July 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1279-1: moderate: Security update for rubygem-activesupport-3_2
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for rubygem-activesupport-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1279-1 Rating: moderate References: #934800 Cross-References: CVE-2015-3227 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-activesupport-3_2 was updated to fix one security issue. This security issue was fixed: - CVE-2015-3227: Possible Denial of Service attack in Active Support (bsc#934800). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-506=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-506=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-activesupport-3_2-3.2.17-2.3.1 rubygem-activesupport-3_2-doc-3.2.17-2.3.1 - openSUSE 13.1 (i586 x86_64): rubygem-activesupport-3_2-3.2.13-3.17.1 rubygem-activesupport-3_2-doc-3.2.13-3.17.1 References: https://www.suse.com/security/cve/CVE-2015-3227.html https://bugzilla.suse.com/934800

1 0

openSUSE-SU-2015:1278-1: moderate: Security update for pdns, pdns-recursor
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for pdns, pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1278-1 Rating: moderate References: #927569 Cross-References: CVE-2015-1868 CVE-2015-5470 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: pdns, pdns-recursor were updated to fix two security issues. These security issues were fixed: - CVE-2015-1868: The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allowed remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself (bsc#927569). - CVE-2015-5470: Complete fix for CVE-2015-1868 (bsc#927569). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-505=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-505=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): pdns-3.3.1-2.3.1 pdns-backend-ldap-3.3.1-2.3.1 pdns-backend-ldap-debuginfo-3.3.1-2.3.1 pdns-backend-lua-3.3.1-2.3.1 pdns-backend-lua-debuginfo-3.3.1-2.3.1 pdns-backend-mydns-3.3.1-2.3.1 pdns-backend-mydns-debuginfo-3.3.1-2.3.1 pdns-backend-mysql-3.3.1-2.3.1 pdns-backend-mysql-debuginfo-3.3.1-2.3.1 pdns-backend-postgresql-3.3.1-2.3.1 pdns-backend-postgresql-debuginfo-3.3.1-2.3.1 pdns-backend-sqlite3-3.3.1-2.3.1 pdns-backend-sqlite3-debuginfo-3.3.1-2.3.1 pdns-debuginfo-3.3.1-2.3.1 pdns-debugsource-3.3.1-2.3.1 - openSUSE 13.1 (i586 x86_64): pdns-recursor-3.6.2-8.7.1 pdns-recursor-debuginfo-3.6.2-8.7.1 pdns-recursor-debugsource-3.6.2-8.7.1 References: https://www.suse.com/security/cve/CVE-2015-1868.html https://www.suse.com/security/cve/CVE-2015-5470.html https://bugzilla.suse.com/927569

1 0

openSUSE-SU-2015:1277-1: important: Security update for libressl
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1277-1 Rating: important References: #912015 #912018 #912292 #912293 #912296 #919648 #920236 #922496 #922499 #922500 #931600 #934487 #934489 #934491 #934493 #934494 #937891 Cross-References: CVE-2014-3570 CVE-2014-3572 CVE-2014-8176 CVE-2014-8275 CVE-2015-0205 CVE-2015-0206 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1792 CVE-2015-4000 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has one errata is now available. Description: libressl was updated to version 2.2.1 to fix 16 security issues. LibreSSL is a fork of OpenSSL. Because of that CVEs affecting OpenSSL often also affect LibreSSL. These security issues were fixed: - CVE-2014-3570: The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c (bsc#912296). - CVE-2014-3572: The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allowed remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message (bsc#912015). - CVE-2015-1792: The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function (bsc#934493). - CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not enforce certain constraints on certificate data, which allowed remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c (bsc#912018). - CVE-2015-0209: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import (bsc#919648). - CVE-2015-1789: The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback (bsc#934489). - CVE-2015-1788: The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b did not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allowed remote attackers to cause a denial of service (infinite loop) via a session that used an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication (bsc#934487). - CVE-2015-1790: The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that used ASN.1 encoding and lacks inner EncryptedContent data (bsc#934491). - CVE-2015-0287: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not reinitialize CHOICE and ADB data structures, which might allowed attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse (bsc#922499). - CVE-2015-0286: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly perform boolean-type comparisons, which allowed remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that used the certificate-verification feature (bsc#922496). - CVE-2015-0289: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly handle a lack of outer ContentInfo, which allowed attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c (bsc#922500). - CVE-2015-0288: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key (bsc#920236). - CVE-2014-8176: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allowed remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data (bsc#934494). - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue (bsc#931600). - CVE-2015-0205: The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allowed remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support (bsc#912293). - CVE-2015-0206: Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allowed remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection (bsc#912292). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-507=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcrypto34-2.2.1-2.3.1 libcrypto34-debuginfo-2.2.1-2.3.1 libressl-2.2.1-2.3.1 libressl-debuginfo-2.2.1-2.3.1 libressl-debugsource-2.2.1-2.3.1 libressl-devel-2.2.1-2.3.1 libssl33-2.2.1-2.3.1 libssl33-debuginfo-2.2.1-2.3.1 libtls4-2.2.1-2.3.1 libtls4-debuginfo-2.2.1-2.3.1 - openSUSE 13.2 (x86_64): libcrypto34-32bit-2.2.1-2.3.1 libcrypto34-debuginfo-32bit-2.2.1-2.3.1 libressl-devel-32bit-2.2.1-2.3.1 libssl33-32bit-2.2.1-2.3.1 libssl33-debuginfo-32bit-2.2.1-2.3.1 libtls4-32bit-2.2.1-2.3.1 libtls4-debuginfo-32bit-2.2.1-2.3.1 - openSUSE 13.2 (noarch): libressl-devel-doc-2.2.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-3570.html https://www.suse.com/security/cve/CVE-2014-3572.html https://www.suse.com/security/cve/CVE-2014-8176.html https://www.suse.com/security/cve/CVE-2014-8275.html https://www.suse.com/security/cve/CVE-2015-0205.html https://www.suse.com/security/cve/CVE-2015-0206.html https://www.suse.com/security/cve/CVE-2015-0209.html https://www.suse.com/security/cve/CVE-2015-0286.html https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-0288.html https://www.suse.com/security/cve/CVE-2015-0289.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/912015 https://bugzilla.suse.com/912018 https://bugzilla.suse.com/912292 https://bugzilla.suse.com/912293 https://bugzilla.suse.com/912296 https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 https://bugzilla.suse.com/931600 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 https://bugzilla.suse.com/937891

