May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1262-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1262-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-572=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.91-12.1 java-1_8_0-openjdk-accessibility-1.8.0.91-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-debugsource-1.8.0.91-12.1 java-1_8_0-openjdk-demo-1.8.0.91-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-devel-1.8.0.91-12.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-headless-1.8.0.91-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-12.1 java-1_8_0-openjdk-src-1.8.0.91-12.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.91-12.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340

1 0

openSUSE-SU-2016:1261-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1261-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: The update disables various insecure coders [boo#978061] These fix issues tracked in CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, CVE-2016-3718 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-569=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-18.1 ImageMagick-debuginfo-6.8.9.8-18.1 ImageMagick-debugsource-6.8.9.8-18.1 ImageMagick-devel-6.8.9.8-18.1 ImageMagick-extra-6.8.9.8-18.1 ImageMagick-extra-debuginfo-6.8.9.8-18.1 libMagick++-6_Q16-5-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-18.1 libMagick++-devel-6.8.9.8-18.1 libMagickCore-6_Q16-2-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-18.1 libMagickWand-6_Q16-2-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-18.1 perl-PerlMagick-6.8.9.8-18.1 perl-PerlMagick-debuginfo-6.8.9.8-18.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-18.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-32bit-6.8.9.8-18.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-18.1 libMagick++-devel-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-18.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-18.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-18.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061

1 0

openSUSE-RU-2016:1256-1: Recommended update for ruby2.1
by maintenance＠opensuse.org 06 May '16

06 May '16

openSUSE Recommended Update: Recommended update for ruby2.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1256-1 Rating: low References: #973073 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ruby2.1 brings performance improvements of Ruby on the IBM POWER platform. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-568=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libruby2_1-2_1-2.1.2-7.1 libruby2_1-2_1-debuginfo-2.1.2-7.1 ruby2.1-2.1.2-7.1 ruby2.1-debuginfo-2.1.2-7.1 ruby2.1-debugsource-2.1.2-7.1 ruby2.1-devel-2.1.2-7.1 ruby2.1-devel-extra-2.1.2-7.1 ruby2.1-doc-2.1.2-7.1 ruby2.1-stdlib-2.1.2-7.1 ruby2.1-stdlib-debuginfo-2.1.2-7.1 - openSUSE Leap 42.1 (noarch): ruby2.1-doc-ri-2.1.2-7.1 References: https://bugzilla.suse.com/973073

1 0

openSUSE-RU-2016:1252-1: Recommended update for hwinfo
by maintenance＠opensuse.org 06 May '16

06 May '16

openSUSE Recommended Update: Recommended update for hwinfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1252-1 Rating: low References: #974737 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hwinfo adjusts the DMI parser to read memory size according to the latest SMBIOS spec. (bsc#974737) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-567=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): hwinfo-21.24-3.1 hwinfo-debuginfo-21.24-3.1 hwinfo-debugsource-21.24-3.1 hwinfo-devel-21.24-3.1 hwinfo-devel-debuginfo-21.24-3.1 References: https://bugzilla.suse.com/974737

1 0

openSUSE-SU-2016:1251-1: moderate: Security update to Firefox 46.0
by opensuse-security＠opensuse.org 06 May '16

