From sle-security-updates at lists.suse.com Tue Sep 1 10:09:42 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 1 Sep 2015 18:09:42 +0200 (CEST) Subject: SUSE-SU-2015:1472-1: important: Security update for kvm Message-ID: <20150901160942.393BC320FC@maintenance.suse.de> SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1472-1 Rating: important References: #938344 Cross-References: CVE-2015-5154 Affected Products: SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: kvm was updated to fix one security issue. This security issue was fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-kvm-12062=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-kvm-12062=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3 (i586 s390x x86_64): kvm-1.4.2-0.22.34.3 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): kvm-1.4.2-0.22.34.3 References: https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/938344 From sle-security-updates at lists.suse.com Tue Sep 1 10:10:06 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 1 Sep 2015 18:10:06 +0200 (CEST) Subject: SUSE-SU-2015:1473-1: moderate: Security update for subversion Message-ID: <20150901161006.74D7C320FC@maintenance.suse.de> SUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1473-1 Rating: moderate References: #939514 #939517 Cross-References: CVE-2015-3184 CVE-2015-3187 Affected Products: SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: subversion was updated to fix two security issues. These security issues were fixed: - CVE-2015-3187: Information leak (only paths) that were hidden by path-based authz (bsc#939517). - CVE-2015-3184: Information leak in mixed anonymous/authenticated httpd (dav) configurations (bsc#939514). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-470=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libsvn_auth_gnome_keyring-1-0-1.8.10-15.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.10-15.1 libsvn_auth_kwallet-1-0-1.8.10-15.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.10-15.1 subversion-1.8.10-15.1 subversion-debuginfo-1.8.10-15.1 subversion-debugsource-1.8.10-15.1 subversion-devel-1.8.10-15.1 subversion-perl-1.8.10-15.1 subversion-perl-debuginfo-1.8.10-15.1 subversion-python-1.8.10-15.1 subversion-python-debuginfo-1.8.10-15.1 subversion-server-1.8.10-15.1 subversion-server-debuginfo-1.8.10-15.1 subversion-tools-1.8.10-15.1 subversion-tools-debuginfo-1.8.10-15.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): subversion-bash-completion-1.8.10-15.1 References: https://www.suse.com/security/cve/CVE-2015-3184.html https://www.suse.com/security/cve/CVE-2015-3187.html https://bugzilla.suse.com/939514 https://bugzilla.suse.com/939517 From sle-security-updates at lists.suse.com Wed Sep 2 04:09:25 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 12:09:25 +0200 (CEST) Subject: SUSE-SU-2015:1475-1: moderate: Security update for tiff Message-ID: <20150902100925.5F309320FC@maintenance.suse.de> SUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1475-1 Rating: moderate References: #914890 #916927 Cross-References: CVE-2014-8127 CVE-2014-8128 CVE-2014-8129 CVE-2014-8130 CVE-2014-9655 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: LibTiff was updated to the 4.0.4 stable release fixing various security issues and bugs. These security issues were fixed: - CVE-2014-8127: Out-of-bounds write (bnc#914890). - CVE-2014-8128: Out-of-bounds write (bnc#914890). - CVE-2014-8129: Out-of-bounds write (bnc#914890). - CVE-2014-8130: Out-of-bounds write (bnc#914890). - CVE-2014-9655: Access of uninitialized memory (bnc#916927). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-473=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-473=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-473=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libtiff-devel-4.0.4-12.2 tiff-debuginfo-4.0.4-12.2 tiff-debugsource-4.0.4-12.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libtiff5-4.0.4-12.2 libtiff5-debuginfo-4.0.4-12.2 tiff-4.0.4-12.2 tiff-debuginfo-4.0.4-12.2 tiff-debugsource-4.0.4-12.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libtiff5-32bit-4.0.4-12.2 libtiff5-debuginfo-32bit-4.0.4-12.2 - SUSE Linux Enterprise Desktop 12 (x86_64): libtiff5-32bit-4.0.4-12.2 libtiff5-4.0.4-12.2 libtiff5-debuginfo-32bit-4.0.4-12.2 libtiff5-debuginfo-4.0.4-12.2 tiff-debuginfo-4.0.4-12.2 tiff-debugsource-4.0.4-12.2 References: https://www.suse.com/security/cve/CVE-2014-8127.html https://www.suse.com/security/cve/CVE-2014-8128.html https://www.suse.com/security/cve/CVE-2014-8129.html https://www.suse.com/security/cve/CVE-2014-8130.html https://www.suse.com/security/cve/CVE-2014-9655.html https://bugzilla.suse.com/914890 https://bugzilla.suse.com/916927 From sle-security-updates at lists.suse.com Wed Sep 2 04:10:07 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 12:10:07 +0200 (CEST) Subject: SUSE-SU-2015:1476-1: important: Security update for MozillaFirefox, mozilla-nss Message-ID: <20150902101007.28010320FC@maintenance.suse.de> SUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1476-1 Rating: important References: #940806 #943557 #943558 #943608 Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4495 CVE-2015-4497 CVE-2015-4498 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities. - Firefox was updated to 38.2.1 ESR (bsc#943608) * MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling * MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs - Firefox was updated to 38.2.0 ESR (bsc#940806) * MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262) Same origin violation and local file stealing via PDF reader * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130, bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068, bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711) Miscellaneous memory safety hazards (rv:40.0 / rv:38.2) * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107, bmo#1170344, bmo#1186718) Overflow issues in libstagefright * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities found through code inspection * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-472=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-472=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-472=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-devel-38.2.1esr-45.1 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-devel-3.19.2.0-26.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-38.2.1esr-45.1 MozillaFirefox-branding-SLE-31.0-14.1 MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-translations-38.2.1esr-45.1 libfreebl3-3.19.2.0-26.2 libfreebl3-debuginfo-3.19.2.0-26.2 libfreebl3-hmac-3.19.2.0-26.2 libsoftokn3-3.19.2.0-26.2 libsoftokn3-debuginfo-3.19.2.0-26.2 libsoftokn3-hmac-3.19.2.0-26.2 mozilla-nss-3.19.2.0-26.2 mozilla-nss-certs-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-3.19.2.0-26.2 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-tools-3.19.2.0-26.2 mozilla-nss-tools-debuginfo-3.19.2.0-26.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.19.2.0-26.2 libfreebl3-debuginfo-32bit-3.19.2.0-26.2 libfreebl3-hmac-32bit-3.19.2.0-26.2 libsoftokn3-32bit-3.19.2.0-26.2 libsoftokn3-debuginfo-32bit-3.19.2.0-26.2 libsoftokn3-hmac-32bit-3.19.2.0-26.2 mozilla-nss-32bit-3.19.2.0-26.2 mozilla-nss-certs-32bit-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debuginfo-32bit-3.19.2.0-26.2 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-38.2.1esr-45.1 MozillaFirefox-branding-SLE-31.0-14.1 MozillaFirefox-debuginfo-38.2.1esr-45.1 MozillaFirefox-debugsource-38.2.1esr-45.1 MozillaFirefox-translations-38.2.1esr-45.1 libfreebl3-3.19.2.0-26.2 libfreebl3-32bit-3.19.2.0-26.2 libfreebl3-debuginfo-3.19.2.0-26.2 libfreebl3-debuginfo-32bit-3.19.2.0-26.2 libsoftokn3-3.19.2.0-26.2 libsoftokn3-32bit-3.19.2.0-26.2 libsoftokn3-debuginfo-3.19.2.0-26.2 libsoftokn3-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-3.19.2.0-26.2 mozilla-nss-32bit-3.19.2.0-26.2 mozilla-nss-certs-3.19.2.0-26.2 mozilla-nss-certs-32bit-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-3.19.2.0-26.2 mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debuginfo-3.19.2.0-26.2 mozilla-nss-debuginfo-32bit-3.19.2.0-26.2 mozilla-nss-debugsource-3.19.2.0-26.2 mozilla-nss-tools-3.19.2.0-26.2 mozilla-nss-tools-debuginfo-3.19.2.0-26.2 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4474.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4495.html https://www.suse.com/security/cve/CVE-2015-4497.html https://www.suse.com/security/cve/CVE-2015-4498.html https://bugzilla.suse.com/940806 https://bugzilla.suse.com/943557 https://bugzilla.suse.com/943558 https://bugzilla.suse.com/943608 From sle-security-updates at lists.suse.com Wed Sep 2 07:10:15 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 15:10:15 +0200 (CEST) Subject: SUSE-SU-2015:1478-1: important: Security update for the Linux Kernel Message-ID: <20150902131015.46DCC320F6@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1478-1 Rating: important References: #798406 #821931 #860593 #879878 #891087 #897995 #898693 #900881 #904671 #908870 #909477 #912916 #914742 #915200 #915517 #915577 #916010 #917093 #917830 #918333 #919007 #919018 #919463 #921769 #922583 #923245 #926240 #927257 #928801 #929148 #929283 #929360 #929525 #930284 #930934 #931474 #933429 #935705 #936831 #937032 #937986 #940338 #940398 Cross-References: CVE-2014-8086 CVE-2014-8159 CVE-2014-9683 CVE-2015-0777 CVE-2015-1420 CVE-2015-1421 CVE-2015-1805 CVE-2015-2041 CVE-2015-2042 CVE-2015-2150 CVE-2015-2830 CVE-2015-2922 CVE-2015-3331 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 CVE-2015-5707 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that solves 18 vulnerabilities and has 25 fixes is now available. Description: The SUSE Linux Enterprise Server 11 SP2 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code. - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240). - CVE-2015-0777: drivers/xen/usbback/usbback.c in the Linux kernel allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830). - CVE-2015-2150: Xen and the Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bnc#919463). - CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-1420: CVE-2015-1420: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517). - CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705). - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun" (bnc#933429). - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket (bnc#927257). - CVE-2015-2922: The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel allowed remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message (bnc#922583). - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bnc#919007). - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect (bnc#929525). - CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bnc#900881). - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bnc#914742). - CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel allowed local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename (bnc#918333). - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bnc#919018). - CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel allowed remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data (bnc#915577). The following