1 0

openSUSE-SU-2015:1271-1: moderate: Security update for libcryptopp
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

openSUSE Security Update: Security update for libcryptopp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1271-1 Rating: moderate References: #936435 Cross-References: CVE-2015-2141 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libcryptopp was updated to fix one security issue. This security issue was fixed: - CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 did not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allowed remote attackers to obtain private keys via a timing attack (bsc#936435). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-504=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-504=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcryptopp-5_6_2-0-5.6.2-7.4.1 libcryptopp-5_6_2-0-debuginfo-5.6.2-7.4.1 libcryptopp-debugsource-5.6.2-7.4.1 libcryptopp-devel-5.6.2-7.4.1 libcryptopp-devel-static-5.6.2-7.4.1 - openSUSE 13.2 (x86_64): libcryptopp-5_6_2-0-32bit-5.6.2-7.4.1 libcryptopp-5_6_2-0-debuginfo-32bit-5.6.2-7.4.1 - openSUSE 13.1 (i586 x86_64): libcryptopp-5_6_2-0-5.6.2-2.4.2 libcryptopp-5_6_2-0-debuginfo-5.6.2-2.4.2 libcryptopp-debugsource-5.6.2-2.4.2 libcryptopp-devel-5.6.2-2.4.2 libcryptopp-devel-static-5.6.2-2.4.2 - openSUSE 13.1 (x86_64): libcryptopp-5_6_2-0-32bit-5.6.2-2.4.2 libcryptopp-5_6_2-0-debuginfo-32bit-5.6.2-2.4.2 References: https://www.suse.com/security/cve/CVE-2015-2141.html https://bugzilla.suse.com/936435

1 0

openSUSE-SU-2015:1267-1: critical: flash-player
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1267-1 Rating: critical References: #937752 Cross-References: CVE-2015-5122 CVE-2015-5123 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: flash-player was updated to fix two security issues. These security issues were fixed: - CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752). - CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-502=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.491-173.1 flash-player-gnome-11.2.202.491-173.1 flash-player-kde4-11.2.202.491-173.1 References: https://www.suse.com/security/cve/CVE-2015-5122.html https://www.suse.com/security/cve/CVE-2015-5123.html https://bugzilla.suse.com/937752

1 0

openSUSE-SU-2015:1266-1: important: Mozilla (Firefox/Thunderbird) updates to 31.8.0
by opensuse-security＠opensuse.org 18 Jul '15