06 May '16

openSUSE Security Update: Security update to Firefox 46.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1251-1 Rating: moderate References: #977333 #977373 #977375 #977376 #977377 #977378 #977379 #977380 #977381 #977382 #977384 #977386 #977388 Cross-References: CVE-2016-2804 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2809 CVE-2016-2810 CVE-2016-2811 CVE-2016-2812 CVE-2016-2813 CVE-2016-2814 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update to Mozilla Firefox 46.0 fixes several security issues and bugs (boo#977333). The following vulnerabilities were fixed: - CVE-2016-2804: Miscellaneous memory safety hazards - MFSA 2016-39 (boo#977373) - CVE-2016-2806: Miscellaneous memory safety hazards - MFSA 2016-39 (boo#977375) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (boo#977376) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (boo#977386) - CVE-2016-2811: Use-after-free in Service Worker - MFSA 2016-42 (boo#977379) - CVE-2016-2812: Buffer overflow in Service Worker - MFSA 2016-42 (boo#977379) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (boo#977381) - CVE-2016-2816: CSP not applied to pages sent with multipart/x-mixed-replace - MFSA 2016-45 (boo#977382) - CVE-2016-2817: Elevation of privilege with chrome.tabs.update API in web extensions - MFSA 2016-46 (boo#977384) - CVE-2016-2820: Firefox Health Reports could accept events from untrusted domains - MFSA 2016-48 (boo#977388) The following miscellaneous changes are included: - Improved security of the JavaScript Just In Time (JIT) Compiler - WebRTC fixes to improve performance and stability - Added support for document.elementsFromPoint - Added HKDF support for Web Crypto API The minimum requirements increased to NSPR 4.12 and NSS 3.22.3. Mozilla NSS was updated to 3.22.3 as a dependency for Mozilla Firefox 46.0, with the following changes: - Increase compatibility of TLS extended master secret, don't send an empty TLS extension last in the handshake (bmo#1243641) - RSA-PSS signatures are now supported - Pseudorandom functions based on hashes other than SHA-1 are now supported - Enforce an External Policy on NSS from a config file Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-566=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-46.0-113.2 MozillaFirefox-branding-upstream-46.0-113.2 MozillaFirefox-buildsymbols-46.0-113.2 MozillaFirefox-debuginfo-46.0-113.2 MozillaFirefox-debugsource-46.0-113.2 MozillaFirefox-devel-46.0-113.2 MozillaFirefox-translations-common-46.0-113.2 MozillaFirefox-translations-other-46.0-113.2 libfreebl3-3.22.3-77.1 libfreebl3-debuginfo-3.22.3-77.1 libsoftokn3-3.22.3-77.1 libsoftokn3-debuginfo-3.22.3-77.1 mozilla-nss-3.22.3-77.1 mozilla-nss-certs-3.22.3-77.1 mozilla-nss-certs-debuginfo-3.22.3-77.1 mozilla-nss-debuginfo-3.22.3-77.1 mozilla-nss-debugsource-3.22.3-77.1 mozilla-nss-devel-3.22.3-77.1 mozilla-nss-sysinit-3.22.3-77.1 mozilla-nss-sysinit-debuginfo-3.22.3-77.1 mozilla-nss-tools-3.22.3-77.1 mozilla-nss-tools-debuginfo-3.22.3-77.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.22.3-77.1 libfreebl3-debuginfo-32bit-3.22.3-77.1 libsoftokn3-32bit-3.22.3-77.1 libsoftokn3-debuginfo-32bit-3.22.3-77.1 mozilla-nss-32bit-3.22.3-77.1 mozilla-nss-certs-32bit-3.22.3-77.1 mozilla-nss-certs-debuginfo-32bit-3.22.3-77.1 mozilla-nss-debuginfo-32bit-3.22.3-77.1 mozilla-nss-sysinit-32bit-3.22.3-77.1 mozilla-nss-sysinit-debuginfo-32bit-3.22.3-77.1 References: https://www.suse.com/security/cve/CVE-2016-2804.html https://www.suse.com/security/cve/CVE-2016-2806.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2808.html https://www.suse.com/security/cve/CVE-2016-2809.html https://www.suse.com/security/cve/CVE-2016-2810.html https://www.suse.com/security/cve/CVE-2016-2811.html https://www.suse.com/security/cve/CVE-2016-2812.html https://www.suse.com/security/cve/CVE-2016-2813.html https://www.suse.com/security/cve/CVE-2016-2814.html https://www.suse.com/security/cve/CVE-2016-2816.html https://www.suse.com/security/cve/CVE-2016-2817.html https://www.suse.com/security/cve/CVE-2016-2820.html https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977373 https://bugzilla.suse.com/977375 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/977377 https://bugzilla.suse.com/977378 https://bugzilla.suse.com/977379 https://bugzilla.suse.com/977380 https://bugzilla.suse.com/977381 https://bugzilla.suse.com/977382 https://bugzilla.suse.com/977384 https://bugzilla.suse.com/977386 https://bugzilla.suse.com/977388

1 0

openSUSE-SU-2016:1243-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1243-1 Rating: important References: #958501 #976942 #976943 #977614 #977615 #977616 #977617 #977621 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse - bsc#977621: Preserve negotiated digests for SNI (bsc#977621) - bsc#958501: Fix openssl enc -non-fips-allow option in FIPS mode (bsc#958501) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-564=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-15.1 libopenssl1_0_0-1.0.1i-15.1 libopenssl1_0_0-debuginfo-1.0.1i-15.1 libopenssl1_0_0-hmac-1.0.1i-15.1 openssl-1.0.1i-15.1 openssl-debuginfo-1.0.1i-15.1 openssl-debugsource-1.0.1i-15.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-15.1 libopenssl1_0_0-32bit-1.0.1i-15.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-15.1 libopenssl1_0_0-hmac-32bit-1.0.1i-15.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-15.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/958501 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617 https://bugzilla.suse.com/977621

1 0

openSUSE-SU-2016:1242-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1242-1 Rating: important References: #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-565=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-565=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl0_9_8-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-0.9.8zh-17.1 libopenssl0_9_8-debugsource-0.9.8zh-17.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-17.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-17.1 - openSUSE 13.2 (i586 x86_64): libopenssl0_9_8-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-0.9.8zh-9.6.1 libopenssl0_9_8-debugsource-0.9.8zh-9.6.1 - openSUSE 13.2 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-9.6.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-9.6.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617

1 0

openSUSE-SU-2016:1241-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1241-1 Rating: important References: #963415 #968046 #968048 #968050 #968374 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse and updates the package to version 0.9.8zh which collects many other fixes, including security ones. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-563=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl0_9_8-0.9.8zh-5.3.1 libopenssl0_9_8-debuginfo-0.9.8zh-5.3.1 libopenssl0_9_8-debugsource-0.9.8zh-5.3.1 - openSUSE 13.1 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-5.3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-5.3.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/968374 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617

1 0

openSUSE-SU-2016:1240-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1240-1 Rating: important References: #976942 #976943 #977614 #977615 #977616 #977617 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-562=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.87.1 libopenssl1_0_0-1.0.1k-11.87.1 libopenssl1_0_0-debuginfo-1.0.1k-11.87.1 openssl-1.0.1k-11.87.1 openssl-debuginfo-1.0.1k-11.87.1 openssl-debugsource-1.0.1k-11.87.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.87.1 libopenssl1_0_0-32bit-1.0.1k-11.87.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.87.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.87.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617

1 0

openSUSE-SU-2016:1239-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1239-1 Rating: important References: #963415 #968046 #968048 #968050 #968374 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse and updates the package to version 0.9.8zh which collects many other fixes, including security ones. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-563=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libopenssl0_9_8-0.9.8zh-14.1 libopenssl0_9_8-debuginfo-0.9.8zh-14.1 libopenssl0_9_8-debugsource-0.9.8zh-14.1 - openSUSE Evergreen 11.4 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-14.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-14.1 - openSUSE Evergreen 11.4 (ia64): libopenssl0_9_8-debuginfo-x86-0.9.8zh-14.1 libopenssl0_9_8-x86-0.9.8zh-14.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/968374 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617

1 0