non-security bugs were fixed: - HID: add ALWAYS_POLL quirk for a Logitech 0xc007 (bnc#931474). - HID: add HP OEM mouse to quirk ALWAYS_POLL (bnc#931474). - HID: add quirk for PIXART OEM mouse used by HP (bnc#931474). - HID: usbhid: add always-poll quirk (bnc#931474). - HID: usbhid: add another mouse that needs QUIRK_ALWAYS_POLL (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 009b (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 0103 (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen 016f (bnc#931474). - HID: usbhid: enable always-poll quirk for Elan Touchscreen. - HID: usbhid: fix PIXART optical mouse (bnc#931474). - HID: usbhid: more mice with ALWAYS_POLL (bnc#931474). - HID: usbhid: yet another mouse with ALWAYS_POLL (bnc#931474). - bnx2x: Fix kdump when iommu=on (bug#921769). - cifs: fix use-after-free bug in find_writable_file (bnc#909477). - coredump: ensure the fpu state is flushed for proper multi-threaded core dump (bsc#904671, bsc#929360). - dm: fixed that LVM merge snapshot of root logical volume were not working (bsc#928801) - deal with deadlock in d_walk fix (bnc#929148, bnc#929283). - e1000: do not enable dma receives until after dma address has been setup (bsc#821931). - fsnotify: Fix handling of renames in audit (bnc#915200). - inet: add a redirect generation id in inetpeer (bnc#860593). - inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). - kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). - kernel: fix data corruption when reading /proc/sysinfo (bsc#891087, bsc#937986, LTC#114480). - libata: prevent HSM state change race between ISR and PIO (bsc#923245). - time, ntp: Do not update time_state in middle of leap second (bsc#912916). - s390-3215-tty-close-crash.patch: kernel: 3215 tty close crash (bsc#916010, LTC#120873). - s390-3215-tty-close-race.patch: kernel: 3215 console crash (bsc#916010, LTC#94302). - s390-3215-tty-hang.patch: Renamed from patches.arch/s390-tty-hang.patch. - s390-3215-tty-hang.patch: Update references (bnc#898693, bnc#897995, LTC#114562). - s390-dasd-retry-partition-detection.patch: s390/dasd: retry partition detection (bsc#916010, LTC#94302). - s390-dasd-retry-partition-detection.patch: Update references (bsc#916010, LTC#120565). - s390-sclp-tty-refcount.patch: kernel: sclp console tty reference counting (bsc#916010, LTC#115466). - scsi: vmw_pvscsi: Fix pvscsi_abort() function (bnc#940398 bsc#930934). - scsi/sg: sg_start_req(): make sure that there is not too many elements in iovec (bsc#940338). - x86, xsave: remove thread_has_fpu() bug check in __sanitize_i387_state() (bsc#904671, bsc#929360). - x86-mm-send-tlb-flush-ipis-to-online-cpus-only.patch: x86, mm: Send tlb flush IPIs to online cpus only (bnc#798406). - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - x86/reboot: Fix a warning message triggered by stop_other_cpus() (bnc#930284). - xen: Correctly re-enable interrupts in xen_spin_wait() (bsc#879878, bsc#908870). - xfs: prevent deadlock trying to cover an active log (bsc#917093). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-kernel-20150819-12065=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-kernel-20150819-12065=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): kernel-default-3.0.101-0.7.37.1 kernel-default-base-3.0.101-0.7.37.1 kernel-default-devel-3.0.101-0.7.37.1 kernel-source-3.0.101-0.7.37.1 kernel-syms-3.0.101-0.7.37.1 kernel-trace-3.0.101-0.7.37.1 kernel-trace-base-3.0.101-0.7.37.1 kernel-trace-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): kernel-ec2-3.0.101-0.7.37.1 kernel-ec2-base-3.0.101-0.7.37.1 kernel-ec2-devel-3.0.101-0.7.37.1 kernel-xen-3.0.101-0.7.37.1 kernel-xen-base-3.0.101-0.7.37.1 kernel-xen-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x): kernel-default-man-3.0.101-0.7.37.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): kernel-pae-3.0.101-0.7.37.1 kernel-pae-base-3.0.101-0.7.37.1 kernel-pae-devel-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): kernel-default-debuginfo-3.0.101-0.7.37.1 kernel-default-debugsource-3.0.101-0.7.37.1 kernel-default-devel-debuginfo-3.0.101-0.7.37.1 kernel-trace-debuginfo-3.0.101-0.7.37.1 kernel-trace-debugsource-3.0.101-0.7.37.1 kernel-trace-devel-debuginfo-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.7.37.1 kernel-ec2-debugsource-3.0.101-0.7.37.1 kernel-xen-debuginfo-3.0.101-0.7.37.1 kernel-xen-debugsource-3.0.101-0.7.37.1 kernel-xen-devel-debuginfo-3.0.101-0.7.37.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586): kernel-pae-debuginfo-3.0.101-0.7.37.1 kernel-pae-debugsource-3.0.101-0.7.37.1 kernel-pae-devel-debuginfo-3.0.101-0.7.37.1 References: https://www.suse.com/security/cve/CVE-2014-8086.html https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2014-9683.html https://www.suse.com/security/cve/CVE-2015-0777.html https://www.suse.com/security/cve/CVE-2015-1420.html https://www.suse.com/security/cve/CVE-2015-1421.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-2041.html https://www.suse.com/security/cve/CVE-2015-2042.html https://www.suse.com/security/cve/CVE-2015-2150.html https://www.suse.com/security/cve/CVE-2015-2830.html https://www.suse.com/security/cve/CVE-2015-2922.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://www.suse.com/security/cve/CVE-2015-5707.html https://bugzilla.suse.com/798406 https://bugzilla.suse.com/821931 https://bugzilla.suse.com/860593 https://bugzilla.suse.com/879878 https://bugzilla.suse.com/891087 https://bugzilla.suse.com/897995 https://bugzilla.suse.com/898693 https://bugzilla.suse.com/900881 https://bugzilla.suse.com/904671 https://bugzilla.suse.com/908870 https://bugzilla.suse.com/909477 https://bugzilla.suse.com/912916 https://bugzilla.suse.com/914742 https://bugzilla.suse.com/915200 https://bugzilla.suse.com/915517 https://bugzilla.suse.com/915577 https://bugzilla.suse.com/916010 https://bugzilla.suse.com/917093 https://bugzilla.suse.com/917830 https://bugzilla.suse.com/918333 https://bugzilla.suse.com/919007 https://bugzilla.suse.com/919018 https://bugzilla.suse.com/919463 https://bugzilla.suse.com/921769 https://bugzilla.suse.com/922583 https://bugzilla.suse.com/923245 https://bugzilla.suse.com/926240 https://bugzilla.suse.com/927257 https://bugzilla.suse.com/928801 https://bugzilla.suse.com/929148 https://bugzilla.suse.com/929283 https://bugzilla.suse.com/929360 https://bugzilla.suse.com/929525 https://bugzilla.suse.com/930284 https://bugzilla.suse.com/930934 https://bugzilla.suse.com/931474 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/936831 https://bugzilla.suse.com/937032 https://bugzilla.suse.com/937986 https://bugzilla.suse.com/940338 https://bugzilla.suse.com/940398 From sle-security-updates at lists.suse.com Wed Sep 2 10:09:45 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 18:09:45 +0200 (CEST) Subject: SUSE-SU-2015:1479-1: important: Security update for xen Message-ID: <20150902160945.F2131320FC@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1479-1 Rating: important References: #922709 #932996 #935634 #938344 #939709 #939712 Cross-References: CVE-2015-2751 CVE-2015-3259 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 CVE-2015-5166 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: xen was updated to fix the following security issues: * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model (bsc#939712, XSA-140) * CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol (bsc#939709, XSA-139) * CVE-2015-2751: Certain domctl operations could have be used to lock up the host (bsc#922709, XSA-127) * CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137) * CVE-2015-4164: DoS through iret hypercall handler (bsc#932996, XSA-136) * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-xen-12066=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-xen-12066=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-xen-12066=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-12066=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 x86_64): xen-devel-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (i586 x86_64): xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (x86_64): xen-4.2.5_12-15.1 xen-doc-html-4.2.5_12-15.1 xen-doc-pdf-4.2.5_12-15.1 xen-libs-32bit-4.2.5_12-15.1 xen-tools-4.2.5_12-15.1 - SUSE Linux Enterprise Server 11-SP3 (i586): xen-kmp-pae-4.2.5_12_3.0.101_0.47.55-15.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586): xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-kmp-pae-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_12-15.1 xen-debugsource-4.2.5_12-15.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-4164.html https://www.suse.com/security/cve/CVE-2015-5154.html https://www.suse.com/security/cve/CVE-2015-5165.html https://www.suse.com/security/cve/CVE-2015-5166.html https://bugzilla.suse.com/922709 https://bugzilla.suse.com/932996 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 https://bugzilla.suse.com/939709 https://bugzilla.suse.com/939712 From sle-security-updates at lists.suse.com Wed Sep 2 11:09:31 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 19:09:31 +0200 (CEST) Subject: SUSE-SU-2015:1479-2: important: Security update for xen Message-ID: <20150902170931.18F29320FC@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1479-2 Rating: important References: #922709 #932996 #935634 #938344 #939709 #939712 Cross-References: CVE-2015-2751 CVE-2015-3259 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 CVE-2015-5166 Affected Products: SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: xen was updated to fix the following security issues: * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model (bsc#939712, XSA-140) * CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol (bsc#939709, XSA-139) * CVE-2015-2751: Certain domctl operations could have be used to lock up the host (bsc#922709, XSA-127) * CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137) * CVE-2015-4164: DoS through iret hypercall handler (bsc#932996, XSA-136) * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-xen-12066=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): xen-4.2.5_12-15.1 xen-doc-html-4.2.5_12-15.1 xen-doc-pdf-4.2.5_12-15.1 xen-kmp-default-4.2.5_12_3.0.101_0.47.55-15.1 xen-libs-32bit-4.2.5_12-15.1 xen-libs-4.2.5_12-15.1 xen-tools-4.2.5_12-15.1 xen-tools-domU-4.2.5_12-15.1 References: https://www.suse.com/security/cve/CVE-2015-2751.html https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-4164.html https://www.suse.com/security/cve/CVE-2015-5154.html https://www.suse.com/security/cve/CVE-2015-5165.html https://www.suse.com/security/cve/CVE-2015-5166.html https://bugzilla.suse.com/922709 https://bugzilla.suse.com/932996 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 https://bugzilla.suse.com/939709 https://bugzilla.suse.com/939712 From sle-security-updates at lists.suse.com Wed Sep 2 15:09:48 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 23:09:48 +0200 (CEST) Subject: SUSE-SU-2015:1480-1: important: Security update for bind Message-ID: <20150902210948.D2217320F7@maintenance.suse.de> SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1480-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-12067=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-bind-12067=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-bind-12067=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-12067=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-bind-12067=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-bind-12067=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-bind-12067=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-bind-12067=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-bind-12067=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.15.