April 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:1177-1: important: Security update for ntp
by opensuse-security＠opensuse.org 28 Apr '16

28 Apr '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1177-1 Rating: important References: #782060 #916617 #937837 #951559 #951629 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 8 fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 12 security issues. Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-694=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-694=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-694=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (noarch): yast2-ntp-client-devel-doc-3.1.22-6.2 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): ntp-4.2.8p6-8.2 ntp-debuginfo-4.2.8p6-8.2 ntp-debugsource-4.2.8p6-8.2 ntp-doc-4.2.8p6-8.2 - SUSE Linux Enterprise Server 12-SP1 (noarch): yast2-ntp-client-3.1.22-6.2 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): ntp-4.2.8p6-8.2 ntp-debuginfo-4.2.8p6-8.2 ntp-debugsource-4.2.8p6-8.2 ntp-doc-4.2.8p6-8.2 - SUSE Linux Enterprise Desktop 12-SP1 (noarch): yast2-ntp-client-3.1.22-6.2 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1175-1: important: Security update for ntp
by opensuse-security＠opensuse.org 28 Apr '16

28 Apr '16

SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1175-1 Rating: important References: #782060 #784760 #916617 #951559 #951629 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 8 fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 12 security issues. These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - bsc#784760: Remove local clock from default configuration Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ntp-12533=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ntp-12533=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-4.2.8p6-8.2 ntp-doc-4.2.8p6-8.2 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ntp-debuginfo-4.2.8p6-8.2 ntp-debugsource-4.2.8p6-8.2 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/784760 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1173-1: important: Security update for php5
by opensuse-security＠opensuse.org 28 Apr '16

