June 2017 - openSUSE Security Announce

[security-announce] SUSE-SU-2017:1745-1: important: Security update for unrar
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for unrar ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1745-1 Rating: important References: #1045315 Cross-References: CVE-2012-6706 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for unrar fixes the following issues: - CVE-2012-6706: decoding malicious RAR files could have lead to memory corruption or code execution. (bsc#1045315). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1085=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1085=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1085=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1085=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1085=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1085=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1085=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libunrar-devel-5.0.14-3.1 libunrar5_0_14-5.0.14-3.1 libunrar5_0_14-debuginfo-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): unrar-5.0.14-3.1 unrar-debuginfo-5.0.14-3.1 unrar-debugsource-5.0.14-3.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1045315 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1744-1: important: Security update for python-pycrypto
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for python-pycrypto ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1744-1 Rating: important References: #1017420 Cross-References: CVE-2013-7459 Affected Products: SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-pycrypto fixes the following issues: - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS: zypper in -t patch slesctsp4-python-pycrypto-13187=1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS: zypper in -t patch slesctsp3-python-pycrypto-13187=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): python-pycrypto-2.6.1-5.1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): python-pycrypto-2.6.1-5.1 References: https://www.suse.com/security/cve/CVE-2013-7459.html https://bugzilla.suse.com/1017420 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1742-1: important: Security update for xen
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1742-1 Rating: important References: #1027519 #1035642 #1037243 #1042160 #1042882 #1042893 #1042915 #1042923 #1042924 #1042931 #1042938 Cross-References: CVE-2017-8309 CVE-2017-9330 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 9 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Missing NULL pointer check in event channel poll allows guests to DoS the host (XSA-221, bsc#1042924) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) - PKRU and BND* leakage between vCPU-s might have leaked information to other guests (XSA-220, bsc#1042923) These non-security issues were fixed: - bsc#1027519: Included various upstream patches - bsc#1035642: Ensure that rpmbuild works Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1087=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1087=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1087=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.2_06-42.1 xen-devel-4.7.2_06-42.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.2_06-42.1 xen-debugsource-4.7.2_06-42.1 xen-doc-html-4.7.2_06-42.1 xen-libs-32bit-4.7.2_06-42.1 xen-libs-4.7.2_06-42.1 xen-libs-debuginfo-32bit-4.7.2_06-42.1 xen-libs-debuginfo-4.7.2_06-42.1 xen-tools-4.7.2_06-42.1 xen-tools-debuginfo-4.7.2_06-42.1 xen-tools-domU-4.7.2_06-42.1 xen-tools-domU-debuginfo-4.7.2_06-42.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.2_06-42.1 xen-debugsource-4.7.2_06-42.1 xen-libs-32bit-4.7.2_06-42.1 xen-libs-4.7.2_06-42.1 xen-libs-debuginfo-32bit-4.7.2_06-42.1 xen-libs-debuginfo-4.7.2_06-42.1 References: https://www.suse.com/security/cve/CVE-2017-8309.html https://www.suse.com/security/cve/CVE-2017-9330.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1035642 https://bugzilla.suse.com/1037243 https://bugzilla.suse.com/1042160 https://bugzilla.suse.com/1042882 https://bugzilla.suse.com/1042893 https://bugzilla.suse.com/1042915 https://bugzilla.suse.com/1042923 https://bugzilla.suse.com/1042924 https://bugzilla.suse.com/1042931 https://bugzilla.suse.com/1042938 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1738-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1738-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1078=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1078=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): bind-doc-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): bind-9.9.9P1-28.37.1 bind-chrootenv-9.9.9P1-28.37.1 bind-debuginfo-9.9.9P1-28.37.1 bind-debugsource-9.9.9P1-28.37.1 bind-devel-9.9.9P1-28.37.1 bind-libs-32bit-9.9.9P1-28.37.1 bind-libs-9.9.9P1-28.37.1 bind-libs-debuginfo-32bit-9.9.9P1-28.37.1 bind-libs-debuginfo-9.9.9P1-28.37.1 bind-utils-9.9.9P1-28.37.1 bind-utils-debuginfo-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-28.37.1 bind-chrootenv-9.9.9P1-28.37.1 bind-debuginfo-9.9.9P1-28.37.1 bind-debugsource-9.9.9P1-28.37.1 bind-devel-9.9.9P1-28.37.1 bind-libs-9.9.9P1-28.37.1 bind-libs-debuginfo-9.9.9P1-28.37.1 bind-utils-9.9.9P1-28.37.1 bind-utils-debuginfo-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-28.37.1 bind-libs-debuginfo-32bit-9.9.9P1-28.37.