May 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0890-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 May '15

15 May '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0890-1 Rating: important References: #930677 Cross-References: CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: The Adobe flash-player package was updated to version 11.2.202.460 to fix several security issues. The following vulnerabilities were fixed (bsc#930677): * APSB15-09, CVE-2015-3044, CVE-2015-3077, CVE-2015-3078, CVE-2015-3079, CVE-2015-3080, CVE-2015-3081, CVE-2015-3082, CVE-2015-3083, CVE-2015-3084, CVE-2015-3085, CVE-2015-3086, CVE-2015-3087, CVE-2015-3088, CVE-2015-3089, CVE-2015-3090, CVE-2015-3091, CVE-2015-3092, CVE-2015-3093 More information can be found at the Adobe Security Bulletin APSB15-09: https://helpx.adobe.com/security/products/flash-player/apsb15-09.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.460-161.1 flash-player-gnome-11.2.202.460-161.1 flash-player-kde4-11.2.202.460-161.1 References: https://www.suse.com/security/cve/CVE-2015-3044.html https://www.suse.com/security/cve/CVE-2015-3077.html https://www.suse.com/security/cve/CVE-2015-3078.html https://www.suse.com/security/cve/CVE-2015-3079.html https://www.suse.com/security/cve/CVE-2015-3080.html https://www.suse.com/security/cve/CVE-2015-3081.html https://www.suse.com/security/cve/CVE-2015-3082.html https://www.suse.com/security/cve/CVE-2015-3083.html https://www.suse.com/security/cve/CVE-2015-3084.html https://www.suse.com/security/cve/CVE-2015-3085.html https://www.suse.com/security/cve/CVE-2015-3086.html https://www.suse.com/security/cve/CVE-2015-3087.html https://www.suse.com/security/cve/CVE-2015-3088.html https://www.suse.com/security/cve/CVE-2015-3089.html https://www.suse.com/security/cve/CVE-2015-3090.html https://www.suse.com/security/cve/CVE-2015-3091.html https://www.suse.com/security/cve/CVE-2015-3092.html https://www.suse.com/security/cve/CVE-2015-3093.html https://bugzilla.suse.com/930677

1 0

openSUSE-RU-2015:0883-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 15 May '15

15 May '15

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0883-1 Rating: moderate References: #929685 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update fixes the following issue with tigervnc: - fix building on armv7l (bnc#929685) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-362=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.32.1 tigervnc-debuginfo-1.4.1-6.32.1 tigervnc-debugsource-1.4.1-6.32.1 xorg-x11-Xvnc-1.4.1-6.32.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.32.1 References: https://bugzilla.suse.com/929685

1 0

openSUSE-SU-2015:0861-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0861-1 Rating: moderate References: #928533 Cross-References: CVE-2015-3153 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: curl was updated to 7.42.1 to fix one security issue. The following vulnerability was fixed: * CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies (bnc#928533) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-356=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-356=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): curl-7.42.1-11.1 curl-debuginfo-7.42.1-11.1 curl-debugsource-7.42.1-11.1 libcurl-devel-7.42.1-11.1 libcurl4-7.42.1-11.1 libcurl4-debuginfo-7.42.1-11.1 - openSUSE 13.2 (x86_64): libcurl-devel-32bit-7.42.1-11.1 libcurl4-32bit-7.42.1-11.1 libcurl4-debuginfo-32bit-7.42.1-11.1 - openSUSE 13.1 (i586 x86_64): curl-7.42.1-2.42.1 curl-debuginfo-7.42.1-2.42.1 curl-debugsource-7.42.1-2.42.1 libcurl-devel-7.42.1-2.42.1 libcurl4-7.42.1-2.42.1 libcurl4-debuginfo-7.42.1-2.42.1 - openSUSE 13.1 (x86_64): libcurl-devel-32bit-7.42.1-2.42.1 libcurl4-32bit-7.42.1-2.42.1 libcurl4-debuginfo-32bit-7.42.1-2.42.1 References: https://www.suse.com/security/cve/CVE-2015-3153.html https://bugzilla.suse.com/928533