28 Apr '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1173-1 Rating: important References: #968284 #969821 #971611 #971612 #971912 #973351 #973792 Cross-References: CVE-2014-9767 CVE-2015-8835 CVE-2015-8838 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-517=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-44.1 apache2-mod_php5-debuginfo-5.5.14-44.1 php5-5.5.14-44.1 php5-bcmath-5.5.14-44.1 php5-bcmath-debuginfo-5.5.14-44.1 php5-bz2-5.5.14-44.1 php5-bz2-debuginfo-5.5.14-44.1 php5-calendar-5.5.14-44.1 php5-calendar-debuginfo-5.5.14-44.1 php5-ctype-5.5.14-44.1 php5-ctype-debuginfo-5.5.14-44.1 php5-curl-5.5.14-44.1 php5-curl-debuginfo-5.5.14-44.1 php5-dba-5.5.14-44.1 php5-dba-debuginfo-5.5.14-44.1 php5-debuginfo-5.5.14-44.1 php5-debugsource-5.5.14-44.1 php5-devel-5.5.14-44.1 php5-dom-5.5.14-44.1 php5-dom-debuginfo-5.5.14-44.1 php5-enchant-5.5.14-44.1 php5-enchant-debuginfo-5.5.14-44.1 php5-exif-5.5.14-44.1 php5-exif-debuginfo-5.5.14-44.1 php5-fastcgi-5.5.14-44.1 php5-fastcgi-debuginfo-5.5.14-44.1 php5-fileinfo-5.5.14-44.1 php5-fileinfo-debuginfo-5.5.14-44.1 php5-firebird-5.5.14-44.1 php5-firebird-debuginfo-5.5.14-44.1 php5-fpm-5.5.14-44.1 php5-fpm-debuginfo-5.5.14-44.1 php5-ftp-5.5.14-44.1 php5-ftp-debuginfo-5.5.14-44.1 php5-gd-5.5.14-44.1 php5-gd-debuginfo-5.5.14-44.1 php5-gettext-5.5.14-44.1 php5-gettext-debuginfo-5.5.14-44.1 php5-gmp-5.5.14-44.1 php5-gmp-debuginfo-5.5.14-44.1 php5-iconv-5.5.14-44.1 php5-iconv-debuginfo-5.5.14-44.1 php5-imap-5.5.14-44.1 php5-imap-debuginfo-5.5.14-44.1 php5-intl-5.5.14-44.1 php5-intl-debuginfo-5.5.14-44.1 php5-json-5.5.14-44.1 php5-json-debuginfo-5.5.14-44.1 php5-ldap-5.5.14-44.1 php5-ldap-debuginfo-5.5.14-44.1 php5-mbstring-5.5.14-44.1 php5-mbstring-debuginfo-5.5.14-44.1 php5-mcrypt-5.5.14-44.1 php5-mcrypt-debuginfo-5.5.14-44.1 php5-mssql-5.5.14-44.1 php5-mssql-debuginfo-5.5.14-44.1 php5-mysql-5.5.14-44.1 php5-mysql-debuginfo-5.5.14-44.1 php5-odbc-5.5.14-44.1 php5-odbc-debuginfo-5.5.14-44.1 php5-opcache-5.5.14-44.1 php5-opcache-debuginfo-5.5.14-44.1 php5-openssl-5.5.14-44.1 php5-openssl-debuginfo-5.5.14-44.1 php5-pcntl-5.5.14-44.1 php5-pcntl-debuginfo-5.5.14-44.1 php5-pdo-5.5.14-44.1 php5-pdo-debuginfo-5.5.14-44.1 php5-pgsql-5.5.14-44.1 php5-pgsql-debuginfo-5.5.14-44.1 php5-phar-5.5.14-44.1 php5-phar-debuginfo-5.5.14-44.1 php5-posix-5.5.14-44.1 php5-posix-debuginfo-5.5.14-44.1 php5-pspell-5.5.14-44.1 php5-pspell-debuginfo-5.5.14-44.1 php5-readline-5.5.14-44.1 php5-readline-debuginfo-5.5.14-44.1 php5-shmop-5.5.14-44.1 php5-shmop-debuginfo-5.5.14-44.1 php5-snmp-5.5.14-44.1 php5-snmp-debuginfo-5.5.14-44.1 php5-soap-5.5.14-44.1 php5-soap-debuginfo-5.5.14-44.1 php5-sockets-5.5.14-44.1 php5-sockets-debuginfo-5.5.14-44.1 php5-sqlite-5.5.14-44.1 php5-sqlite-debuginfo-5.5.14-44.1 php5-suhosin-5.5.14-44.1 php5-suhosin-debuginfo-5.5.14-44.1 php5-sysvmsg-5.5.14-44.1 php5-sysvmsg-debuginfo-5.5.14-44.1 php5-sysvsem-5.5.14-44.1 php5-sysvsem-debuginfo-5.5.14-44.1 php5-sysvshm-5.5.14-44.1 php5-sysvshm-debuginfo-5.5.14-44.1 php5-tidy-5.5.14-44.1 php5-tidy-debuginfo-5.5.14-44.1 php5-tokenizer-5.5.14-44.1 php5-tokenizer-debuginfo-5.5.14-44.1 php5-wddx-5.5.14-44.1 php5-wddx-debuginfo-5.5.14-44.1 php5-xmlreader-5.5.14-44.1 php5-xmlreader-debuginfo-5.5.14-44.1 php5-xmlrpc-5.5.14-44.1 php5-xmlrpc-debuginfo-5.5.14-44.1 php5-xmlwriter-5.5.14-44.1 php5-xmlwriter-debuginfo-5.5.14-44.1 php5-xsl-5.5.14-44.1 php5-xsl-debuginfo-5.5.14-44.1 php5-zip-5.5.14-44.1 php5-zip-debuginfo-5.5.14-44.1 php5-zlib-5.5.14-44.1 php5-zlib-debuginfo-5.5.14-44.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-44.1 References: https://www.suse.com/security/cve/CVE-2014-9767.html https://www.suse.com/security/cve/CVE-2015-8835.html https://www.suse.com/security/cve/CVE-2015-8838.html https://www.suse.com/security/cve/CVE-2016-2554.html https://www.suse.com/security/cve/CVE-2016-3141.html https://www.suse.com/security/cve/CVE-2016-3142.html https://www.suse.com/security/cve/CVE-2016-3185.html https://bugzilla.suse.com/968284 https://bugzilla.suse.com/969821 https://bugzilla.suse.com/971611 https://bugzilla.suse.com/971612 https://bugzilla.suse.com/971912 https://bugzilla.suse.com/973351 https://bugzilla.suse.com/973792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1167-1: important: Security update for php5
by opensuse-security＠opensuse.org 27 Apr '16