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64): bind-devel-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): bind-libs-x86-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.15.1 bind-chrootenv-9.9.6P1-0.15.1 bind-devel-9.9.6P1-0.15.1 bind-doc-9.9.6P1-0.15.1 bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): bind-libs-9.9.6P1-0.15.1 bind-utils-9.9.6P1-0.15.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): bind-libs-32bit-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): bind-debuginfo-9.9.6P1-0.15.1 bind-debugsource-9.9.6P1-0.15.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066 From sle-security-updates at lists.suse.com Wed Sep 2 15:10:20 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 2 Sep 2015 23:10:20 +0200 (CEST) Subject: SUSE-SU-2015:1481-1: important: Security update for bind Message-ID: <20150902211020.62971320FC@maintenance.suse.de> SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1481-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-478=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-478=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-478=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-devel-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bind-9.9.6P1-26.1 bind-chrootenv-9.9.6P1-26.1 bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-libs-9.9.6P1-26.1 bind-libs-debuginfo-9.9.6P1-26.1 bind-utils-9.9.6P1-26.1 bind-utils-debuginfo-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): bind-libs-32bit-9.9.6P1-26.1 bind-libs-debuginfo-32bit-9.9.6P1-26.1 - SUSE Linux Enterprise Server 12 (noarch): bind-doc-9.9.6P1-26.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bind-debuginfo-9.9.6P1-26.1 bind-debugsource-9.9.6P1-26.1 bind-libs-32bit-9.9.6P1-26.1 bind-libs-9.9.6P1-26.1 bind-libs-debuginfo-32bit-9.9.6P1-26.1 bind-libs-debuginfo-9.9.6P1-26.1 bind-utils-9.9.6P1-26.1 bind-utils-debuginfo-9.9.6P1-26.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066 From sle-security-updates at lists.suse.com Thu Sep 3 03:09:43 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 3 Sep 2015 11:09:43 +0200 (CEST) Subject: SUSE-SU-2015:1482-1: moderate: Recommended update for openldap2 Message-ID: <20150903090943.4B65A320FC@maintenance.suse.de> SUSE Security Update: Recommended update for openldap2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1482-1 Rating: moderate References: #924496 #932773 #937766 Cross-References: CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: openldap2 was updated to fix one security issue. This security issue was fixed: - CVE-2015-4000: The Logjam Attack / weakdh.org (bsc#937766). This non-security issue was fixed: - bsc#932773: ldapmodify failed with DOS format LDIF files containing "-" separator. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-openldap2-12068=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-openldap2-12068=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-openldap2-12068=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openldap2-12068=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-openldap2-12068=1 - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openldap2-12068=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-openldap2-12068=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-openldap2-12068=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openldap2-12068=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openldap2-12068=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): openldap2-back-perl-2.4.26-0.35.1 openldap2-devel-2.4.26-0.35.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): openldap2-devel-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): openldap2-2.4.26-0.35.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): openldap2-back-perl-2.4.26-0.35.1 openldap2-devel-2.4.26-0.35.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64 s390x x86_64): openldap2-devel-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 x86_64): openldap2-2.4.26-0.35.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): compat-libldap-2_3-0-2.3.37-2.35.1 libldap-2_4-2-2.4.26-0.35.1 openldap2-2.4.26-0.35.1 openldap2-back-meta-2.4.26-0.35.1 openldap2-client-2.4.26-0.35.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libldap-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): compat-libldap-2_3-0-2.3.37-2.35.1 libldap-2_4-2-2.4.26-0.35.1 openldap2-2.4.26-0.35.1 openldap2-back-meta-2.4.26-0.35.1 openldap2-client-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libldap-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libldap-2_4-2-x86-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): compat-libldap-2_3-0-2.3.37-2.35.1 libldap-2_4-2-2.4.26-0.35.1 openldap2-2.4.26-0.35.1 openldap2-back-meta-2.4.26-0.35.1 openldap2-client-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libldap-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libldap-2_4-2-x86-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): libldap-openssl1-2_4-2-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SECURITY (ppc64 s390x x86_64): libldap-openssl1-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Server 11-SECURITY (ia64): libldap-openssl1-2_4-2-x86-2.4.26-0.35.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): libldap-2_4-2-2.4.26-0.35.1 openldap2-client-2.4.26-0.35.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libldap-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): libldap-2_4-2-2.4.26-0.35.1 openldap2-client-2.4.26-0.35.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libldap-2_4-2-32bit-2.4.26-0.35.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openldap2-client-debuginfo-2.4.26-0.35.1 openldap2-client-debugsource-2.4.26-0.35.1 openldap2-debuginfo-2.4.26-0.35.1 openldap2-debugsource-2.4.26-0.35.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): openldap2-client-debuginfo-2.4.26-0.35.1 openldap2-client-debugsource-2.4.26-0.35.1 openldap2-client-openssl1-debuginfo-2.4.26-0.35.1 openldap2-client-openssl1-debugsource-2.4.26-0.35.1 openldap2-debuginfo-2.4.26-0.35.1 openldap2-debugsource-2.4.26-0.35.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/924496 https://bugzilla.suse.com/932773 https://bugzilla.suse.com/937766 From sle-security-updates at lists.suse.com Thu Sep 3 06:09:30 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 3 Sep 2015 14:09:30 +0200 (CEST) Subject: SUSE-SU-2015:1484-1: moderate: Security update for libwmf Message-ID: <20150903120930.4AEA4320FC@maintenance.suse.de> SUSE Security Update: Security update for libwmf ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1484-1 Rating: moderate References: #495842 #831299 #933109 #936058 #936062 Cross-References: CVE-2009-1364 CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: libwmf was updated to fix five security issues. These security issues were fixed: - CVE-2009-1364: Fixed realloc return value usage (bsc#495842, bnc#831299) - CVE-2015-0848: Heap overflow on libwmf0.2-7 (bsc#933109) - CVE-2015-4588: DecodeImage() did not check that the run-length "count" fits into the total size of the image, which could lead to a heap-based buffer overflow (bsc#933109) - CVE-2015-4695: meta_pen_create heap buffer over read (bsc#936058) - CVE-2015-4696: Use after free (bsc#936062) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-481=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-481=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-481=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): libwmf-0_2-7-0.2.8.4-242.3 libwmf-0_2-7-debuginfo-0.2.8.4-242.3 libwmf-debugsource-0.2.8.4-242.3 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libwmf-0_2-7-0.2.8.4-242.3 libwmf-0_2-7-debuginfo-0.2.8.4-242.3 libwmf-debugsource-0.2.8.4-242.3 libwmf-devel-0.2.8.4-242.3 libwmf-gnome-0.2.8.4-242.3 libwmf-gnome-debuginfo-0.2.8.4-242.3 - SUSE Linux Enterprise Desktop 12 (x86_64): libwmf-0_2-7-0.2.8.4-242.3 libwmf-0_2-7-debuginfo-0.2.8.4-242.3 libwmf-debugsource-0.2.8.4-242.3 References: https://www.suse.com/security/cve/CVE-2009-1364.html https://www.suse.com/security/cve/CVE-2015-0848.html https://www.suse.com/security/cve/CVE-2015-4588.html https://www.suse.com/security/cve/CVE-2015-4695.html https://www.suse.com/security/cve/CVE-2015-4696.html https://bugzilla.suse.com/495842 https://bugzilla.suse.com/831299 https://bugzilla.suse.com/933109 https://bugzilla.suse.com/936058 https://bugzilla.suse.com/936062 From sle-security-updates at lists.suse.com Fri Sep 4 04:09:22 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 12:09:22 +0200 (CEST) Subject: SUSE-SU-2015:1487-1: important: Live patch for the Linux Kernel Message-ID: <20150904100922.604CA320FC@maintenance.suse.de> SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1487-1 Rating: important References: #939044 #939241 #939262 #939263 #939270 #939273 #939276 #939277 Cross-References: CVE-2014-8159 CVE-2015-1805 CVE-2015-3331 CVE-2015-3339 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.38-44 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-486=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_38-44-default-2-7.1 kgraft-patch-3_12_38-44-xen-2-7.1 References: https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939241 https://bugzilla.suse.com/939262 https://bugzilla.suse.com/939263 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 https://bugzilla.suse.com/939277 From sle-security-updates at lists.suse.com Fri Sep 4 04:10:58 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 12:10:58 +0200 (CEST) Subject: SUSE-SU-2015:1488-1: important: Live patch for the Linux Kernel Message-ID: <20150904101058.088E0320FC@maintenance.suse.de> SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1488-1 Rating: important References: #916225 #939044 #939240 #939241 #939262 #939263 #939270 #939273 #939276 #939277 Cross-References: CVE-2014-7822 CVE-2014-8159 CVE-2015-1465 CVE-2015-1805 CVE-2015-3331 CVE-2015-3339 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.36-38 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-1465: The IPv4 implementation in the Linux kernel did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. (bsc#939044 bsc#916225) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) - CVE-2014-7822: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem. (bsc#939240) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-485=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_36-38-default-3-2.1 kgraft-patch-3_12_36-38-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2014-7822.html https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2015-1465.