1 0

openSUSE-SU-2015:0860-1: Security update for libssh
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0860-1 Rating: low References: #928323 Cross-References: CVE-2015-3146 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libssh was updated to fix one security issue. The following vulnerability was fixed: * CVE-2015-3146: Specially crafted packages inserted into a connection could have lead to a client or server process crash via a null pointer dereference. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-355=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-355=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libssh-debugsource-0.6.3-2.7.1 libssh-devel-0.6.3-2.7.1 libssh-devel-doc-0.6.3-2.7.1 libssh4-0.6.3-2.7.1 libssh4-debuginfo-0.6.3-2.7.1 - openSUSE 13.2 (x86_64): libssh4-32bit-0.6.3-2.7.1 libssh4-debuginfo-32bit-0.6.3-2.7.1 - openSUSE 13.1 (i586 x86_64): libssh-debugsource-0.5.5-2.15.1 libssh-devel-0.5.5-2.15.1 libssh-devel-doc-0.5.5-2.15.1 libssh4-0.5.5-2.15.1 libssh4-debuginfo-0.5.5-2.15.1 - openSUSE 13.1 (x86_64): libssh4-32bit-0.5.5-2.15.1 libssh4-debuginfo-32bit-0.5.5-2.15.1 References: https://www.suse.com/security/cve/CVE-2015-3146.html https://bugzilla.suse.com/928323