27 Apr '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1167-1 Rating: important References: #969821 #971611 #971612 #971912 #973351 #973792 #974305 Cross-References: CVE-2014-9767 CVE-2015-8835 CVE-2015-8838 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for php5 fixes the following security issues: - bsc#974305: buffer overflow in libmagic - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s__call method suffered from type confusion issue (bnc#973351). - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-516=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-53.3 apache2-mod_php5-debuginfo-5.6.1-53.3 php5-5.6.1-53.3 php5-bcmath-5.6.1-53.3 php5-bcmath-debuginfo-5.6.1-53.3 php5-bz2-5.6.1-53.3 php5-bz2-debuginfo-5.6.1-53.3 php5-calendar-5.6.1-53.3 php5-calendar-debuginfo-5.6.1-53.3 php5-ctype-5.6.1-53.3 php5-ctype-debuginfo-5.6.1-53.3 php5-curl-5.6.1-53.3 php5-curl-debuginfo-5.6.1-53.3 php5-dba-5.6.1-53.3 php5-dba-debuginfo-5.6.1-53.3 php5-debuginfo-5.6.1-53.3 php5-debugsource-5.6.1-53.3 php5-devel-5.6.1-53.3 php5-dom-5.6.1-53.3 php5-dom-debuginfo-5.6.1-53.3 php5-enchant-5.6.1-53.3 php5-enchant-debuginfo-5.6.1-53.3 php5-exif-5.6.1-53.3 php5-exif-debuginfo-5.6.1-53.3 php5-fastcgi-5.6.1-53.3 php5-fastcgi-debuginfo-5.6.1-53.3 php5-fileinfo-5.6.1-53.3 php5-fileinfo-debuginfo-5.6.1-53.3 php5-firebird-5.6.1-53.3 php5-firebird-debuginfo-5.6.1-53.3 php5-fpm-5.6.1-53.3 php5-fpm-debuginfo-5.6.1-53.3 php5-ftp-5.6.1-53.3 php5-ftp-debuginfo-5.6.1-53.3 php5-gd-5.6.1-53.3 php5-gd-debuginfo-5.6.1-53.3 php5-gettext-5.6.1-53.3 php5-gettext-debuginfo-5.6.1-53.3 php5-gmp-5.6.1-53.3 php5-gmp-debuginfo-5.6.1-53.3 php5-iconv-5.6.1-53.3 php5-iconv-debuginfo-5.6.1-53.3 php5-imap-5.6.1-53.3 php5-imap-debuginfo-5.6.1-53.3 php5-intl-5.6.1-53.3 php5-intl-debuginfo-5.6.1-53.3 php5-json-5.6.1-53.3 php5-json-debuginfo-5.6.1-53.3 php5-ldap-5.6.1-53.3 php5-ldap-debuginfo-5.6.1-53.3 php5-mbstring-5.6.1-53.3 php5-mbstring-debuginfo-5.6.1-53.3 php5-mcrypt-5.6.1-53.3 php5-mcrypt-debuginfo-5.6.1-53.3 php5-mssql-5.6.1-53.3 php5-mssql-debuginfo-5.6.1-53.3 php5-mysql-5.6.1-53.3 php5-mysql-debuginfo-5.6.1-53.3 php5-odbc-5.6.1-53.3 php5-odbc-debuginfo-5.6.1-53.3 php5-opcache-5.6.1-53.3 