18 Jul '15

openSUSE Security Update: Mozilla (Firefox/Thunderbird) updates to 31.8.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1266-1 Rating: important References: #894370 #900639 #900941 #908009 #910669 #917597 #925368 #930622 #935979 Cross-References: CVE-2011-3079 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0833 CVE-2015-0836 CVE-2015-2708 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: Combined Mozilla update: - Update Firefox to 31.8.0 - Update Thunderbird to 31.8.0 - Update mozilla-nspr to 4.10.6 - Update mozilla-nss to 3.19.2 to fix several security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.8.0-143.1 MozillaFirefox-branding-upstream-31.8.0-143.1 MozillaFirefox-buildsymbols-31.8.0-143.1 MozillaFirefox-debuginfo-31.8.0-143.1 MozillaFirefox-debugsource-31.8.0-143.1 MozillaFirefox-devel-31.8.0-143.1 MozillaFirefox-translations-common-31.8.0-143.1 MozillaFirefox-translations-other-31.8.0-143.1 MozillaThunderbird-31.8.0-110.1 MozillaThunderbird-buildsymbols-31.8.0-110.1 MozillaThunderbird-debuginfo-31.8.0-110.1 MozillaThunderbird-debugsource-31.8.0-110.1 MozillaThunderbird-devel-31.8.0-110.1 MozillaThunderbird-translations-common-31.8.0-110.1 MozillaThunderbird-translations-other-31.8.0-110.1 libfreebl3-3.19.2-107.1 libfreebl3-debuginfo-3.19.2-107.1 libsoftokn3-3.19.2-107.1 libsoftokn3-debuginfo-3.19.2-107.1 mozilla-nspr-4.10.8-52.1 mozilla-nspr-debuginfo-4.10.8-52.1 mozilla-nspr-debugsource-4.10.8-52.1 mozilla-nspr-devel-4.10.8-52.1 mozilla-nss-3.19.2-107.1 mozilla-nss-certs-3.19.2-107.1 mozilla-nss-certs-debuginfo-3.19.2-107.1 mozilla-nss-debuginfo-3.19.2-107.1 mozilla-nss-debugsource-3.19.2-107.1 mozilla-nss-devel-3.19.2-107.1 mozilla-nss-sysinit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-3.19.2-107.1 mozilla-nss-tools-3.19.2-107.1 mozilla-nss-tools-debuginfo-3.19.2-107.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.19.2-107.1 libfreebl3-debuginfo-32bit-3.19.2-107.1 libsoftokn3-32bit-3.19.2-107.1 libsoftokn3-debuginfo-32bit-3.19.2-107.1 mozilla-nspr-32bit-4.10.8-52.1 mozilla-nspr-debuginfo-32bit-4.10.8-52.1 mozilla-nss-32bit-3.19.2-107.1 mozilla-nss-certs-32bit-3.19.2-107.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-107.1 mozilla-nss-debuginfo-32bit-3.19.2-107.1 mozilla-nss-sysinit-32bit-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-107.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.19.2-107.1 libfreebl3-x86-3.19.2-107.1 libsoftokn3-debuginfo-x86-3.19.2-107.1 libsoftokn3-x86-3.19.2-107.1 mozilla-nspr-debuginfo-x86-4.10.8-52.1 mozilla-nspr-x86-4.10.8-52.1 mozilla-nss-certs-debuginfo-x86-3.19.2-107.1 mozilla-nss-certs-x86-3.19.2-107.1 mozilla-nss-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-debuginfo-x86-3.19.2-107.1 mozilla-nss-sysinit-x86-3.19.2-107.1 mozilla-nss-x86-3.19.2-107.1 References: https://www.suse.com/security/cve/CVE-2011-3079.html https://www.suse.com/security/cve/CVE-2014-1553.html https://www.suse.com/security/cve/CVE-2014-1562.html https://www.suse.com/security/cve/CVE-2014-1563.html https://www.suse.com/security/cve/CVE-2014-1564.html https://www.suse.com/security/cve/CVE-2014-1565.html https://www.suse.com/security/cve/CVE-2014-1567.html https://www.suse.com/security/cve/CVE-2014-1574.html https://www.suse.com/security/cve/CVE-2014-1576.html https://www.suse.com/security/cve/CVE-2014-1577.html https://www.suse.com/security/cve/CVE-2014-1578.html https://www.suse.com/security/cve/CVE-2014-1581.html https://www.suse.com/security/cve/CVE-2014-1585.html https://www.suse.com/security/cve/CVE-2014-1586.html https://www.suse.com/security/cve/CVE-2014-1587.html https://www.suse.com/security/cve/CVE-2014-1590.html https://www.suse.com/security/cve/CVE-2014-1592.html https://www.suse.com/security/cve/CVE-2014-1593.html https://www.suse.com/security/cve/CVE-2014-1594.html https://www.suse.com/security/cve/CVE-2014-8634.html https://www.suse.com/security/cve/CVE-2014-8635.html https://www.suse.com/security/cve/CVE-2014-8638.html https://www.suse.com/security/cve/CVE-2014-8639.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://www.suse.com/security/cve/CVE-2015-0822.html https://www.suse.com/security/cve/CVE-2015-0827.html https://www.suse.com/security/cve/CVE-2015-0831.html https://www.suse.com/security/cve/CVE-2015-0833.html https://www.suse.com/security/cve/CVE-2015-0836.html https://www.suse.com/security/cve/CVE-2015-2708.html https://www.suse.com/security/cve/CVE-2015-2710.html https://www.suse.com/security/cve/CVE-2015-2713.html https://www.suse.com/security/cve/CVE-2015-2716.html https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/894370 https://bugzilla.suse.com/900639 https://bugzilla.suse.com/900941 https://bugzilla.suse.com/908009 https://bugzilla.suse.com/910669 https://bugzilla.suse.com/917597 https://bugzilla.suse.com/925368 https://bugzilla.suse.com/930622 https://bugzilla.suse.com/935979

