SUSE-SU-2016:2353-1: moderate: Security update for yast2-storage

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for yast2-storage
______________________________________________________________________________

Announcement ID:    SUSE-SU-2016:2353-1
Rating:             moderate
References:         #937942 #984245 #986971 #996208 
Cross-References:   CVE-2016-5746
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:


   This update for yast2-storage provides the following fixes:

   Security issues fixed:
   - Use standard IPC, and not temporary files, to pass passwords between
     processes. (bsc#986971, CVE-2016-5746)

   Non security bugs fixed:
   - Fix usage of complete multipath disk as LVM physical volume. (bsc#984245)
   - Load the correct multipath module (dm-multipath). (bsc#937942)
   - Improve message for creating volumes with a filesystem but without a
     mount point. (bsc#996208)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-yast2-storage-12756=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-yast2-storage-12756=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-yast2-storage-12756=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      yast2-storage-devel-2.17.161-5.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      yast2-storage-2.17.161-5.1
      yast2-storage-lib-2.17.161-5.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      yast2-storage-debuginfo-2.17.161-5.1
      yast2-storage-debugsource-2.17.161-5.1


References:

   https://www.suse.com/security/cve/CVE-2016-5746.html
   https://bugzilla.suse.com/937942
   https://bugzilla.suse.com/984245
   https://bugzilla.suse.com/986971
   https://bugzilla.suse.com/996208