php5-opcache-debuginfo-5.6.1-53.3 php5-openssl-5.6.1-53.3 php5-openssl-debuginfo-5.6.1-53.3 php5-pcntl-5.6.1-53.3 php5-pcntl-debuginfo-5.6.1-53.3 php5-pdo-5.6.1-53.3 php5-pdo-debuginfo-5.6.1-53.3 php5-pgsql-5.6.1-53.3 php5-pgsql-debuginfo-5.6.1-53.3 php5-phar-5.6.1-53.3 php5-phar-debuginfo-5.6.1-53.3 php5-posix-5.6.1-53.3 php5-posix-debuginfo-5.6.1-53.3 php5-pspell-5.6.1-53.3 php5-pspell-debuginfo-5.6.1-53.3 php5-readline-5.6.1-53.3 php5-readline-debuginfo-5.6.1-53.3 php5-shmop-5.6.1-53.3 php5-shmop-debuginfo-5.6.1-53.3 php5-snmp-5.6.1-53.3 php5-snmp-debuginfo-5.6.1-53.3 php5-soap-5.6.1-53.3 php5-soap-debuginfo-5.6.1-53.3 php5-sockets-5.6.1-53.3 php5-sockets-debuginfo-5.6.1-53.3 php5-sqlite-5.6.1-53.3 php5-sqlite-debuginfo-5.6.1-53.3 php5-suhosin-5.6.1-53.3 php5-suhosin-debuginfo-5.6.1-53.3 php5-sysvmsg-5.6.1-53.3 php5-sysvmsg-debuginfo-5.6.1-53.3 php5-sysvsem-5.6.1-53.3 php5-sysvsem-debuginfo-5.6.1-53.3 php5-sysvshm-5.6.1-53.3 php5-sysvshm-debuginfo-5.6.1-53.3 php5-tidy-5.6.1-53.3 php5-tidy-debuginfo-5.6.1-53.3 php5-tokenizer-5.6.1-53.3 php5-tokenizer-debuginfo-5.6.1-53.3 php5-wddx-5.6.1-53.3 php5-wddx-debuginfo-5.6.1-53.3 php5-xmlreader-5.6.1-53.3 php5-xmlreader-debuginfo-5.6.1-53.3 php5-xmlrpc-5.6.1-53.3 php5-xmlrpc-debuginfo-5.6.1-53.3 php5-xmlwriter-5.6.1-53.3 php5-xmlwriter-debuginfo-5.6.1-53.3 php5-xsl-5.6.1-53.3 php5-xsl-debuginfo-5.6.1-53.3 php5-zip-5.6.1-53.3 php5-zip-debuginfo-5.6.1-53.3 php5-zlib-5.6.1-53.3 php5-zlib-debuginfo-5.6.1-53.3 - openSUSE 13.2 (noarch): php5-pear-5.6.1-53.3 References: https://www.suse.com/security/cve/CVE-2014-9767.html https://www.suse.com/security/cve/CVE-2015-8835.html https://www.suse.com/security/cve/CVE-2015-8838.html https://www.suse.com/security/cve/CVE-2016-3141.html https://www.suse.com/security/cve/CVE-2016-3142.html https://www.suse.com/security/cve/CVE-2016-3185.html https://bugzilla.suse.com/969821 https://bugzilla.suse.com/971611 https://bugzilla.suse.com/971612 https://bugzilla.suse.com/971912 https://bugzilla.suse.com/973351 https://bugzilla.suse.com/973792 https://bugzilla.suse.com/974305 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1166-1: important: Security update for php5
by opensuse-security＠opensuse.org 27 Apr '16