1 0

openSUSE-SU-2015:0859-1: moderate: Security update for libreoffice
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0859-1 Rating: moderate References: #881214 #919409 Cross-References: CVE-2015-1774 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: LibreOffice was updated to 4.3.7 to fix one security issue and a number of bugs. The following vulnerability was fixed: * CVE-2015-1774: Specially crafted HWP documents could have led to an application crash or possibly the execution of arbitrary code (boo#919409) The following non-security bugs were fixed: * boo#881214: Failed to launch reprots wizard in libreoffice-base with error "java.lang.NoClassDefFoundError" In addition this update contains all upstream fixes of the 4.3.7 series. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-357=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libreoffice-4.3.7.2-18.1 libreoffice-base-4.3.7.2-18.1 libreoffice-base-debuginfo-4.3.7.2-18.1 libreoffice-base-drivers-mysql-4.3.7.2-18.1 libreoffice-base-drivers-mysql-debuginfo-4.3.7.2-18.1 libreoffice-base-drivers-postgresql-4.3.7.2-18.1 libreoffice-base-drivers-postgresql-debuginfo-4.3.7.2-18.1 libreoffice-calc-4.3.7.2-18.1 libreoffice-calc-debuginfo-4.3.7.2-18.1 libreoffice-calc-extensions-4.3.7.2-18.1 libreoffice-debuginfo-4.3.7.2-18.1 libreoffice-debugsource-4.3.7.2-18.1 libreoffice-draw-4.3.7.2-18.1 libreoffice-draw-debuginfo-4.3.7.2-18.1 libreoffice-filters-optional-4.3.7.2-18.1 libreoffice-gnome-4.3.7.2-18.1 libreoffice-gnome-debuginfo-4.3.7.2-18.1 libreoffice-impress-4.3.7.2-18.1 libreoffice-impress-debuginfo-4.3.7.2-18.1 libreoffice-kde4-4.3.7.2-18.1 libreoffice-kde4-debuginfo-4.3.7.2-18.1 libreoffice-mailmerge-4.3.7.2-18.1 libreoffice-math-4.3.7.2-18.1 libreoffice-math-debuginfo-4.3.7.2-18.1 libreoffice-officebean-4.3.7.2-18.1 libreoffice-officebean-debuginfo-4.3.7.2-18.1 libreoffice-pyuno-4.3.7.2-18.1 libreoffice-pyuno-debuginfo-4.3.7.2-18.1 libreoffice-sdk-4.3.7.2-18.1 libreoffice-sdk-debuginfo-4.3.7.2-18.1 libreoffice-sdk-doc-4.3.7.2-18.1 libreoffice-writer-4.3.7.2-18.1 libreoffice-writer-debuginfo-4.3.7.2-18.1 libreoffice-writer-extensions-4.3.7.2-18.1 - openSUSE 13.2 (noarch): libreoffice-branding-upstream-4.3.7.2-18.1 libreoffice-icon-theme-crystal-4.3.7.2-18.1 libreoffice-icon-theme-galaxy-4.3.7.2-18.1 libreoffice-icon-theme-hicontrast-4.3.7.2-18.1 libreoffice-icon-theme-oxygen-4.3.7.2-18.1 libreoffice-icon-theme-sifr-4.3.7.2-18.1 libreoffice-icon-theme-tango-4.3.7.2-18.1 libreoffice-l10n-af-4.3.7.2-18.1 libreoffice-l10n-ar-4.3.7.2-18.1 libreoffice-l10n-as-4.3.7.2-18.1 libreoffice-l10n-bg-4.3.7.2-18.1 libreoffice-l10n-bn-4.3.7.2-18.1 libreoffice-l10n-br-4.3.7.2-18.1 libreoffice-l10n-ca-4.3.7.2-18.1 libreoffice-l10n-cs-4.3.7.2-18.1 libreoffice-l10n-cy-4.3.7.2-18.1 libreoffice-l10n-da-4.3.7.2-18.1 libreoffice-l10n-de-4.3.7.2-18.1 libreoffice-l10n-dz-4.3.7.2-18.1 libreoffice-l10n-el-4.3.7.2-18.1 libreoffice-l10n-en-4.3.7.2-18.1 libreoffice-l10n-es-4.3.7.2-18.1 libreoffice-l10n-et-4.3.7.2-18.1 libreoffice-l10n-eu-4.3.7.2-18.1 libreoffice-l10n-fa-4.3.7.2-18.1 libreoffice-l10n-fi-4.3.7.2-18.1 libreoffice-l10n-fr-4.3.7.2-18.1 libreoffice-l10n-ga-4.3.7.2-18.1 libreoffice-l10n-gl-4.3.7.2-18.1 libreoffice-l10n-gu-4.3.7.2-18.1 libreoffice-l10n-he-4.3.7.2-18.1 libreoffice-l10n-hi-4.3.7.2-18.1 libreoffice-l10n-hr-4.3.7.2-18.1 libreoffice-l10n-hu-4.3.7.2-18.1 libreoffice-l10n-it-4.3.7.2-18.1 libreoffice-l10n-ja-4.3.7.2-18.1 libreoffice-l10n-kk-4.3.7.2-18.1 libreoffice-l10n-kn-4.3.7.2-18.1 libreoffice-l10n-ko-4.3.7.2-18.1 libreoffice-l10n-lt-4.3.7.2-18.1 libreoffice-l10n-lv-4.3.7.2-18.1 libreoffice-l10n-mai-4.3.7.2-18.1 libreoffice-l10n-ml-4.3.7.2-18.1 libreoffice-l10n-mr-4.3.7.2-18.1 libreoffice-l10n-nb-4.3.7.2-18.1 libreoffice-l10n-nl-4.3.7.2-18.1 libreoffice-l10n-nn-4.3.7.2-18.1 libreoffice-l10n-nr-4.3.7.2-18.1 libreoffice-l10n-nso-4.3.7.2-18.1 libreoffice-l10n-or-4.3.7.2-18.1 libreoffice-l10n-pa-4.3.7.2-18.1 libreoffice-l10n-pl-4.3.7.2-18.1 libreoffice-l10n-pt-BR-4.3.7.2-18.1 libreoffice-l10n-pt-PT-4.3.7.2-18.1 libreoffice-l10n-ro-4.3.7.2-18.1 libreoffice-l10n-ru-4.3.7.2-18.1 libreoffice-l10n-si-4.3.7.2-18.1 libreoffice-l10n-sk-4.3.7.2-18.1 libreoffice-l10n-sl-4.3.7.2-18.1 libreoffice-l10n-sr-4.3.7.2-18.1 libreoffice-l10n-ss-4.3.7.2-18.1 libreoffice-l10n-st-4.3.7.2-18.1 libreoffice-l10n-sv-4.3.7.2-18.1 libreoffice-l10n-ta-4.3.7.2-18.1 libreoffice-l10n-te-4.3.7.2-18.1 libreoffice-l10n-th-4.3.7.2-18.1 libreoffice-l10n-tn-4.3.7.2-18.1 libreoffice-l10n-tr-4.3.7.2-18.1 libreoffice-l10n-ts-4.3.7.2-18.1 libreoffice-l10n-uk-4.3.7.2-18.1 libreoffice-l10n-ve-4.3.7.2-18.1 libreoffice-l10n-xh-4.3.7.2-18.1 libreoffice-l10n-zh-Hans-4.3.7.2-18.1 libreoffice-l10n-zh-Hant-4.3.7.2-18.1 libreoffice-l10n-zu-4.3.7.2-18.1 References: https://www.suse.com/security/cve/CVE-2015-1774.html https://bugzilla.suse.com/881214 https://bugzilla.suse.com/919409

