21.1 wicked-service-0.6.27-21.1 References: https://bugzilla.suse.com/899985 https://bugzilla.suse.com/916035 https://bugzilla.suse.com/925276 https://bugzilla.suse.com/927309 https://bugzilla.suse.com/928459 https://bugzilla.suse.com/939142 https://bugzilla.suse.com/940239 https://bugzilla.suse.com/941611 https://bugzilla.suse.com/941964 https://bugzilla.suse.com/942278 https://bugzilla.suse.com/947542 https://bugzilla.suse.com/948423 https://bugzilla.suse.com/950333 https://bugzilla.suse.com/951315

1 0

openSUSE-RU-2015:1900-1: moderate: Recommended update for bumblebee
by maintenance＠opensuse.org 04 Nov '15

04 Nov '15

openSUSE Recommended Update: Recommended update for bumblebee ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1900-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for bumblebee fixes the following issue: - Added patch to correctly load/unload nvidia-uvm and unload nvidia-modeset: * nvidia-uvm-modeset-support.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-694=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bumblebee-3.2.1-2.3.1 bumblebee-debuginfo-3.2.1-2.3.1 bumblebee-debugsource-3.2.1-2.3.1 References:

1 0

openSUSE-RU-2015:1891-1: moderate: Recommended update for the Software Stack
by maintenance＠opensuse.org 03 Nov '15

03 Nov '15

openSUSE Recommended Update: Recommended update for the Software Stack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1891-1 Rating: moderate References: #941453 #941463 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for the Software Stack fixes the following issues: - libzypp: + Update translations + Resolver allow tuning DUP mode solver flags (FATE#319128) + Fix setting dup_allow* solver options (bnc#941463) + Don't make zypper encode {} around repo vars (bnc#941453) + Support for MIPS architectures - zypper: + Update translations + Options to allow vendor locking for zypper dup (FATE#319128) + Fix handling of wchar errors + Add git-like subcommand support for zypper. * Zypper subcommands are standalone executables that live in the zypper exec dir or are available in your $PATH (see zypper(8)). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-692=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libzypp-14.40.2-29.2 libzypp-debuginfo-14.40.2-29.2 libzypp-debugsource-14.40.2-29.2 libzypp-devel-14.40.2-29.2 libzypp-devel-doc-14.40.2-29.2 zypper-1.11.34-25.2 zypper-debuginfo-1.11.34-25.2 zypper-debugsource-1.11.34-25.2 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.34-25.2 zypper-log-1.11.34-25.2 References: https://bugzilla.suse.com/941453 https://bugzilla.suse.com/941463

1 0

openSUSE-SU-2015:1887-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 02 Nov '15

02 Nov '15

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1887-1 Rating: moderate References: Cross-References: CVE-2015-1233 CVE-2015-1234 CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: - Update to Chromium 42.0.2311.90 * A number of new apps, extension and Web Platform APIs (including the Push API!) * Lots of under the hood changes for stability and performance * Security fixes, including: - CVE-2015-1235: Cross-origin-bypass in HTML parser - CVE-2015-1236: Cross-origin-bypass in Blink - CVE-2015-1237: Use-after-free in IPC - CVE-2015-1238: Out-of-bounds write in Skia - CVE-2015-1240: Out-of-bounds read in WebGL - CVE-2015-1241: Tap-Jacking - CVE-2015-1242: Type confusion in V8 - CVE-2015-1244: HSTS bypass in WebSockets - CVE-2015-1245: Use-after-free in PDFium - CVE-2015-1246: Out-of-bounds read in Blink - CVE-2015-1247: Scheme issues in OpenSearch - CVE-2015-1248: SafeBrowsing bypass - CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed - Update to Chromium 41.0.2272.118 Security fixes: * CVE-2015-1233: A combination of V8, Gamepad and IPC bugs that can lead to remote code execution outside of the sandbox * CVE-2015-1234: Buffer overflow via race condition in GPU Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2015-351=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-42.0.2311.135-5.1 chromium-42.0.2311.135-5.1 chromium-desktop-gnome-42.0.2311.135-5.1 chromium-desktop-kde-42.0.2311.135-5.1 chromium-ffmpegsumo-42.0.2311.135-5.1 References: https://www.suse.com/security/cve/CVE-2015-1233.html https://www.suse.com/security/cve/CVE-2015-1234.html https://www.suse.com/security/cve/CVE-2015-1235.html https://www.suse.com/security/cve/CVE-2015-1236.html https://www.suse.com/security/cve/CVE-2015-1237.html https://www.suse.com/security/cve/CVE-2015-1238.html https://www.suse.com/security/cve/CVE-2015-1240.html https://www.suse.com/security/cve/CVE-2015-1241.html https://www.suse.com/security/cve/CVE-2015-1242.html https://www.suse.com/security/cve/CVE-2015-1244.html https://www.suse.com/security/cve/CVE-2015-1245.html https://www.suse.com/security/cve/CVE-2015-1246.html https://www.suse.com/security/cve/CVE-2015-1247.html https://www.suse.com/security/cve/CVE-2015-1248.html https://www.suse.com/security/cve/CVE-2015-1249.html

1 0