27 Apr '16

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1166-1 Rating: important References: #968284 #969821 #971611 #971612 #971912 #973351 #973792 Cross-References: CVE-2014-9767 CVE-2015-8835 CVE-2015-8838 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-688=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-688=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-688=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-53.1 php5-debugsource-5.5.14-53.1 php5-devel-5.5.14-53.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-53.1 php5-debugsource-5.5.14-53.1 php5-devel-5.5.14-53.1 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php5-5.5.14-53.1 apache2-mod_php5-debuginfo-5.5.14-53.1 php5-5.5.14-53.1 php5-bcmath-5.5.14-53.1 php5-bcmath-debuginfo-5.5.14-53.1 php5-bz2-5.5.14-53.1 php5-bz2-debuginfo-5.5.14-53.1 php5-calendar-5.5.14-53.1 php5-calendar-debuginfo-5.5.14-53.1 php5-ctype-5.5.14-53.1 php5-ctype-debuginfo-5.5.14-53.1 php5-curl-5.5.14-53.1 php5-curl-debuginfo-5.5.14-53.1 php5-dba-5.5.14-53.1 php5-dba-debuginfo-5.5.14-53.1 php5-debuginfo-5.5.14-53.1 php5-debugsource-5.5.14-53.1 php5-dom-5.5.14-53.1 php5-dom-debuginfo-5.5.14-53.1 php5-enchant-5.5.14-53.1 php5-enchant-debuginfo-5.5.14-53.1 php5-exif-5.5.14-53.1 php5-exif-debuginfo-5.5.14-53.1 php5-fastcgi-5.5.14-53.1 php5-fastcgi-debuginfo-5.5.14-53.1 php5-fileinfo-5.5.14-53.1 php5-fileinfo-debuginfo-5.5.14-53.1 php5-fpm-5.5.14-53.1 php5-fpm-debuginfo-5.5.14-53.1 php5-ftp-5.5.14-53.1 php5-ftp-debuginfo-5.5.14-53.1 php5-gd-5.5.14-53.1 php5-gd-debuginfo-5.5.14-53.1 php5-gettext-5.5.14-53.1 php5-gettext-debuginfo-5.5.14-53.1 php5-gmp-5.5.14-53.1 php5-gmp-debuginfo-5.5.14-53.1 php5-iconv-5.5.14-53.1 php5-iconv-debuginfo-5.5.14-53.1 php5-intl-5.5.14-53.1 php5-intl-debuginfo-5.5.14-53.1 php5-json-5.5.14-53.1 php5-json-debuginfo-5.5.14-53.1 php5-ldap-5.5.14-53.1 php5-ldap-debuginfo-5.5.14-53.1 php5-mbstring-5.5.14-53.1 php5-mbstring-debuginfo-5.5.14-53.1 php5-mcrypt-5.5.14-53.1 php5-mcrypt-debuginfo-5.5.14-53.1 php5-mysql-5.5.14-53.1 php5-mysql-debuginfo-5.5.14-53.1 php5-odbc-5.5.14-53.1 php5-odbc-debuginfo-5.5.14-53.1 php5-opcache-5.5.14-53.1 php5-opcache-debuginfo-5.5.14-53.1 php5-openssl-5.5.14-53.1 php5-openssl-debuginfo-5.5.14-53.1 php5-pcntl-5.5.14-53.1 php5-pcntl-debuginfo-5.5.14-53.1 php5-pdo-5.5.14-53.1 php5-pdo-debuginfo-5.5.14-53.1 php5-pgsql-5.5.14-53.1 php5-pgsql-debuginfo-5.5.14-53.1 php5-posix-5.5.14-53.1 php5-posix-debuginfo-5.5.14-53.1 php5-pspell-5.5.14-53.1 php5-pspell-debuginfo-5.5.14-53.1 php5-shmop-5.5.14-53.1 php5-shmop-debuginfo-5.5.14-53.1 php5-snmp-5.5.14-53.1 php5-snmp-debuginfo-5.5.14-53.1 php5-soap-5.5.14-53.1 php5-soap-debuginfo-5.5.14-53.1 php5-sockets-5.5.14-53.1 php5-sockets-debuginfo-5.5.14-53.1 php5-sqlite-5.5.14-53.1 php5-sqlite-debuginfo-5.5.14-53.1 php5-suhosin-5.5.14-53.1 php5-suhosin-debuginfo-5.5.14-53.1 php5-sysvmsg-5.5.14-53.1 php5-sysvmsg-debuginfo-5.5.14-53.1 php5-sysvsem-5.5.14-53.1 php5-sysvsem-debuginfo-5.5.14-53.1 php5-sysvshm-5.5.14-53.1 php5-sysvshm-debuginfo-5.5.14-53.1 php5-tokenizer-5.5.14-53.1 php5-tokenizer-debuginfo-5.5.14-53.1 php5-wddx-5.5.14-53.1 php5-wddx-debuginfo-5.5.14-53.1 php5-xmlreader-5.5.14-53.1 php5-xmlreader-debuginfo-5.5.14-53.1 php5-xmlrpc-5.5.14-53.1 php5-xmlrpc-debuginfo-5.5.14-53.1 php5-xmlwriter-5.5.14-53.1 php5-xmlwriter-debuginfo-5.5.14-53.1 php5-xsl-5.5.14-53.1 php5-xsl-debuginfo-5.5.14-53.1 php5-zip-5.5.14-53.1 php5-zip-debuginfo-5.5.14-53.1 php5-zlib-5.5.14-53.1 php5-zlib-debuginfo-5.5.14-53.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-53.1 References: https://www.suse.com/security/cve/CVE-2014-9767.html https://www.suse.com/security/cve/CVE-2015-8835.html https://www.suse.com/security/cve/CVE-2015-8838.html https://www.suse.com/security/cve/CVE-2016-2554.html https://www.suse.com/security/cve/CVE-2016-3141.html https://www.suse.com/security/cve/CVE-2016-3142.html https://www.suse.com/security/cve/CVE-2016-3185.html https://bugzilla.suse.com/968284 https://bugzilla.suse.com/969821 https://bugzilla.suse.com/971611 https://bugzilla.suse.com/971612 https://bugzilla.suse.com/971912 https://bugzilla.suse.com/973351 https://bugzilla.suse.com/973792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:1157-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 26 Apr '16