1 0

openSUSE-SU-2015:0858-1: moderate: Security update for pcre
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for pcre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0858-1 Rating: moderate References: #906574 #924960 #924961 Cross-References: CVE-2014-8964 CVE-2015-2325 CVE-2015-2326 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The regular expression library pcre was updated to 8.37 to fix three security issues and a number of bugs and correctness issues. The following vulnerabilities were fixed: * CVE-2015-2325: Specially crafted regular expressions could have caused a heap buffer overlow in compile_branch(), potentially allowing the execution of arbitrary code. (boo#924960) * CVE-2015-2326: Specially crafted regular expressions could have caused a heap buffer overlow in pcre_compile2(), potentially allowing the execution of arbitrary code. [boo#924961] * CVE-2014-8964: Specially crafted regular expression could have caused a denial of service (crash) or have other unspecified impact. [boo#906574] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-353=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-353=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpcre1-8.37-3.5.1 libpcre1-debuginfo-8.37-3.5.1 libpcre16-0-8.37-3.5.1 libpcre16-0-debuginfo-8.37-3.5.1 libpcrecpp0-8.37-3.5.1 libpcrecpp0-debuginfo-8.37-3.5.1 libpcreposix0-8.37-3.5.1 libpcreposix0-debuginfo-8.37-3.5.1 pcre-debugsource-8.37-3.5.1 pcre-devel-8.37-3.5.1 pcre-devel-static-8.37-3.5.1 pcre-tools-8.37-3.5.1 pcre-tools-debuginfo-8.37-3.5.1 - openSUSE 13.2 (x86_64): libpcre1-32bit-8.37-3.5.1 libpcre1-debuginfo-32bit-8.37-3.5.1 libpcre16-0-32bit-8.37-3.5.1 libpcre16-0-debuginfo-32bit-8.37-3.5.1 libpcrecpp0-32bit-8.37-3.5.1 libpcrecpp0-debuginfo-32bit-8.37-3.5.1 libpcreposix0-32bit-8.37-3.5.1 libpcreposix0-debuginfo-32bit-8.37-3.5.1 - openSUSE 13.2 (noarch): pcre-doc-8.37-3.5.1 - openSUSE 13.1 (i586 x86_64): libpcre1-8.37-2.4.1 libpcre1-debuginfo-8.37-2.4.1 libpcre16-0-8.37-2.4.1 libpcre16-0-debuginfo-8.37-2.4.1 libpcrecpp0-8.37-2.4.1 libpcrecpp0-debuginfo-8.37-2.4.1 libpcreposix0-8.37-2.4.1 libpcreposix0-debuginfo-8.37-2.4.1 pcre-debugsource-8.37-2.4.1 pcre-devel-8.37-2.4.1 pcre-devel-static-8.37-2.4.1 pcre-tools-8.37-2.4.1 pcre-tools-debuginfo-8.37-2.4.1 - openSUSE 13.1 (x86_64): libpcre1-32bit-8.37-2.4.1 libpcre1-debuginfo-32bit-8.37-2.4.1 libpcre16-0-32bit-8.37-2.4.1 libpcre16-0-debuginfo-32bit-8.37-2.4.1 libpcrecpp0-32bit-8.37-2.4.1 libpcrecpp0-debuginfo-32bit-8.37-2.4.1 libpcreposix0-32bit-8.37-2.4.1 libpcreposix0-debuginfo-32bit-8.37-2.4.1 - openSUSE 13.1 (noarch): pcre-doc-8.37-2.4.1 References: https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2326.html https://bugzilla.suse.com/906574 https://bugzilla.suse.com/924960 https://bugzilla.suse.com/924961