1 0

openSUSE-SU-2015:1263-1: moderate: Security update for rubygem-rack-1_3
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

openSUSE Security Update: Security update for rubygem-rack-1_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1263-1 Rating: moderate References: #934797 Cross-References: CVE-2015-3225 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-rack-1_3 was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Potential Denial of Service Vulnerability in Rack (bsc#934797). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-499=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-499=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-rack-1_3-1.3.10-5.3.1 rubygem-rack-1_3-doc-1.3.10-5.3.1 rubygem-rack-1_3-testsuite-1.3.10-5.3.1 - openSUSE 13.1 (i586 x86_64): rubygem-rack-1_3-1.3.10-3.3.1 rubygem-rack-1_3-doc-1.3.10-3.3.1 rubygem-rack-1_3-testsuite-1.3.10-3.3.1 References: https://www.suse.com/security/cve/CVE-2015-3225.html https://bugzilla.suse.com/934797

1 0

openSUSE-SU-2015:1262-1: moderate: Security update for rubygem-rack-1_4
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

openSUSE Security Update: Security update for rubygem-rack-1_4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1262-1 Rating: moderate References: #934797 Cross-References: CVE-2015-3225 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-rack-1_4 was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Potential Denial of Service Vulnerability in Rack (bsc#934797). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-500=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-500=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-rack-1_4-1.4.5-5.3.1 rubygem-rack-1_4-doc-1.4.5-5.3.1 rubygem-rack-1_4-testsuite-1.4.5-5.3.1 - openSUSE 13.1 (i586 x86_64): rubygem-rack-1_4-1.4.5-3.3.1 rubygem-rack-1_4-doc-1.4.5-3.3.1 rubygem-rack-1_4-testsuite-1.4.5-3.3.1 References: https://www.suse.com/security/cve/CVE-2015-3225.html https://bugzilla.suse.com/934797

1 0

openSUSE-SU-2015:1261-1: moderate: Security update for libidn
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

openSUSE Security Update: Security update for libidn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1261-1 Rating: moderate References: #923241 Cross-References: CVE-2015-2059 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libidn was updated to version 1.31 to fix one security issue. This security issue was fixed: - CVE-2015-2059: Out-of-bounds read with stringprep on invalid UTF-8 (bsc#923241). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-497=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-497=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libidn-debugsource-1.31-3.3.1 libidn-devel-1.31-3.3.1 libidn-tools-1.31-3.3.1 libidn-tools-debuginfo-1.31-3.3.1 libidn11-1.31-3.3.1 libidn11-debuginfo-1.31-3.3.1 - openSUSE 13.2 (x86_64): libidn11-32bit-1.31-3.3.1 libidn11-debuginfo-32bit-1.31-3.3.1 - openSUSE 13.1 (i586 x86_64): libidn-debugsource-1.31-7.3.1 libidn-devel-1.31-7.3.1 libidn-tools-1.31-7.3.1 libidn-tools-debuginfo-1.31-7.3.1 libidn11-1.31-7.3.1 libidn11-debuginfo-1.31-7.3.1 - openSUSE 13.1 (x86_64): libidn11-32bit-1.31-7.3.1 libidn11-debuginfo-32bit-1.31-7.3.1 References: https://www.suse.com/security/cve/CVE-2015-2059.html https://bugzilla.suse.com/923241

1 0

openSUSE-SU-2015:1260-1: moderate: Security update for rubygem-jquery-rails
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

openSUSE Security Update: Security update for rubygem-jquery-rails ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1260-1 Rating: moderate References: #934795 Cross-References: CVE-2015-1840 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-jquery-rails was updated to fix one security issue. This security issue was fixed: - CVE-2015-1840: CSRF Vulnerability in jquery-ujs and jquery-rails (bsc#934795). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-501=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-501=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-jquery-rails-3.1.1-2.3.1 rubygem-jquery-rails-doc-3.1.1-2.3.1 - openSUSE 13.1 (i586 x86_64): rubygem-jquery-rails-3.0.4-2.3.1 rubygem-jquery-rails-doc-3.0.4-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-1840.html https://bugzilla.suse.com/934795

1 0