26 Apr '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1157-1 Rating: important References: #974209 Cross-References: CVE-2016-1019 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2016-1019: Adobe Flash Player earlier allowed remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016 Aliased: (bsc#974209). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.616-182.1 flash-player-gnome-11.2.202.616-182.1 flash-player-kde4-11.2.202.616-182.1 References: https://www.suse.com/security/cve/CVE-2016-1019.html https://bugzilla.suse.com/974209 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1154-1: important: Security update for xen
by opensuse-security＠opensuse.org 26 Apr '16

26 Apr '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1154-1 Rating: important References: #864391 #864655 #864769 #864805 #864811 #877642 #897654 #901508 #902737 #945989 #957162 #957988 #958007 #958009 #958491 #958523 #959005 #960707 #960725 #960861 #960862 #961691 #963782 #965315 #965317 #967013 #967630 #969350 Cross-References: CVE-2013-4533 CVE-2013-4534 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3640 CVE-2014-3689 CVE-2014-7815 CVE-2015-5278 CVE-2015-7512 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8743 CVE-2015-8745 CVE-2016-1570 CVE-2016-1571 CVE-2016-1714 CVE-2016-1981 CVE-2016-2270 CVE-2016-2271 CVE-2016-2391 CVE-2016-2841 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS ______________________________________________________________________________ An update that solves 26 vulnerabilities and has two fixes is now available. Description: xen was updated to fix 27 security issues. These security issues were fixed: - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655). - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642). - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162). - CVE-2015-8504: VNC: floating point exception (bsc#958491). - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988). - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007). - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009). - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782). - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315). - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013). - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350). - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523). This non-security issue was fixed: - bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-xen-12530=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): xen-devel-4.1.6_08-26.1 xen-kmp-default-4.1.6_08_3.0.101_0.7.37-26.1 xen-kmp-trace-4.1.6_08_3.0.101_0.7.37-26.1 xen-libs-4.1.6_08-26.1 xen-tools-domU-4.1.6_08-26.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (x86_64): xen-4.1.6_08-26.1 xen-doc-html-4.1.6_08-26.1 xen-doc-pdf-4.1.6_08-26.1 xen-libs-32bit-4.1.6_08-26.1 xen-tools-4.1.6_08-26.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): xen-kmp-pae-4.1.6_08_3.0.101_0.7.37-26.1 References: https://www.suse.com/security/cve/CVE-2013-4533.html https://www.suse.com/security/cve/CVE-2013-4534.html https://www.suse.com/security/cve/CVE-2013-4537.html https://www.suse.com/security/cve/CVE-2013-4538.html https://www.suse.com/security/cve/CVE-2013-4539.html https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-3640.html https://www.suse.com/security/cve/CVE-2014-3689.html https://www.suse.com/security/cve/CVE-2014-7815.html https://www.suse.com/security/cve/CVE-2015-5278.html https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8550.html https://www.suse.com/security/cve/CVE-2015-8554.html https://www.suse.com/security/cve/CVE-2015-8555.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2016-1570.html https://www.suse.com/security/cve/CVE-2016-1571.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2270.html https://www.suse.com/security/cve/CVE-2016-2271.html https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2841.html https://bugzilla.suse.com/864391 https://bugzilla.suse.com/864655 https://bugzilla.suse.com/864769 https://bugzilla.suse.com/864805 https://bugzilla.suse.com/864811 https://bugzilla.suse.com/877642 https://bugzilla.suse.com/897654 https://bugzilla.suse.com/901508 https://bugzilla.suse.com/902737 https://bugzilla.suse.com/945989 https://bugzilla.suse.com/957162 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/958007 https://bugzilla.suse.com/958009 https://bugzilla.suse.com/958491 https://bugzilla.suse.com/958523 https://bugzilla.suse.com/959005 https://bugzilla.suse.com/960707 https://bugzilla.suse.com/960725 https://bugzilla.suse.com/960861 https://bugzilla.suse.com/960862 https://bugzilla.suse.com/961691 https://bugzilla.suse.com/963782 https://bugzilla.suse.com/965315 https://bugzilla.suse.com/965317 https://bugzilla.suse.com/967013 https://bugzilla.suse.com/967630 https://bugzilla.suse.com/969350 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1146-1: important: Security update for portus
by opensuse-security＠opensuse.org 25 Apr '16