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/916225 https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939240 https://bugzilla.suse.com/939241 https://bugzilla.suse.com/939262 https://bugzilla.suse.com/939263 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 https://bugzilla.suse.com/939277 From sle-security-updates at lists.suse.com Fri Sep 4 04:13:02 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 12:13:02 +0200 (CEST) Subject: SUSE-SU-2015:1489-1: important: Live patch for the Linux Kernel Message-ID: <20150904101302.7875B320FC@maintenance.suse.de> SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1489-1 Rating: important References: #902349 #916225 #939044 #939240 #939241 #939260 #939262 #939263 #939270 #939273 #939276 #939277 Cross-References: CVE-2014-3687 CVE-2014-7822 CVE-2014-8159 CVE-2014-9710 CVE-2015-1465 CVE-2015-1805 CVE-2015-3331 CVE-2015-3339 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.32-33 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-1465: The IPv4 implementation in the Linux kernel did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. (bsc#939044 bsc#916225) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2014-9710: The Btrfs implementation in the Linux kernel did not ensure that the visible xattr state is consistent with a requested replacement, which allowed local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit. (bsc#939260) - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter. (bsc#902349 bsc#939044) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) - CVE-2014-7822: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem. (bsc#939240) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-484=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_32-33-default-3-2.1 kgraft-patch-3_12_32-33-xen-3-2.1 References: https://www.suse.com/security/cve/CVE-2014-3687.html https://www.suse.com/security/cve/CVE-2014-7822.html https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2014-9710.html https://www.suse.com/security/cve/CVE-2015-1465.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/902349 https://bugzilla.suse.com/916225 https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939240 https://bugzilla.suse.com/939241 https://bugzilla.suse.com/939260 https://bugzilla.suse.com/939262 https://bugzilla.suse.com/939263 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 https://bugzilla.suse.com/939277 From sle-security-updates at lists.suse.com Fri Sep 4 04:15:27 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 12:15:27 +0200 (CEST) Subject: SUSE-SU-2015:1490-1: important: Live patch for the Linux Kernel Message-ID: <20150904101527.EB551320FC@maintenance.suse.de> SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1490-1 Rating: important References: #939044 #939270 #939273 #939276 Cross-References: CVE-2015-1805 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.43-52.6 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-488=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_43-52_6-default-2-6.1 kgraft-patch-3_12_43-52_6-xen-2-6.1 References: https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 From sle-security-updates at lists.suse.com Fri Sep 4 04:16:23 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 12:16:23 +0200 (CEST) Subject: SUSE-SU-2015:1491-1: important: Live patch for the Linux Kernel Message-ID: <20150904101623.A9587320FE@maintenance.suse.de> SUSE Security Update: Live patch for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1491-1 Rating: important References: #939044 #939241 #939262 #939263 #939270 #939273 #939276 #939277 Cross-References: CVE-2014-8159 CVE-2015-1805 CVE-2015-3331 CVE-2015-3339 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update contains a kernel live patch for the 3.12.39-47 SUSE Linux Enterprise Server 12 Kernel, fixing following security issues. - CVE-2015-3339: A race condition in the prepare_binprm function in fs/exec.c in the Linux kernel allowed local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. (bsc#939263 bsc#939044) - CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the Linux kernel did not initialize a certain list data structure during an unhash operation, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. (bsc#939277) - CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood of UDP packets with invalid checksums were fixed that could be used by remote attackers to delay execution. (bsc#939276) - CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel did not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allowed local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." (bsc#939270) - CVE-2015-4700: A BPF Jit optimization flaw could allow local users to panic the kernel. (bsc#939273) - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket. (bsc#939262) - CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/. (bsc#939241) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-487=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_39-47-default-2-10.1 kgraft-patch-3_12_39-47-xen-2-10.1 References: https://www.suse.com/security/cve/CVE-2014-8159.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-3331.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-3636.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://bugzilla.suse.com/939044 https://bugzilla.suse.com/939241 https://bugzilla.suse.com/939262 https://bugzilla.suse.com/939263 https://bugzilla.suse.com/939270 https://bugzilla.suse.com/939273 https://bugzilla.suse.com/939276 https://bugzilla.suse.com/939277 From sle-security-updates at lists.suse.com Fri Sep 4 10:09:46 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 4 Sep 2015 18:09:46 +0200 (CEST) Subject: SUSE-SU-2015:1496-1: important: Security update for bind Message-ID: <20150904160946.1BA43320FC@maintenance.suse.de> SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1496-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: SUSE Linux Enterprise Server 11-SP1-LTSS SUSE Linux Enterprise Debuginfo 11-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP1-LTSS: zypper in -t patch slessp1-bind-12070=1 - SUSE Linux Enterprise Debuginfo 11-SP1: zypper in -t patch dbgsp1-bind-12070=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP1-LTSS (i586 s390x x86_64): bind-9.6ESVR11W1-0.9.1 bind-chrootenv-9.6ESVR11W1-0.9.1 bind-devel-9.6ESVR11W1-0.9.1 bind-doc-9.6ESVR11W1-0.9.1 bind-libs-9.6ESVR11W1-0.9.1 bind-utils-9.6ESVR11W1-0.9.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (s390x x86_64): bind-libs-32bit-9.6ESVR11W1-0.9.1 - SUSE Linux Enterprise Debuginfo 11-SP1 (i586 s390x x86_64): bind-debuginfo-9.6ESVR11W1-0.9.1 bind-debugsource-9.6ESVR11W1-0.9.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066 From sle-security-updates at lists.suse.com Mon Sep 7 06:09:38 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Mon, 7 Sep 2015 14:09:38 +0200 (CEST) Subject: SUSE-SU-2015:1504-1: important: Security update for MozillaFirefox Message-ID: <20150907120938.E5F21320FC@maintenance.suse.de> SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1504-1 Rating: important References: #943557 #943558 #943608 Cross-References: CVE-2015-4497 CVE-2015-4498 Affected Products: SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Server 11-SP1-LTSS SUSE Linux Enterprise Debuginfo 11-SP2 SUSE Linux Enterprise Debuginfo 11-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. (bsc#943608) * MFSA 2015-94/CVE-2015-4497 (bsc#943557): Use-after-free when resizing canvas element during restyling * MFSA 2015-95/CVE-2015-4498 (bsc#943558): Add-on notification bypass through data URLs Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-firefox-20150831-12071=1 - SUSE Linux Enterprise Server 11-SP1-LTSS: zypper in -t patch slessp1-firefox-20150831-12071=1 - SUSE Linux Enterprise Debuginfo 11-SP2: zypper in -t patch dbgsp2-firefox-20150831-12071=1 - SUSE Linux Enterprise Debuginfo 11-SP1: zypper in -t patch dbgsp1-firefox-20150831-12071=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): MozillaFirefox-38.2.1esr-17.1 MozillaFirefox-translations-38.2.1esr-17.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (i586 s390x x86_64): MozillaFirefox-38.2.1esr-17.1 MozillaFirefox-translations-38.2.1esr-17.1 - SUSE Linux Enterprise Debuginfo 11-SP2 (i586 s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-17.1 MozillaFirefox-debugsource-38.2.1esr-17.1 - SUSE Linux Enterprise Debuginfo 11-SP1 (i586 s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-17.1 MozillaFirefox-debugsource-38.2.1esr-17.1 References: https://www.suse.com/security/cve/CVE-2015-4497.html https://www.suse.com/security/cve/CVE-2015-4498.html https://bugzilla.suse.com/943557 https://bugzilla.suse.com/943558 https://bugzilla.suse.com/943608 From sle-security-updates at lists.suse.com Tue Sep 8 05:10:01 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 8 Sep 2015 13:10:01 +0200 (CEST) Subject: SUSE-SU-2015:1509-1: important: Security update for java-1_6_0-ibm Message-ID: <20150908111001.2D723320F7@maintenance.suse.de> SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1509-1 Rating: important References: #935540 #936844 #938895 #941939 Cross-References: CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Server 11-SP1-LTSS ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: IBM Java was updated to version 6 SR16 FP7 (6.0-16.7) to fix several security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. (bnc#935540) * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. The following non-security bugs were fixed: * bsc#936844: misconfigured update-alternative entries * bsc#941939: provide %{name} instead of %{sdklnk} only in _jvmprivdir Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-java-1_6_0-ibm-12072=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-java-1_6_0-ibm-12072=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-java-1_6_0-ibm-12072=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-java-1_6_0-ibm-12072=1 - SUSE Linux Enterprise Server 11-SP1-LTSS: zypper in -t patch slessp1-java-1_6_0-ibm-12072=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.7-10.1 java-1_6_0-ibm-fonts-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.7-10.1 java-1_6_0-ibm-fonts-1.6.0_sr16.7-10.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.7-10.1 java-1_6_0-ibm-plugin-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.7-10.1 java-1_6_0-ibm-fonts-1.6.0_sr16.7-10.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.7-10.1 java-1_6_0-ibm-devel-1.6.0_sr16.7-10.1 java-1_6_0-ibm-fonts-1.6.0_sr16.7-10.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.7-10.1 java-1_6_0-ibm-fonts-1.6.0_sr16.7-10.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.7-10.1 - SUSE Linux Enterprise Server 11-SP1-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.7-10.1 References: https://www.suse.com/security/cve/CVE-2015-1931.html https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/935540 https://bugzilla.suse.com/936844 https://bugzilla.suse.com/938895 https://bugzilla.suse.com/941939 From sle-security-updates at lists.suse.com Tue Sep 8 06:09:41 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 8 Sep 2015 14:09:41 +0200 (CEST) Subject: SUSE-SU-2015:1510-1: moderate: Security update for zeromq Message-ID: <20150908120941.6AC74320FC@maintenance.suse.de> SUSE Security Update: Security update for zeromq ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1510-1 Rating: moderate References: #912460 #931978 Cross-References: CVE-2014-9721 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Desktop 12 SUSE Enterprise Storage 1.