1 0

openSUSE-SU-2015:0857-1: moderate: Security update for dnsmasq
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0857-1 Rating: moderate References: #928867 Cross-References: CVE-2015-3294 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The DNS server dnsmasq was updated to fix one security issue. The following vulnerability was fixed: * CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read heap memory, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-359=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-359=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dnsmasq-2.71-3.4.1 dnsmasq-debuginfo-2.71-3.4.1 dnsmasq-debugsource-2.71-3.4.1 dnsmasq-utils-2.71-3.4.1 dnsmasq-utils-debuginfo-2.71-3.4.1 - openSUSE 13.1 (i586 x86_64): dnsmasq-2.65-7.3.1 dnsmasq-debuginfo-2.65-7.3.1 dnsmasq-debugsource-2.65-7.3.1 dnsmasq-utils-2.65-7.3.1 dnsmasq-utils-debuginfo-2.65-7.3.1 References: https://www.suse.com/security/cve/CVE-2015-3294.html https://bugzilla.suse.com/928867

1 0

openSUSE-SU-2015:0856-1: Security update for gnu_parallel
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for gnu_parallel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0856-1 Rating: low References: #928664 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: GNU parallel was updated to version 20150422 to fix one security issue, several bugs and add functionality. The following vulnerability was fixed: * A local attacker could make a user overwrite one of his own files with a single byte when using --compress, --tmux, --pipe, --cat or --fifo when guessing random file names within a time window of 15 ms. [boo#928664] In addition, the update to 20150422 adds a number of bug fixes, improvements and new features. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-358=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-358=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): gnu_parallel-20150422-2.3.1 gnu_parallel-doc-20150422-2.3.1 - openSUSE 13.1 (noarch): gnu_parallel-20150422-2.3.1 gnu_parallel-doc-20150422-2.3.1 References: https://bugzilla.suse.com/928664