25 Apr '16

SUSE Security Update: Security update for portus ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1146-1 Rating: important References: #963326 #963327 #963328 #963563 #963604 #963608 #963617 #963625 #963627 #969943 Cross-References: CVE-2015-7576 CVE-2015-7577 CVE-2015-7578 CVE-2015-7579 CVE-2015-7580 CVE-2015-7581 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753 CVE-2016-2098 Affected Products: SUSE Linux Enterprise Module for Containers 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: Portus was updated to version 2.0.3, which brings several fixes and enhancements: - Fixed crono job when a repository could not be found. - Fixed compatibility issues with Docker 1.10 and Distribution 2.3. - Handle multiple scopes in token requests. - Add optional fields to token response. - Fixed notification events for Distribution v2.3. - Paginate through the catalog properly. - Do not remove all the repositories if fetching one fails. - Fixed SMTP setup. - Don't let crono overflow the 'log' column on the DB. - Show the actual LDAP error on invalid login. - Fixed the location of crono logs. - Always use relative paths. - Set RUBYLIB when using portusctl. - Don't count hidden teams on the admin panel. - Warn developers on unsupported docker-compose versions. - Directly invalidate LDAP logins without name and password. - Don't show the "I forgot my password" link on LDAP. The following Rubygems bundled within Portus have been updated to fix security issues: - CVE-2016-2098: rubygem-actionpack (bsc#969943). - CVE-2015-7578: rails-html-sanitizer (bsc#963326). - CVE-2015-7579: rails-html-sanitizer (bsc#963327). - CVE-2015-7580: rails-html-sanitizer (bsc#963328). - CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563). - CVE-2015-7577: rubygem-activerecord (bsc#963604). - CVE-2016-0751: rugygem-actionpack (bsc#963627). - CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608). - CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617). - CVE-2015-7581: rubygem-actionpack (bsc#963625). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Containers 12: zypper in -t patch SUSE-SLE-Module-Containers-12-2016-672=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Containers 12 (x86_64): portus-2.0.3-2.4 portus-debuginfo-2.0.3-2.4 portus-debugsource-2.0.3-2.4 References: https://www.suse.com/security/cve/CVE-2015-7576.html https://www.suse.com/security/cve/CVE-2015-7577.html https://www.suse.com/security/cve/CVE-2015-7578.html https://www.suse.com/security/cve/CVE-2015-7579.html https://www.suse.com/security/cve/CVE-2015-7580.html https://www.suse.com/security/cve/CVE-2015-7581.html https://www.suse.com/security/cve/CVE-2016-0751.html https://www.suse.com/security/cve/CVE-2016-0752.html https://www.suse.com/security/cve/CVE-2016-0753.html https://www.suse.com/security/cve/CVE-2016-2098.html https://bugzilla.suse.com/963326 https://bugzilla.suse.com/963327 https://bugzilla.suse.com/963328 https://bugzilla.suse.com/963563 https://bugzilla.suse.com/963604 https://bugzilla.suse.com/963608 https://bugzilla.suse.com/963617 https://bugzilla.suse.com/963625 https://bugzilla.suse.com/963627 https://bugzilla.suse.com/969943 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1145-1: important: Security update for php53
by opensuse-security＠opensuse.org 25 Apr '16