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): bind-doc-9.9.9P1-28.37.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1737-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1737-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-13185=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-13185=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-bind-13185=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-bind-13185=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-13185=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-13185=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.50.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-devel-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.50.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): bind-9.9.6P1-0.50.1 bind-chrootenv-9.9.6P1-0.50.1 bind-devel-9.9.6P1-0.50.1 bind-doc-9.9.6P1-0.50.1 bind-libs-9.9.6P1-0.50.1 bind-utils-9.9.6P1-0.50.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.50.1 bind-debugsource-9.9.6P1-0.50.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): bind-debuginfo-9.9.6P1-0.50.1 bind-debugsource-9.9.6P1-0.50.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1736-1: important: Security update for bind
by opensuse-security＠opensuse.org 30 Jun '17

30 Jun '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1736-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1080=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1080=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1080=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1080=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1080=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): bind-doc-9.9.9P1-62.1 - SUSE OpenStack Cloud 6 (x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-32bit-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-62.1 bind-chrootenv-9.9.9P1-62.1 bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-devel-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): bind-doc-9.9.9P1-62.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): bind-debuginfo-9.9.9P1-62.1 bind-debugsource-9.9.9P1-62.1 bind-libs-32bit-9.9.9P1-62.1 bind-libs-9.9.9P1-62.1 bind-libs-debuginfo-32bit-9.9.9P1-62.1 bind-libs-debuginfo-9.9.9P1-62.1 bind-utils-9.9.9P1-62.1 bind-utils-debuginfo-9.9.9P1-62.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1735-1: important: Security update for the Linux kernel
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for the Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1735-1 Rating: important References: #1045340 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Linux kernel update for SUSE Linux Enterprise 12 fixes the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1077=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1077=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-1077=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): kernel-devel-3.12.61-52.80.1 kernel-macros-3.12.61-52.80.1 kernel-source-3.12.61-52.80.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): kernel-default-3.12.61-52.80.1 kernel-default-base-3.12.61-52.80.1 kernel-default-base-debuginfo-3.12.61-52.80.1 kernel-default-debuginfo-3.12.61-52.80.1 kernel-default-debugsource-3.12.61-52.80.1 kernel-default-devel-3.12.61-52.80.1 kernel-syms-3.12.61-52.80.1 kernel-xen-3.12.61-52.80.1 kernel-xen-base-3.12.61-52.80.1 kernel-xen-base-debuginfo-3.12.61-52.80.1 kernel-xen-debuginfo-3.12.61-52.80.1 kernel-xen-debugsource-3.12.61-52.80.1 kernel-xen-devel-3.12.61-52.80.1 kgraft-patch-3_12_61-52_80-default-1-2.1 kgraft-patch-3_12_61-52_80-xen-1-2.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.61-52.80.1 kernel-default-base-3.12.61-52.80.1 kernel-default-base-debuginfo-3.12.61-52.80.1 kernel-default-debuginfo-3.12.61-52.80.1 kernel-default-debugsource-3.12.61-52.80.1 kernel-default-devel-3.12.61-52.80.1 kernel-syms-3.12.61-52.80.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.61-52.80.1 kernel-macros-3.12.61-52.80.1 kernel-source-3.12.61-52.80.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.61-52.80.1 kernel-xen-base-3.12.61-52.80.1 kernel-xen-base-debuginfo-3.12.61-52.80.1 kernel-xen-debuginfo-3.12.61-52.80.1 kernel-xen-debugsource-3.12.61-52.80.1 kernel-xen-devel-3.12.61-52.80.1 kgraft-patch-3_12_61-52_80-default-1-2.1 kgraft-patch-3_12_61-52_80-xen-1-2.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.61-52.80.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.61-52.80.1 kernel-ec2-debuginfo-3.12.61-52.80.1 kernel-ec2-debugsource-3.12.61-52.80.1 kernel-ec2-devel-3.12.61-52.80.1 kernel-ec2-extra-3.12.61-52.80.1 kernel-ec2-extra-debuginfo-3.12.61-52.80.1 References: https://bugzilla.suse.com/1045340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1718-1: important: Security update for openvpn-openssl1