1 0

openSUSE-SU-2015:0855-1: important: Security update for php5
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0855-1 Rating: important References: #927147 #928408 #928506 #928511 Cross-References: CVE-2015-2783 CVE-2015-3329 CVE-2015-3330 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: PHP was updated to fix three security issues. The following vulnerabilities were fixed: * CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506) * CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506) * CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511) On openSUSE 13.2, the following bug was fixed: * boo#927147: php5-fpm did not start correctly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-352=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-352=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-21.1 apache2-mod_php5-debuginfo-5.6.1-21.1 php5-5.6.1-21.1 php5-bcmath-5.6.1-21.1 php5-bcmath-debuginfo-5.6.1-21.1 php5-bz2-5.6.1-21.1 php5-bz2-debuginfo-5.6.1-21.1 php5-calendar-5.6.1-21.1 php5-calendar-debuginfo-5.6.1-21.1 php5-ctype-5.6.1-21.1 php5-ctype-debuginfo-5.6.1-21.1 php5-curl-5.6.1-21.1 php5-curl-debuginfo-5.6.1-21.1 php5-dba-5.6.1-21.1 php5-dba-debuginfo-5.6.1-21.1 php5-debuginfo-5.6.1-21.1 php5-debugsource-5.6.1-21.1 php5-devel-5.6.1-21.1 php5-dom-5.6.1-21.1 php5-dom-debuginfo-5.6.1-21.1 php5-enchant-5.6.1-21.1 php5-enchant-debuginfo-5.6.1-21.1 php5-exif-5.6.1-21.1 php5-exif-debuginfo-5.6.1-21.1 php5-fastcgi-5.6.1-21.1 php5-fastcgi-debuginfo-5.6.1-21.1 php5-fileinfo-5.6.1-21.1 php5-fileinfo-debuginfo-5.6.1-21.1 php5-firebird-5.6.1-21.1 php5-firebird-debuginfo-5.6.1-21.1 php5-fpm-5.6.1-21.1 php5-fpm-debuginfo-5.6.1-21.1 php5-ftp-5.6.1-21.1 php5-ftp-debuginfo-5.6.1-21.1 php5-gd-5.6.1-21.1 php5-gd-debuginfo-5.6.1-21.1 php5-gettext-5.6.1-21.1 php5-gettext-debuginfo-5.6.1-21.1 php5-gmp-5.6.1-21.1 php5-gmp-debuginfo-5.6.1-21.1 php5-iconv-5.6.1-21.1 php5-iconv-debuginfo-5.6.1-21.1 php5-imap-5.6.1-21.1 php5-imap-debuginfo-5.6.1-21.1 php5-intl-5.6.1-21.1 php5-intl-debuginfo-5.6.1-21.1 php5-json-5.6.1-21.1 php5-json-debuginfo-5.6.1-21.1 php5-ldap-5.6.1-21.1 php5-ldap-debuginfo-5.6.1-21.1 php5-mbstring-5.6.1-21.1 php5-mbstring-debuginfo-5.6.1-21.1 php5-mcrypt-5.6.1-21.1 php5-mcrypt-debuginfo-5.6.1-21.1 php5-mssql-5.6.1-21.1 php5-mssql-debuginfo-5.6.1-21.1 php5-mysql-5.6.1-21.1 php5-mysql-debuginfo-5.6.1-21.1 php5-odbc-5.6.1-21.1 php5-odbc-debuginfo-5.6.1-21.1 php5-opcache-5.6.1-21.1 php5-opcache-debuginfo-5.6.1-21.1 php5-openssl-5.6.1-21.1 php5-openssl-debuginfo-5.6.1-21.1 php5-pcntl-5.6.1-21.1 php5-pcntl-debuginfo-5.6.1-21.1 php5-pdo-5.6.1-21.1 php5-pdo-debuginfo-5.6.1-21.1 php5-pgsql-5.6.1-21.1 php5-pgsql-debuginfo-5.6.1-21.1 php5-phar-5.6.1-21.1 php5-phar-debuginfo-5.6.1-21.1 php5-posix-5.6.1-21.1 php5-posix-debuginfo-5.6.1-21.1 php5-pspell-5.6.1-21.1 php5-pspell-debuginfo-5.6.1-21.1 php5-readline-5.6.1-21.1 php5-readline-debuginfo-5.6.1-21.1 php5-shmop-5.6.1-21.1 php5-shmop-debuginfo-5.6.1-21.1 php5-snmp-5.6.1-21.1 php5-snmp-debuginfo-5.6.1-21.1 php5-soap-5.6.1-21.1 php5-soap-debuginfo-5.6.1-21.1 php5-sockets-5.6.1-21.1 php5-sockets-debuginfo-5.6.1-21.1 php5-sqlite-5.6.1-21.1 php5-sqlite-debuginfo-5.6.1-21.1 php5-suhosin-5.6.1-21.1 php5-suhosin-debuginfo-5.6.1-21.1 php5-sysvmsg-5.6.1-21.1 php5-sysvmsg-debuginfo-5.6.1-21.1 php5-sysvsem-5.6.1-21.1 php5-sysvsem-debuginfo-5.6.1-21.1 php5-sysvshm-5.6.1-21.1 php5-sysvshm-debuginfo-5.6.1-21.1 php5-tidy-5.6.1-21.1 php5-tidy-debuginfo-5.6.1-21.1 php5-tokenizer-5.6.1-21.1 php5-tokenizer-debuginfo-5.6.1-21.1 php5-wddx-5.6.1-21.1 php5-wddx-debuginfo-5.6.1-21.1 php5-xmlreader-5.6.1-21.1 php5-xmlreader-debuginfo-5.6.1-21.1 php5-xmlrpc-5.6.1-21.1 php5-xmlrpc-debuginfo-5.6.1-21.1 php5-xmlwriter-5.6.1-21.1 php5-xmlwriter-debuginfo-5.6.1-21.1 php5-xsl-5.6.1-21.1 php5-xsl-debuginfo-5.6.1-21.1 php5-zip-5.6.1-21.1 php5-zip-debuginfo-5.6.1-21.1 php5-zlib-5.6.1-21.1 php5-zlib-debuginfo-5.6.1-21.