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: zeromq was updated to fix one security issue and one non-security bug. The following vulnerability was fixed: * CVE-2014-9721: zeromq protocol downgrade attack on sockets using the ZMTP v3 protocol (boo#931978) The following bug was fixed: * boo#912460: avoid curve test to hang for ppc ppc64 ppc64le architectures Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-499=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-499=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-499=1 - SUSE Enterprise Storage 1.0: zypper in -t patch SUSE-Storage-1.0-2015-499=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): libzmq3-4.0.4-13.1 libzmq3-debuginfo-4.0.4-13.1 zeromq-debugsource-4.0.4-13.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libzmq3-4.0.4-13.1 libzmq3-debuginfo-4.0.4-13.1 zeromq-debugsource-4.0.4-13.1 zeromq-devel-4.0.4-13.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libzmq3-4.0.4-13.1 libzmq3-debuginfo-4.0.4-13.1 zeromq-debugsource-4.0.4-13.1 - SUSE Enterprise Storage 1.0 (x86_64): libzmq3-4.0.4-13.1 libzmq3-debuginfo-4.0.4-13.1 zeromq-debugsource-4.0.4-13.1 References: https://www.suse.com/security/cve/CVE-2014-9721.html https://bugzilla.suse.com/912460 https://bugzilla.suse.com/931978 From sle-security-updates at lists.suse.com Tue Sep 8 09:09:42 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 8 Sep 2015 17:09:42 +0200 (CEST) Subject: SUSE-SU-2015:1511-1: moderate: Security update for libgcrypt Message-ID: <20150908150942.A4121320FC@maintenance.suse.de> SUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1511-1 Rating: moderate References: #920057 #938343 Cross-References: CVE-2015-0837 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the following issues: Security: * Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] (bsc#920057) Bugfixes: * don't drop privileges when locking secure memory (bsc#938343) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-500=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-500=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-500=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libgcrypt-debugsource-1.6.1-16.1 libgcrypt-devel-1.6.1-16.1 libgcrypt-devel-debuginfo-1.6.1-16.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libgcrypt-debugsource-1.6.1-16.1 libgcrypt20-1.6.1-16.1 libgcrypt20-debuginfo-1.6.1-16.1 libgcrypt20-hmac-1.6.1-16.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libgcrypt20-32bit-1.6.1-16.1 libgcrypt20-debuginfo-32bit-1.6.1-16.1 libgcrypt20-hmac-32bit-1.6.1-16.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libgcrypt-debugsource-1.6.1-16.1 libgcrypt20-1.6.1-16.1 libgcrypt20-32bit-1.6.1-16.1 libgcrypt20-debuginfo-1.6.1-16.1 libgcrypt20-debuginfo-32bit-1.6.1-16.1 References: https://www.suse.com/security/cve/CVE-2015-0837.html https://bugzilla.suse.com/920057 https://bugzilla.suse.com/938343 From sle-security-updates at lists.suse.com Tue Sep 8 10:10:13 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 8 Sep 2015 18:10:13 +0200 (CEST) Subject: SUSE-SU-2015:1513-1: Security update for tidy Message-ID: <20150908161013.C32A6320FC@maintenance.suse.de> SUSE Security Update: Security update for tidy ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1513-1 Rating: low References: #903962 #933588 Cross-References: CVE-2015-5522 CVE-2015-5523 Affected Products: SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities could allow remote attackers to cause a denial of service (crash) via vectors involving a command character in an href. (CVE-2015-5522, CVE-2015-5523) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-501=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libtidy-0_99-0-1.0.20100204cvs-25.3 libtidy-0_99-0-debuginfo-1.0.20100204cvs-25.3 libtidy-0_99-0-devel-1.0.20100204cvs-25.3 tidy-1.0.20100204cvs-25.3 tidy-debuginfo-1.0.20100204cvs-25.3 tidy-debugsource-1.0.20100204cvs-25.3 References: https://www.suse.com/security/cve/CVE-2015-5522.html https://www.suse.com/security/cve/CVE-2015-5523.html https://bugzilla.suse.com/903962 https://bugzilla.suse.com/933588 From sle-security-updates at lists.suse.com Wed Sep 9 03:10:41 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 9 Sep 2015 11:10:41 +0200 (CEST) Subject: SUSE-SU-2015:1515-1: Security update for openstack and python-oslo.utils Message-ID: <20150909091041.46EDE320FC@maintenance.suse.de> SUSE Security Update: Security update for openstack and python-oslo.utils ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1515-1 Rating: low References: #918784 #920573 #926596 #928718 #930574 #931204 #935892 Affected Products: SUSE OpenStack Cloud 5 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update provides the following fixes provided from the upstream OpenStack-project: - openstack-suse: + do not copy upstream python requirements to the package, we rely on Requires; upstream requirements.txt introduce version caps which we do not follow (bnc#920573) - openstack-sahara: + Fix getting heat stack in Sahara + Fixed scaling with new node group with auto sg + Open all ports for private network for auto SG + Fix for getting auth url for hadoop-swift + Fixed auto security group cleanup in case of creation error + Add list of open ports for Cloudera plugin + Add missed files for migrations in MANIFEST.in + Include launch_command.py in MANIFEST.in + Fix requires - openstack-keystone: + Updated hybrid backend to include fix for bsc#935892 + Deal with PEP-0476 certificate chaining checking + Backport fixes for v3 API sample policy file (lp#1381809 and lp#1392155). + Install v3 sample policy into the doc directory + Update hybrid backend to include latest fixes for v3 protocol (bsc#928718) + backend_argument should be marked secret + Work with pymongo 3.0 + Speed up memcache lock + Fix up _ldap_res_to_model for ldap identity backend + Don't try to convert LDAP attributes to boolean + Fix the wrong update logic of catalog kvs driver + Do parameter check before updating endpoint_group + Correct initialization order for logging to use eventlet locks + Fix the syntax issue on creating table `endpoint_group` - openstack-heat: + Add env storing for loaded environments + Fix block_device_mapping property validation when using get_attr + Add default_client_name in Nova::FloatingIPAssoc + Fix cloud-init Python syntax for Python < 2.6 + Allow lists and strings for Json parameters via provider resources + RandomString physical_resource_id as id not the string + Authenticate the domain user with id instead of username + Tell stevedore not to force verify requirements + Use properties.data when testing for "provided by the user" + Ship /usr/lib/heat directory in openstack-heat-engine subpackage, since that's where plugin are loaded from. + Create openstack-heat-plugin-heat_docker subpackage to ship the heat_docker plugin. + Fix update on failed stack + Enable https for keystone while creating stack user + Change the engine-listener topic + Just to delete the stack when adopt rollback + Release stack lock when successfully acquire + Add dependency on Router External Gateway property + Use only FIP dependencies from graph + Add dependency hidden on router_interface + Update heat.conf.sample + Upgrade requirements for kombu and greenlet to Juno versions (bnc#920573) + Stop patching oslo.messaging private bits - openstack-glance: + Eventlet green threads not released back to pool + Replace assert statements with proper control-flow + Fix intermittent unit test failures + Initiate deletion of image files if the import was interrupted to prevent denial of service (bnc#918784, CVE-2014-9684) - openstack-cinder: + Remove nonexistent LIO terminate_connection call + Disallow backing files when uploading volumes to image + LVM: Pass volume size in MiB to copy_volume() during volume migration + Remove iscsi_helper calls from base iscsi driver + Fix exceptions logging in iSCSI targets + Delete the temporary volume if migration fails + Get the 'consumer' in a correct way for retyping with qos-specs + Fix re-export of iscsi volume when using lioadm + Revert "Add support for customized cluster name" + Failed to discovery when iscsi multipath and CHAP both enabled + Add support for customized cluster name + Only use operational LIFs for iscsi target details + Clear migration_status from a destination volume if migration fails + Deal with PEP-0476 certificate chaining checking - openstack-ceilometer: + Ensure unique list of consumers created + Add bandwidth to measurements + Rely on VM UUID to fetch metrics in libvirt + Retry to connect database when DB2 or mongodb is restarted + Use alarm's evaluation periods in sufficient test + [MongoDB] Fix bug with reconnection to new master node + Fix the value of query_spec.maxSample to advoid to be zero + Fix issue when ceilometer-expirer is called from the wrong user via cronjob and the resulting logs end up having wrong ownership. See also bsc#930574 + Metering data ttl sql backend breaks resource metadata + Stop mocking os.path in test_setup_events_default_config + Move the cron job to collector package (bnc#926596) + Catch exception when evaluate single alarm - python-oslo.utils: + Update to version 1.4.0 * Add a stopwatch + split for duration(s) * Allow providing a logger to save_and_reraise_exception * Utility API to generate EUI-64 IPv6 address * Add a eventlet utils helper module * Add microsecond support to iso8601_from_timestamp * Update Oslo imports to remove namespace package * Add TimeFixture * Add microsecond support to timeutils.utcnow_ts() - python-oslo.i18n: + Update to version 1.3.1 * Remove deprecation warning (bnc#931204) * Correct the translation domain for loading messages * Workflow documentation is now in infra-manual * Imported Translations from Transifex * Activate pep8 check that _ is imported * Make clear in docs to use _LE() when using LOG.exception() * Support building wheels (PEP-427) - python-six: + Update to version 1.9.0 * Support the `flush` parameter to `six.print_`. * Add the `python_2_unicode_compatible` decorator. * Ensure `six.wraps` respects the *updated* and *assigned* arguments. * Fix `six.moves` race condition in multi-threaded code. * Add `six.view(keys|values|itmes)`, which provide dictionary views on Python 2.7+. * Fix add_metaclass when the class has __slots__ containing "__weakref__" or "__dict__". * Always accept *updated* and *assigned* arguments for wraps(). * Fix import six on Python 3.4 with a custom loader. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-openstack-201507-12074=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): openstack-ceilometer-2014.2.4.dev18-9.7 openstack-ceilometer-agent-central-2014.2.4.dev18-9.7 openstack-ceilometer-agent-compute-2014.2.4.dev18-9.7 openstack-ceilometer-agent-ipmi-2014.2.4.dev18-9.7 openstack-ceilometer-agent-notification-2014.2.4.dev18-9.7 openstack-ceilometer-alarm-evaluator-2014.2.4.dev18-9.7 openstack-ceilometer-alarm-notifier-2014.2.4.dev18-9.7 openstack-ceilometer-api-2014.2.4.dev18-9.7 openstack-ceilometer-collector-2014.2.4.dev18-9.7 openstack-cinder-2014.2.4.dev19-9.7 openstack-cinder-api-2014.2.4.dev19-9.7 openstack-cinder-backup-2014.2.4.dev19-9.7 openstack-cinder-scheduler-2014.2.4.dev19-9.7 openstack-cinder-volume-2014.2.4.dev19-9.7 openstack-glance-2014.2.4.dev5-9.5 openstack-heat-2014.2.4.dev13-9.6 openstack-heat-api-2014.2.4.dev13-9.6 openstack-heat-api-cfn-2014.2.4.dev13-9.6 openstack-heat-api-cloudwatch-2014.2.4.dev13-9.6 openstack-heat-engine-2014.2.4.dev13-9.6 openstack-keystone-2014.2.4.dev5-11.8 openstack-sahara-2014.2.4.dev3-9.5 openstack-sahara-api-2014.2.4.dev3-9.5 openstack-sahara-engine-2014.2.4.dev3-9.5 python-ceilometer-2014.2.4.dev18-9.7 python-cinder-2014.2.4.dev19-9.7 python-glance-2014.2.4.dev5-9.5 python-heat-2014.2.4.dev13-9.6 python-keystone-2014.2.4.dev5-11.8 python-oslo.i18n-1.3.1-9.6 python-oslo.utils-1.4.0-14.2 python-oslotest-1.2.0-2.5 python-sahara-2014.2.4.dev3-9.5 python-six-1.9.0-9.2 - SUSE OpenStack Cloud 5 (noarch): openstack-ceilometer-doc-2014.2.4.dev18-9.11 openstack-cinder-doc-2014.2.4.dev19-9.12 openstack-glance-doc-2014.2.4.dev5-9.7 openstack-heat-doc-2014.2.4.dev13-9.8 openstack-keystone-doc-2014.2.4.dev5-11.12 openstack-sahara-doc-2014.2.4.dev3-9.5 openstack-suse-sudo-2014.2-9.2 References: https://bugzilla.suse.com/918784 https://bugzilla.suse.com/920573 https://bugzilla.suse.com/926596 https://bugzilla.suse.com/928718 https://bugzilla.suse.com/930574 https://bugzilla.suse.com/931204 https://bugzilla.suse.com/935892 From sle-security-updates at lists.suse.com Wed Sep 9 10:12:32 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 9 Sep 2015 18:12:32 +0200 (CEST) Subject: SUSE-SU-2015:1518-1: moderate: Security update for gnutls Message-ID: <20150909161232.EC117320FC@maintenance.suse.de> SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1518-1 Rating: moderate References: #929414 #929690 #941794 Cross-References: CVE-2015-3622 CVE-2015-6251 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: gnutls was updated to fix several security vulnerabilities. - fix double free in certificate DN decoding (GNUTLS-SA-2015-3)(bsc#941794,CVE-2015-6251) - fix invalid read in octet string in bundled libtasn1 (bsc#929414,CVE-2015-3622) - fix ServerKeyExchange signature issue (GNUTLS-SA-2015-2)(bsc#929690) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-513=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-513=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-513=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): gnutls-debuginfo-3.2.15-11.1 gnutls-debugsource-3.2.15-11.1 libgnutls-devel-3.2.15-11.1 libgnutls-openssl-devel-3.2.15-11.1 libgnutlsxx-devel-3.2.15-11.1 libgnutlsxx28-3.2.15-11.1 libgnutlsxx28-debuginfo-3.2.15-11.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): gnutls-3.2.15-11.1 gnutls-debuginfo-3.2.15-11.1 gnutls-debugsource-3.2.15-11.1 libgnutls-openssl27-3.2.15-11.1 libgnutls-openssl27-debuginfo-3.2.15-11.1 libgnutls28-3.2.15-11.1 libgnutls28-debuginfo-3.2.15-11.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libgnutls28-32bit-3.2.15-11.1 libgnutls28-debuginfo-32bit-3.2.15-11.1 - SUSE Linux Enterprise Desktop 12 (x86_64): gnutls-3.2.15-11.1 gnutls-debuginfo-3.2.15-11.1 gnutls-debugsource-3.2.15-11.1 libgnutls28-3.2.15-11.1 libgnutls28-32bit-3.2.15-11.1 libgnutls28-debuginfo-3.2.15-11.1 libgnutls28-debuginfo-32bit-3.2.15-11.1 References: https://www.suse.com/security/cve/CVE-2015-3622.html https://www.suse.com/security/cve/CVE-2015-6251.html https://bugzilla.suse.com/929414 https://bugzilla.suse.com/929690 https://bugzilla.suse.com/941794 From sle-security-updates at lists.suse.com Wed Sep 9 10:13:18 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 9 Sep 2015 18:13:18 +0200 (CEST) Subject: SUSE-SU-2015:1519-1: important: Security update for qemu Message-ID: <20150909161318.D3430320F3@maintenance.suse.de> SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1519-1 Rating: important References: #893892 #932267 #932770 Cross-References: CVE-2015-3209 CVE-2015-4037 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: qemu was updated to fix two security issues and augments one non-security bug fix. The following vulnerabilities were fixed: * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (bsc#932770) * CVE-2015-4037: Avoid predictable directory name for smb config (bsc#932267) The fix for the following non-security bug was improved: * bsc#893892: Use improved upstream patch for display issue affecting installs of SLES 11 VMs on SLES 12 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-509=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-509=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): qemu-2.0.2-48.4.1 qemu-block-curl-2.0.2-48.4.1 qemu-block-curl-debuginfo-2.0.2-48.4.1 qemu-debugsource-2.0.2-48.4.1 qemu-guest-agent-2.0.2-48.4.1 qemu-guest-agent-debuginfo-2.0.2-48.4.1 qemu-lang-2.0.2-48.4.1 qemu-tools-2.0.2-48.4.1 qemu-tools-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): qemu-kvm-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (ppc64le): qemu-ppc-2.0.2-48.4.1 qemu-ppc-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (noarch): qemu-ipxe-1.0.0-48.4.1 qemu-seabios-1.7.4-48.4.1 qemu-sgabios-8-48.4.1 qemu-vgabios-1.7.4-48.4.1 - SUSE Linux Enterprise Server 12 (x86_64): qemu-block-rbd-2.0.2-48.4.1 qemu-block-rbd-debuginfo-2.0.2-48.4.1 qemu-x86-2.0.2-48.4.1 qemu-x86-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Server 12 (s390x): qemu-s390-2.0.2-48.4.1 qemu-s390-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Desktop 12 (x86_64): qemu-2.0.2-48.4.1 qemu-block-curl-2.0.2-48.4.1 qemu-block-curl-debuginfo-2.0.2-48.4.1 qemu-debugsource-2.0.2-48.4.1 qemu-kvm-2.0.2-48.4.1 qemu-tools-2.0.2-48.4.1 qemu-tools-debuginfo-2.0.2-48.4.1 qemu-x86-2.0.2-48.4.1 qemu-x86-debuginfo-2.0.2-48.4.1 - SUSE Linux Enterprise Desktop 12 (noarch): qemu-ipxe-1.0.0-48.4.1 qemu-seabios-1.7.4-48.4.1 qemu-sgabios-8-48.4.1 qemu-vgabios-1.7.4-48.4.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4037.html https://bugzilla.suse.com/893892 https://bugzilla.suse.com/932267 https://bugzilla.suse.com/932770 From sle-security-updates at lists.suse.com Wed Sep 9 10:15:45 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 9 Sep 2015 18:15:45 +0200 (CEST) Subject: SUSE-SU-2015:1522-1: moderate: Security update for rubygem-rack-1_4 Message-ID: <20150909161545.8AE6B320F7@maintenance.suse.de> SUSE Security Update: Security update for rubygem-rack-1_4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1522-1 Rating: moderate References: #934797 Cross-References: CVE-2015-3225 Affected Products: SUSE Webyast 1.3 SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Lifecycle Management Server 1.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-rack-1_4 was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Crafted requests could have caused a SystemStackError leading to Denial of Service. (bsc#934797) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Webyast 1.3: zypper in -t patch slewyst13-rubygem-rack-1_4-12076=1 - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-rubygem-rack-1_4-12076=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-rubygem-rack-1_4-12076=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-rubygem-rack-1_4-12076=1 - SUSE Lifecycle Management Server 1.3: zypper in -t patch sleslms13-rubygem-rack-1_4-12076=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Webyast 1.3 (i586 ia64 ppc64 s390x x86_64): rubygem-rack-1_4-1.4.5-0.7.3 - SUSE Studio Onsite 1.3 (x86_64): rubygem-rack-1_4-1.4.5-0.7.3 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): rubygem-rack-1_4-1.4.5-0.7.3 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): rubygem-rack-1_4-1.4.5-0.7.3 - SUSE Lifecycle Management Server 1.3 (x86_64): rubygem-rack-1_4-1.4.5-0.7.3 References: https://www.suse.com/security/cve/CVE-2015-3225.html https://bugzilla.suse.com/934797 From sle-security-updates at lists.suse.com Wed Sep 9 11:10:17 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 9 Sep 2015 19:10:17 +0200 (CEST) Subject: SUSE-SU-2015:1524-1: moderate: Security update for net-snmp Message-ID: <20150909171017.14F20320FC@maintenance.suse.de> SUSE Security Update: Security update for net-snmp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1524-1 Rating: moderate References: #853382 #935863 #940188 Cross-References: CVE-2015-5621 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: net-snmp was updated to fix one security vulnerability and several bugs. - fix a vulnerability within the snmp_pdu_parse() function of snmp_api.c. (bnc#940188, CVE-2015-5621) - Add build requirement 'procps' to fix a net-snmp-config error. (bsc#935863) - add support for /dev/shm in snmp hostmib (bnc#853382, FATE#316893). - stop snmptrapd on package removal. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-net-snmp-12079=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-net-snmp-12079=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-net-snmp-12079=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-net-snmp-12079=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-net-snmp-12079=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-net-snmp-12079=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-net-snmp-12079=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-net-snmp-12079=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-net-snmp-12079=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): net-snmp-devel-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): net-snmp-devel-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): net-snmp-devel-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64): net-snmp-devel-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): libsnmp15-5.4.2.1-8.12.24.1 net-snmp-5.4.2.1-8.12.24.1 perl-SNMP-5.4.2.1-8.12.24.1 snmp-mibs-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libsnmp15-5.4.2.1-8.12.24.1 net-snmp-5.4.2.1-8.12.24.1 perl-SNMP-5.4.2.1-8.12.24.1 snmp-mibs-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libsnmp15-x86-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): libsnmp15-5.4.2.1-8.12.24.1 net-snmp-5.4.2.1-8.12.24.1 perl-SNMP-5.4.2.1-8.12.24.1 snmp-mibs-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libsnmp15-x86-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): libsnmp15-5.4.2.1-8.12.24.1 net-snmp-5.4.2.1-8.12.24.1 perl-SNMP-5.4.2.1-8.12.24.1 snmp-mibs-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): libsnmp15-5.4.2.1-8.12.24.1 net-snmp-5.4.2.1-8.12.24.1 perl-SNMP-5.4.2.1-8.12.24.1 snmp-mibs-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libsnmp15-32bit-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): net-snmp-debuginfo-5.4.2.1-8.12.24.1 net-snmp-debugsource-5.4.2.1-8.12.24.