25 Apr '16

SUSE Security Update: Security update for php53 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1145-1 Rating: important References: #949961 #968284 #969821 #971611 #971612 #971912 #973351 #973792 Cross-References: CVE-2014-9767 CVE-2015-7803 CVE-2015-8835 CVE-2015-8838 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for php53 fixes the following issues: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2015-7803: A Stack overflow vulnerability when decompressing tar phar archives could potentially lead to code execution. [bsc#949961] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-12527=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-php53-12527=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-php53-12527=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-59.1 php53-imap-5.3.17-59.1 php53-posix-5.3.17-59.1 php53-readline-5.3.17-59.1 php53-sockets-5.3.17-59.1 php53-sqlite-5.3.17-59.1 php53-tidy-5.3.17-59.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-59.1 php53-5.3.17-59.1 php53-bcmath-5.3.17-59.1 php53-bz2-5.3.17-59.1 php53-calendar-5.3.17-59.1 php53-ctype-5.3.17-59.1 php53-curl-5.3.17-59.1 php53-dba-5.3.17-59.1 php53-dom-5.3.17-59.1 php53-exif-5.3.17-59.1 php53-fastcgi-5.3.17-59.1 php53-fileinfo-5.3.17-59.1 php53-ftp-5.3.17-59.1 php53-gd-5.3.17-59.1 php53-gettext-5.3.17-59.1 php53-gmp-5.3.17-59.1 php53-iconv-5.3.17-59.1 php53-intl-5.3.17-59.1 php53-json-5.3.17-59.1 php53-ldap-5.3.17-59.1 php53-mbstring-5.3.17-59.1 php53-mcrypt-5.3.17-59.1 php53-mysql-5.3.17-59.1 php53-odbc-5.3.17-59.1 php53-openssl-5.3.17-59.1 php53-pcntl-5.3.17-59.1 php53-pdo-5.3.17-59.1 php53-pear-5.3.17-59.1 php53-pgsql-5.3.17-59.1 php53-pspell-5.3.17-59.1 php53-shmop-5.3.17-59.1 php53-snmp-5.3.17-59.1 php53-soap-5.3.17-59.1 php53-suhosin-5.3.17-59.1 php53-sysvmsg-5.3.17-59.1 php53-sysvsem-5.3.17-59.1 php53-sysvshm-5.3.17-59.1 php53-tokenizer-5.3.17-59.1 php53-wddx-5.3.17-59.1 php53-xmlreader-5.3.17-59.1 php53-xmlrpc-5.3.17-59.1 php53-xmlwriter-5.3.17-59.1 php53-xsl-5.3.17-59.1 php53-zip-5.3.17-59.1 php53-zlib-5.3.17-59.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): php53-debuginfo-5.3.17-59.1 php53-debugsource-5.3.17-59.1 References: https://www.suse.com/security/cve/CVE-2014-9767.html https://www.suse.com/security/cve/CVE-2015-7803.html https://www.suse.com/security/cve/CVE-2015-8835.html https://www.suse.com/security/cve/CVE-2015-8838.html https://www.suse.com/security/cve/CVE-2016-2554.html https://www.suse.com/security/cve/CVE-2016-3141.html https://www.suse.com/security/cve/CVE-2016-3142.html https://www.suse.com/security/cve/CVE-2016-3185.html https://bugzilla.suse.com/949961 https://bugzilla.suse.com/968284 https://bugzilla.suse.com/969821 https://bugzilla.suse.com/971611 https://bugzilla.suse.com/971612 https://bugzilla.suse.com/971912 https://bugzilla.suse.com/973351 https://bugzilla.suse.com/973792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:1138-1: important: Security update for yast2-users
by opensuse-security＠opensuse.org 25 Apr '16

25 Apr '16

SUSE Security Update: Security update for yast2-users ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1138-1 Rating: important References: #971804 #973639 #974220 Cross-References: CVE-2016-1601 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: yast2-users was updated to fix one security issue. This security issue was fixed: - CVE-2016-1601: Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation (bsc#974220). This update includes a script that fixes installations that we're affected by this problem. It is run automatically upon installing the update. This non-security issue was fixed: - bsc#971804: Set root password correctly when using a minimal profile Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-669=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-669=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-669=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): yast2-users-debuginfo-3.1.41.3-9.1 yast2-users-debugsource-3.1.41.3-9.1 yast2-users-devel-doc-3.1.41.3-9.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): yast2-users-3.1.41.3-9.1 yast2-users-debuginfo-3.1.41.3-9.1 yast2-users-debugsource-3.1.41.3-9.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): yast2-users-3.1.41.3-9.1 yast2-users-debuginfo-3.1.41.3-9.1 yast2-users-debugsource-3.1.41.3-9.1 References: https://www.suse.com/security/cve/CVE-2016-1601.html https://bugzilla.suse.com/971804 https://bugzilla.suse.com/973639 https://bugzilla.suse.com/974220 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0