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-21.1 - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-52.1 apache2-mod_php5-debuginfo-5.4.20-52.1 php5-5.4.20-52.1 php5-bcmath-5.4.20-52.1 php5-bcmath-debuginfo-5.4.20-52.1 php5-bz2-5.4.20-52.1 php5-bz2-debuginfo-5.4.20-52.1 php5-calendar-5.4.20-52.1 php5-calendar-debuginfo-5.4.20-52.1 php5-ctype-5.4.20-52.1 php5-ctype-debuginfo-5.4.20-52.1 php5-curl-5.4.20-52.1 php5-curl-debuginfo-5.4.20-52.1 php5-dba-5.4.20-52.1 php5-dba-debuginfo-5.4.20-52.1 php5-debuginfo-5.4.20-52.1 php5-debugsource-5.4.20-52.1 php5-devel-5.4.20-52.1 php5-dom-5.4.20-52.1 php5-dom-debuginfo-5.4.20-52.1 php5-enchant-5.4.20-52.1 php5-enchant-debuginfo-5.4.20-52.1 php5-exif-5.4.20-52.1 php5-exif-debuginfo-5.4.20-52.1 php5-fastcgi-5.4.20-52.1 php5-fastcgi-debuginfo-5.4.20-52.1 php5-fileinfo-5.4.20-52.1 php5-fileinfo-debuginfo-5.4.20-52.1 php5-firebird-5.4.20-52.1 php5-firebird-debuginfo-5.4.20-52.1 php5-fpm-5.4.20-52.1 php5-fpm-debuginfo-5.4.20-52.1 php5-ftp-5.4.20-52.1 php5-ftp-debuginfo-5.4.20-52.1 php5-gd-5.4.20-52.1 php5-gd-debuginfo-5.4.20-52.1 php5-gettext-5.4.20-52.1 php5-gettext-debuginfo-5.4.20-52.1 php5-gmp-5.4.20-52.1 php5-gmp-debuginfo-5.4.20-52.1 php5-iconv-5.4.20-52.1 php5-iconv-debuginfo-5.4.20-52.1 php5-imap-5.4.20-52.1 php5-imap-debuginfo-5.4.20-52.1 php5-intl-5.4.20-52.1 php5-intl-debuginfo-5.4.20-52.1 php5-json-5.4.20-52.1 php5-json-debuginfo-5.4.20-52.1 php5-ldap-5.4.20-52.1 php5-ldap-debuginfo-5.4.20-52.1 php5-mbstring-5.4.20-52.1 php5-mbstring-debuginfo-5.4.20-52.1 php5-mcrypt-5.4.20-52.1 php5-mcrypt-debuginfo-5.4.20-52.1 php5-mssql-5.4.20-52.1 php5-mssql-debuginfo-5.4.20-52.1 php5-mysql-5.4.20-52.1 php5-mysql-debuginfo-5.4.20-52.1 php5-odbc-5.4.20-52.1 php5-odbc-debuginfo-5.4.20-52.1 php5-openssl-5.4.20-52.1 php5-openssl-debuginfo-5.4.20-52.1 php5-pcntl-5.4.20-52.1 php5-pcntl-debuginfo-5.4.20-52.1 php5-pdo-5.4.20-52.1 php5-pdo-debuginfo-5.4.20-52.1 php5-pgsql-5.4.20-52.1 php5-pgsql-debuginfo-5.4.20-52.1 php5-phar-5.4.20-52.1 php5-phar-debuginfo-5.4.20-52.1 php5-posix-5.4.20-52.1 php5-posix-debuginfo-5.4.20-52.1 php5-pspell-5.4.20-52.1 php5-pspell-debuginfo-5.4.20-52.1 php5-readline-5.4.20-52.1 php5-readline-debuginfo-5.4.20-52.1 php5-shmop-5.4.20-52.1 php5-shmop-debuginfo-5.4.20-52.1 php5-snmp-5.4.20-52.1 php5-snmp-debuginfo-5.4.20-52.1 php5-soap-5.4.20-52.1 php5-soap-debuginfo-5.4.20-52.1 php5-sockets-5.4.20-52.1 php5-sockets-debuginfo-5.4.20-52.1 php5-sqlite-5.4.20-52.1 php5-sqlite-debuginfo-5.4.20-52.1 php5-suhosin-5.4.20-52.1 php5-suhosin-debuginfo-5.4.20-52.1 php5-sysvmsg-5.4.20-52.1 php5-sysvmsg-debuginfo-5.4.20-52.1 php5-sysvsem-5.4.20-52.1 php5-sysvsem-debuginfo-5.4.20-52.1 php5-sysvshm-5.4.20-52.1 php5-sysvshm-debuginfo-5.4.20-52.1 php5-tidy-5.4.20-52.1 php5-tidy-debuginfo-5.4.20-52.1 php5-tokenizer-5.4.20-52.1 php5-tokenizer-debuginfo-5.4.20-52.1 php5-wddx-5.4.20-52.1 php5-wddx-debuginfo-5.4.20-52.1 php5-xmlreader-5.4.20-52.1 php5-xmlreader-debuginfo-5.4.20-52.1 php5-xmlrpc-5.4.20-52.1 php5-xmlrpc-debuginfo-5.4.20-52.1 php5-xmlwriter-5.4.20-52.1 php5-xmlwriter-debuginfo-5.4.20-52.1 php5-xsl-5.4.20-52.1 php5-xsl-debuginfo-5.4.20-52.1 php5-zip-5.4.20-52.1 php5-zip-debuginfo-5.4.20-52.1 php5-zlib-5.4.20-52.1 php5-zlib-debuginfo-5.4.20-52.1 - openSUSE 13.1 (noarch): php5-pear-5.4.20-52.1 References: https://www.suse.com/security/cve/CVE-2015-2783.html https://www.suse.com/security/cve/CVE-2015-3329.html https://www.suse.com/security/cve/CVE-2015-3330.html https://bugzilla.suse.com/927147 https://bugzilla.suse.com/928408 https://bugzilla.suse.com/928506 https://bugzilla.suse.com/928511