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for openvpn-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1718-1 Rating: important References: #1038709 #1038711 #1038713 #1044947 #959511 #988522 Cross-References: CVE-2017-7478 CVE-2017-7479 CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for openvpn-openssl1 fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a (quite inefficient) DoS attack on the server. [bsc#1044947, CVE-2017-7521] - The ASN1 parsing code contained a bug that could have resulted in some buffers being free()d twice, and this issue could have potentially been triggered remotely by a VPN peer. [bsc#1044947, CVE-2017-7521] - If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker between client and proxy could cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory was likely to contain the proxy password. If the proxy password had not been reused, this was unlikely to compromise the security of the OpenVPN tunnel itself. Clients who did not use the --http-proxy option with ntlm2 authentication were not affected. [bsc#1044947, CVE-2017-7520] - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] - The installed sample configuration file was updated to comply to FIPS requirements. [bsc#988522] - Remedy large latencies on the openVPN server during authentication process. [bsc#959511] - Fix potential denial-of-service attacks found during independent audits. [bsc#1038713, bsc#1038709, CVE-2017-7478, bsc#1038711, CVE-2017-7479] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openvpn-openssl1-13182=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openvpn-openssl1-2.3.2-0.9.1 openvpn-openssl1-down-root-plugin-2.3.2-0.9.1 References: https://www.suse.com/security/cve/CVE-2017-7478.html https://www.suse.com/security/cve/CVE-2017-7479.html https://www.suse.com/security/cve/CVE-2017-7508.html https://www.suse.com/security/cve/CVE-2017-7520.html https://www.suse.com/security/cve/CVE-2017-7521.html https://bugzilla.suse.com/1038709 https://bugzilla.suse.com/1038711 https://bugzilla.suse.com/1038713 https://bugzilla.suse.com/1044947 https://bugzilla.suse.com/959511 https://bugzilla.suse.com/988522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1716-1: important: Security update for clamav
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1716-1 Rating: important References: #1040662 #1045490 Cross-References: CVE-2012-6706 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for clamav fixes the following issues: Security issue fixed: - CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490) Non security issues fixed: - Provide and obsolete clamav-nodb to trigger its removal in openSUSE Leap. (bsc#1040662) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1069=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-1069=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1069=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1069=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1069=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1069=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1069=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): clamav-0.99.2-32.1 clamav-debuginfo-0.99.2-32.1 clamav-debugsource-0.99.2-32.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1040662 https://bugzilla.suse.com/1045490 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:1715-1: important: Security update for xen
by opensuse-security＠opensuse.org 29 Jun '17

29 Jun '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:1715-1 Rating: important References: #1034845 #1037243 #1042160 #1042863 #1042882 #1042893 #1042915 #1042931 #1042938 Cross-References: CVE-2017-8309 CVE-2017-8905 CVE-2017-9330 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: This update for xen fixes the following security issues: - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests (XSA-216, bsc#1042863) - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) - CVE-2017-8905: Xen a failsafe callback, which might have allowed PV guest OS users to execute arbitrary code on the host OS (XSA-215, bsc#1034845). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13181=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13181=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13181=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.102-44.1 xen-libs-4.2.5_21-44.1 xen-tools-domU-4.2.5_21-44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-44.1 xen-doc-html-4.2.5_21-44.1 xen-doc-pdf-4.2.5_21-44.1 xen-libs-32bit-4.2.5_21-44.1 xen-tools-4.2.5_21-44.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.102-44.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.102-44.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.102-44.1 xen-libs-4.2.5_21-44.1 xen-tools-domU-4.2.5_21-44.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-44.1 xen-debugsource-4.2.5_21-44.1 References: https://www.suse.com/security/cve/CVE-2017-8309.html https://www.suse.com/security/cve/CVE-2017-8905.html https://www.suse.com/security/cve/CVE-2017-9330.html https://bugzilla.suse.com/1034845 https://bugzilla.suse.com/1037243 https://bugzilla.suse.com/1042160 https://bugzilla.suse.com/1042863 https://bugzilla.suse.com/1042882 https://bugzilla.suse.com/1042893 https://bugzilla.suse.com/1042915 https://bugzilla.suse.com/1042931 https://bugzilla.suse.com/1042938 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0