1 0

openSUSE-SU-2015:0854-1: Security update for libtasn1
by opensuse-security＠opensuse.org 12 May '15

12 May '15

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0854-1 Rating: low References: #924828 Cross-References: CVE-2015-2806 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The ASN.1 parsing library libtasn1 was updated to fix one memory handling issue. The following vulnerability was fixed: * CVE-2015-2806: A stack-based buffer overflow in libtasn1 allowed remote attackers to have unspecified impact via unknown vectors. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-360=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-360=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libtasn1-3.7-2.4.1 libtasn1-6-3.7-2.4.1 libtasn1-6-debuginfo-3.7-2.4.1 libtasn1-debuginfo-3.7-2.4.1 libtasn1-debugsource-3.7-2.4.1 libtasn1-devel-3.7-2.4.1 - openSUSE 13.2 (x86_64): libtasn1-6-32bit-3.7-2.4.1 libtasn1-6-debuginfo-32bit-3.7-2.4.1 libtasn1-devel-32bit-3.7-2.4.1 - openSUSE 13.1 (i586 x86_64): libtasn1-3.3-3.4.1 libtasn1-6-3.3-3.4.1 libtasn1-6-debuginfo-3.3-3.4.1 libtasn1-debuginfo-3.3-3.4.1 libtasn1-debugsource-3.3-3.4.1 libtasn1-devel-3.3-3.4.1 - openSUSE 13.1 (x86_64): libtasn1-6-32bit-3.3-3.4.1 libtasn1-6-debuginfo-32bit-3.3-3.4.1 References: https://www.suse.com/security/cve/CVE-2015-2806.html https://bugzilla.suse.com/924828

1 0