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): net-snmp-debuginfo-5.4.2.1-8.12.24.1 net-snmp-debugsource-5.4.2.1-8.12.24.1 References: https://www.suse.com/security/cve/CVE-2015-5621.html https://bugzilla.suse.com/853382 https://bugzilla.suse.com/935863 https://bugzilla.suse.com/940188 From sle-security-updates at lists.suse.com Thu Sep 10 05:10:00 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 10 Sep 2015 13:10:00 +0200 (CEST) Subject: SUSE-SU-2015:1525-1: Security update for tidy Message-ID: <20150910111000.DD7B3320FC@maintenance.suse.de> SUSE Security Update: Security update for tidy ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1525-1 Rating: low References: #933588 Cross-References: CVE-2015-5522 CVE-2015-5523 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities could allow remote attackers to cause a denial of service (crash) via vectors involving a command character in an href. (CVE-2015-5522, CVE-2015-5523) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-tidy-12080=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-tidy-12080=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-tidy-12080=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-tidy-12080=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-tidy-12080=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libtidy-1.0-37.1 libtidy-devel-1.0-37.1 tidy-1.0-37.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): libtidy-1.0-37.1 libtidy-devel-1.0-37.1 tidy-1.0-37.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): libtidy-1.0-37.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): libtidy-1.0-37.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): tidy-debuginfo-1.0-37.1 tidy-debugsource-1.0-37.1 References: https://www.suse.com/security/cve/CVE-2015-5522.html https://www.suse.com/security/cve/CVE-2015-5523.html https://bugzilla.suse.com/933588 From sle-security-updates at lists.suse.com Thu Sep 10 05:10:29 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 10 Sep 2015 13:10:29 +0200 (CEST) Subject: SUSE-SU-2015:1526-1: moderate: Security update for gnutls Message-ID: <20150910111029.9DD90320FC@maintenance.suse.de> SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1526-1 Rating: moderate References: #925499 #932026 Cross-References: CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise High Availability Extension 11-SP4 SUSE Linux Enterprise High Availability Extension 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This security update of gnutls fixes the following issues: - use minimal padding for CBC, the default random length padding causes problems with some servers (bsc#925499) * added gnutls-use_minimal_cbc_padding.patch - use the default DH minimum for gnutls-cli instead of hardcoding 512 * CVE-2015-4000 (Logjam) (bsc#932026) * added gnutls-CVE-2015-4000-logjam-use_the_default_DH_min_for_cli.patch Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-gnutls-12081=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-gnutls-12081=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-gnutls-12081=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-gnutls-12081=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-gnutls-12081=1 - SUSE Linux Enterprise High Availability Extension 11-SP4: zypper in -t patch slehasp4-gnutls-12081=1 - SUSE Linux Enterprise High Availability Extension 11-SP3: zypper in -t patch slehasp3-gnutls-12081=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-gnutls-12081=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-gnutls-12081=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-gnutls-12081=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-gnutls-12081=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libgnutls-devel-2.4.1-24.39.57.1 libgnutls-extra-devel-2.4.1-24.39.57.1 libgnutls-extra26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-devel-2.4.1-24.39.57.1 libgnutls-extra-devel-2.4.1-24.39.57.1 libgnutls-extra26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): gnutls-2.4.1-24.39.57.1 libgnutls-extra26-2.4.1-24.39.57.1 libgnutls26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libgnutls26-32bit-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): gnutls-2.4.1-24.39.57.1 libgnutls-extra26-2.4.1-24.39.57.1 libgnutls26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libgnutls26-32bit-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libgnutls26-x86-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): gnutls-2.4.1-24.39.57.1 libgnutls-extra26-2.4.1-24.39.57.1 libgnutls26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libgnutls26-32bit-2.4.1-24.39.57.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libgnutls26-x86-2.4.1-24.39.57.1 - SUSE Linux Enterprise High Availability Extension 11-SP4 (i586 ia64 ppc64 s390x x86_64): libgnutls-extra26-2.4.1-24.39.57.1 - SUSE Linux Enterprise High Availability Extension 11-SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-extra26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): gnutls-2.4.1-24.39.57.1 libgnutls26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libgnutls26-32bit-2.4.1-24.39.57.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): gnutls-2.4.1-24.39.57.1 libgnutls26-2.4.1-24.39.57.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libgnutls26-32bit-2.4.1-24.39.57.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): gnutls-debuginfo-2.4.1-24.39.57.1 gnutls-debugsource-2.4.1-24.39.57.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): gnutls-debuginfo-2.4.1-24.39.57.1 gnutls-debugsource-2.4.1-24.39.57.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/925499 https://bugzilla.suse.com/932026 From sle-security-updates at lists.suse.com Thu Sep 10 09:10:06 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 10 Sep 2015 17:10:06 +0200 (CEST) Subject: SUSE-SU-2015:1528-1: important: Security update for MozillaFirefox, mozilla-nss Message-ID: <20150910151006.D76B4320FC@maintenance.suse.de> SUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1528-1 Rating: important References: #940806 Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4495 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release). Security issues fixed: - MFSA 2015-78 / CVE-2015-4495: Same origin violation and local file stealing via PDF reader - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474: Miscellaneous memory safety hazards (rv:40.0 / rv:38.2) - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with malformed MP3 file - MFSA 2015-82 / CVE-2015-4478: Redefinition of non-configurable JavaScript object properties - MFSA 2015-83 / CVE-2015-4479: Overflow issues in libstagefright - MFSA 2015-87 / CVE-2015-4484: Crash when using shared memory in JavaScript - MFSA 2015-88 / CVE-2015-4491: Heap overflow in gdk-pixbuf when scaling bitmap images - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer overflows on Libvpx when decoding WebM video - MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489: Vulnerabilities found through code inspection - MFSA 2015-92 / CVE-2015-4492: Use-after-free in XMLHttpRequest with shared workers This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR. Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-firefox38-20150820-12083=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-firefox38-20150820-12083=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-firefox38-20150820-12083=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-firefox38-20150820-12083=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-firefox38-20150820-12083=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-firefox38-20150820-12083=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-firefox38-20150820-12083=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-firefox38-20150820-12083=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-firefox38-20150820-12083=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-38.2.1esr-19.3 mozilla-nss-devel-3.19.2.0-0.16.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-38.2.1esr-19.3 mozilla-nss-devel-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): MozillaFirefox-38.2.1esr-19.3 MozillaFirefox-branding-SLES-for-VMware-31.0-0.7.5 MozillaFirefox-translations-38.2.1esr-19.3 libfreebl3-3.19.2.0-0.16.1 libsoftokn3-3.19.2.0-0.16.1 mozilla-nss-3.19.2.0-0.16.1 mozilla-nss-tools-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libfreebl3-32bit-3.19.2.0-0.16.1 libsoftokn3-32bit-3.19.2.0-0.16.1 mozilla-nss-32bit-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-38.2.1esr-19.3 MozillaFirefox-branding-SLED-31.0-0.12.51 MozillaFirefox-translations-38.2.1esr-19.3 libfreebl3-3.19.2.0-0.16.1 libsoftokn3-3.19.2.0-0.16.1 mozilla-nss-3.19.2.0-0.16.1 mozilla-nss-tools-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libfreebl3-32bit-3.19.2.0-0.16.1 libsoftokn3-32bit-3.19.2.0-0.16.1 mozilla-nss-32bit-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libfreebl3-x86-3.19.2.0-0.16.1 libsoftokn3-x86-3.19.2.0-0.16.1 mozilla-nss-x86-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-38.2.1esr-19.3 MozillaFirefox-branding-SLED-31.0-0.12.51 MozillaFirefox-translations-38.2.1esr-19.3 libfreebl3-3.19.2.0-0.16.1 libsoftokn3-3.19.2.0-0.16.1 mozilla-nss-3.19.2.0-0.16.1 mozilla-nss-tools-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libfreebl3-32bit-3.19.2.0-0.16.1 libsoftokn3-32bit-3.19.2.0-0.16.1 mozilla-nss-32bit-3.19.2.0-0.16.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libfreebl3-x86-3.19.2.0-0.16.1 libsoftokn3-x86-3.19.2.0-0.16.1 mozilla-nss-x86-3.19.2.0-0.16.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): MozillaFirefox-38.2.1esr-19.3 MozillaFirefox-branding-SLED-31.0-0.12.51 MozillaFirefox-translations-38.2.1esr-19.3 libfreebl3-3.19.2.0-0.16.1 libsoftokn3-3.19.2.0-0.16.1 mozilla-nss-3.19.2.0-0.16.1 mozilla-nss-tools-3.19.2.0-0.16.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libfreebl3-32bit-3.19.2.0-0.16.1 libsoftokn3-32bit-3.19.2.0-0.16.1 mozilla-nss-32bit-3.19.2.0-0.16.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): MozillaFirefox-38.2.1esr-19.3 MozillaFirefox-branding-SLED-31.0-0.12.51 MozillaFirefox-translations-38.2.1esr-19.3 libfreebl3-3.19.2.0-0.16.1 libsoftokn3-3.19.2.0-0.16.1 mozilla-nss-3.19.2.0-0.16.1 mozilla-nss-tools-3.19.2.0-0.16.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libfreebl3-32bit-3.19.2.0-0.16.1 libsoftokn3-32bit-3.19.2.0-0.16.1 mozilla-nss-32bit-3.19.2.0-0.16.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-19.3 MozillaFirefox-debugsource-38.2.1esr-19.3 mozilla-nss-debuginfo-3.19.2.0-0.16.1 mozilla-nss-debugsource-3.19.2.0-0.16.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-38.2.1esr-19.3 MozillaFirefox-debugsource-38.2.1esr-19.3 mozilla-nss-debuginfo-3.19.2.0-0.16.1 mozilla-nss-debugsource-3.19.2.0-0.16.1 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4474.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4495.html https://bugzilla.suse.com/940806 From sle-security-updates at lists.suse.com Fri Sep 11 07:09:43 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 11 Sep 2015 15:09:43 +0200 (CEST) Subject: SUSE-SU-2015:1544-1: moderate: Security update for openssh Message-ID: <20150911130943.4CF8B320F7@maintenance.suse.de> SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1544-1 Rating: moderate References: #903649 #932483 #936695 #938746 #943006 #943010 Cross-References: CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: openssh was updated to fix several security issues. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. (bsc#943010) * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. (bsc#943006) Also use %restart_on_update in the trigger script. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-526=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-526=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): openssh-6.6p1-29.1 openssh-askpass-gnome-6.6p1-29.1 openssh-askpass-gnome-debuginfo-6.6p1-29.1 openssh-debuginfo-6.6p1-29.1 openssh-debugsource-6.6p1-29.1 openssh-fips-6.6p1-29.1 openssh-helpers-6.6p1-29.1 openssh-helpers-debuginfo-6.6p1-29.1 - SUSE Linux Enterprise Desktop 12 (x86_64): openssh-6.6p1-29.1 openssh-askpass-gnome-6.6p1-29.1 openssh-askpass-gnome-debuginfo-6.6p1-29.1 openssh-debuginfo-6.6p1-29.1 openssh-debugsource-6.6p1-29.1 openssh-helpers-6.6p1-29.1 openssh-helpers-debuginfo-6.6p1-29.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-5352.html https://www.suse.com/security/cve/CVE-2015-5600.html https://www.suse.com/security/cve/CVE-2015-6563.html https://www.suse.com/security/cve/CVE-2015-6564.html https://bugzilla.suse.com/903649 https://bugzilla.suse.com/932483 https://bugzilla.suse.com/936695 https://bugzilla.suse.com/938746 https://bugzilla.suse.com/943006 https://bugzilla.suse.com/943010 From sle-security-updates at lists.suse.com Fri Sep 11 08:09:39 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 11 Sep 2015 16:09:39 +0200 (CEST) Subject: SUSE-SU-2015:1545-1: moderate: Security update for conntrack-tools Message-ID: <20150911140939.6E92C320FC@maintenance.suse.de> SUSE Security Update: Security update for conntrack-tools ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1545-1 Rating: moderate References: #942149 #944339 Cross-References: CVE-2015-6496 Affected Products: SUSE OpenStack Cloud Compute 5 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise High Availability 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. (bsc#942149, CVE-2015-6496) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Compute 5: zypper in -t patch SUSE-SLE12-CLOUD-5-2015-527=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-527=1 - SUSE Linux Enterprise High Availability 12: zypper in -t patch SUSE-SLE-HA-12-2015-527=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud Compute 5 (x86_64): conntrack-tools-1.4.2-5.2 conntrack-tools-debuginfo-1.4.2-5.2 conntrack-tools-debugsource-1.4.2-5.2 libnetfilter_cthelper-debugsource-1.0.0-7.1 libnetfilter_cthelper0-1.0.0-7.1 libnetfilter_cthelper0-debuginfo-1.0.0-7.1 libnetfilter_cttimeout-debugsource-1.0.0-9.1 libnetfilter_cttimeout1-1.0.0-9.1 libnetfilter_cttimeout1-debuginfo-1.0.0-9.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libnetfilter_cthelper-debugsource-1.0.0-7.1 libnetfilter_cthelper-devel-1.0.0-7.1 libnetfilter_cthelper0-1.0.0-7.1 libnetfilter_cthelper0-debuginfo-1.0.0-7.1 libnetfilter_cttimeout-debugsource-1.0.0-9.1 libnetfilter_cttimeout-devel-1.0.0-9.1 libnetfilter_cttimeout1-1.0.0-9.1 libnetfilter_cttimeout1-debuginfo-1.0.0-9.1 - SUSE Linux Enterprise High Availability 12 (s390x x86_64): conntrack-tools-1.4.2-5.2 conntrack-tools-debuginfo-1.4.2-5.2 conntrack-tools-debugsource-1.4.2-5.2 libnetfilter_cthelper-debugsource-1.0.0-7.1 libnetfilter_cthelper0-1.0.0-7.1 libnetfilter_cthelper0-debuginfo-1.0.0-7.1 libnetfilter_cttimeout-debugsource-1.0.0-9.1 libnetfilter_cttimeout1-1.0.0-9.1 libnetfilter_cttimeout1-debuginfo-1.0.0-9.1 References: https://www.suse.com/security/cve/CVE-2015-6496.html https://bugzilla.suse.com/942149 https://bugzilla.suse.com/944339 From sle-security-updates at lists.suse.com Fri Sep 11 09:11:01 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 11 Sep 2015 17:11:01 +0200 (CEST) Subject: SUSE-SU-2015:1547-1: moderate: Security update for openssh Message-ID: <20150911151101.878A2320FC@maintenance.suse.de> SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1547-1 Rating: moderate References: #673532 #903649 #905118 #914309 #916549 #932483 #936695 #938746 #943006 #943010 Cross-References: CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 Affected Products: SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 5 fixes is now available. Description: openssh was updated to fix several security issues and bugs. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. These non-security issues were fixed: - bsc#914309: sshd inherits oom_adj -17 on SIGHUP causing DoS potential for oom_killer. - bsc#673532: limits.conf fsize change in SLES10SP3 causing problems to WebSphere mqm user. - bsc#916549: Fixed support for aesXXX-gcm at openssh.com. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-openssh-12087=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-openssh-12087=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): openssh-6.2p2-0.17.1 openssh-askpass-6.2p2-0.17.1 openssh-askpass-gnome-6.2p2-0.17.3 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-6.2p2-0.17.1 openssh-askpass-6.2p2-0.17.1 openssh-askpass-gnome-6.2p2-0.17.3 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-5352.html https://www.suse.com/security/cve/CVE-2015-5600.html https://www.suse.com/security/cve/CVE-2015-6563.html https://www.suse.com/security/cve/CVE-2015-6564.html https://bugzilla.suse.com/673532 https://bugzilla.suse.com/903649 https://bugzilla.suse.com/905118 https://bugzilla.suse.com/914309 https://bugzilla.suse.com/916549 https://bugzilla.suse.com/932483 https://bugzilla.suse.com/936695 https://bugzilla.suse.com/938746 https://bugzilla.suse.com/943006 https://bugzilla.suse.com/943010 From sle-security-updates at lists.suse.com Fri Sep 11 10:11:23 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 11 Sep 2015 18:11:23 +0200 (CEST) Subject: SUSE-SU-2015:1547-2: moderate: Security update for openssh Message-ID: <20150911161123.32E87320FE@maintenance.suse.de> SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1547-2 Rating: moderate References: #673532 #903649 #905118 #914309 #916549 #932483 #936695 #938746 #943006 #943010 Cross-References: CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 Affected Products: SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 5 fixes is now available. Description: openssh was updated to fix several security issues and bugs. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. These non-security issues were fixed: - bsc#914309: sshd inherits oom_adj -17 on SIGHUP causing DoS potential for oom_killer. - bsc#673532: limits.conf fsize change in SLES10SP3 causing problems to WebSphere mqm user. - bsc#916549: Fixed support for aesXXX-gcm at openssh.com. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-openssh-12087=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssh-12087=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): openssh-6.2p2-0.17.1 openssh-askpass-6.2p2-0.17.1 openssh-askpass-gnome-6.2p2-0.17.3 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.2p2-0.17.3 openssh-debuginfo-6.2p2-0.17.1 openssh-debugsource-6.2p2-0.17.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-5352.html https://www.suse.com/security/cve/CVE-2015-5600.html https://www.suse.com/security/cve/CVE-2015-6563.html https://www.suse.com/security/cve/CVE-2015-6564.html https://bugzilla.suse.com/673532 https://bugzilla.suse.com/903649 https://bugzilla.suse.com/905118 https://bugzilla.suse.com/914309 https://bugzilla.suse.com/916549 https://bugzilla.suse.com/932483 https://bugzilla.suse.com/936695 https://bugzilla.suse.com/938746 https://bugzilla.suse.com/943006 https://bugzilla.suse.com/943010 From sle-security-updates at lists.suse.com Mon Sep 14 09:10:13 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Mon, 14 Sep 2015 17:10:13 +0200 (CEST) Subject: SUSE-SU-2015:1556-1: moderate: Security update for net-snmp Message-ID: <20150914151013.80B05320FE@maintenance.suse.de> SUSE Security Update: Security update for net-snmp ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1556-1 Rating: moderate References: #909479 #935863 #935876 #940084 #940188 Cross-References: CVE-2015-5621 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: The following issues have been fixed within this update: * fix btrfs output inside HOST-RESOURCES-MIB::hrStorageDescr. (bsc#909479) * fix an incompletely initialized vulnerability within the snmp_pdu_parse() function of snmp_api.c. (bsc#940188, CVE-2015-5621) * add build requirement 'procps' to fix a net-snmp-config error (bsc#935863) * --disable-md5 to allow operation in FIPS mode and not use the old algorithm (bsc#935876 bsc#940084) * also stop snmptrapd on removal Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-537=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-537=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-537=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): net-snmp-debuginfo-5.7.2.1-4.3.2 net-snmp-debugsource-5.7.2.1-4.3.2 net-snmp-devel-5.7.2.1-4.3.2 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libsnmp30-5.7.2.1-4.3.2 libsnmp30-debuginfo-5.7.2.1-4.3.2 net-snmp-5.7.2.1-4.3.2 net-snmp-debuginfo-5.7.2.1-4.3.2 net-snmp-debugsource-5.7.2.1-4.3.2 perl-SNMP-5.7.2.1-4.3.2 perl-SNMP-debuginfo-5.7.2.1-4.3.2 snmp-mibs-5.7.2.1-4.3.2 - SUSE Linux Enterprise Server 12 (s390x x86_64): libsnmp30-32bit-5.7.2.1-4.3.2 libsnmp30-debuginfo-32bit-5.7.2.1-4.3.2 - SUSE Linux Enterprise Desktop 12 (x86_64): libsnmp30-32bit-5.7.2.1-4.3.2 libsnmp30-5.7.2.1-4.3.2 libsnmp30-debuginfo-32bit-5.7.2.1-4.3.2 libsnmp30-debuginfo-5.7.2.1-4.3.2 net-snmp-5.7.2.1-4.3.2 net-snmp-debuginfo-5.7.2.1-4.3.2 net-snmp-debugsource-5.7.2.1-4.3.2 perl-SNMP-5.7.2.1-4.3.2 perl-SNMP-debuginfo-5.7.2.1-4.3.2 snmp-mibs-5.7.2.1-4.3.2 References: https://www.suse.com/security/cve/CVE-2015-5621.html https://bugzilla.suse.com/909479 https://bugzilla.suse.com/935863 https://bugzilla.suse.com/935876 https://bugzilla.suse.com/940084 https://bugzilla.suse.com/940188 From sle-security-updates at lists.suse.com Wed Sep 16 09:09:49 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 16 Sep 2015 17:09:49 +0200 (CEST) Subject: SUSE-SU-2015:1565-1: moderate: Security update for tomcat6 Message-ID: <20150916150949.CC3BA32102@maintenance.suse.de> SUSE Security Update: Security update for tomcat6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1565-1 Rating: moderate References: #906152 #917127 #926762 #931442 #932698 #934219 Cross-References: CVE-2014-0227 CVE-2014-0230 CVE-2014-7810 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for Tomcat fixes the following security issues: - CVE-2014-7810: Security manager bypass via EL expressions. (bsc#931442) It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could have used this flaw to bypass security manager protections. - CVE-2014-0227: Limited DoS in chunked transfer encoding input filter. (bsc#917127) It was discovered that the ChunkedInputFilter implementation did not fail subsequent attempts to read input early enough. A remote attacker could have used this flaw to perform a denial of service attack, by streaming an unlimited quantity of data, leading to consumption of server resources. - CVE-2014-0230: Non-persistent DoS attack by feeding data by aborting an upload It was possible for a remote attacker to trigger a non-persistent DoS attack by feeding data by aborting an upload. (bsc#926762) Additionally, the following non-security issues have been fixed: - Fix rights of all files within /usr/share/tomcat6/bin. (bsc#906152) - Don't overwrite /var/run/tomcat6.pid when Tomcat is already running. (bsc#934219) - Miscellaneous fixes and improvements to Tomcat's init script. (bsc#932698) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-tomcat6-12092=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (noarch): tomcat6-6.0.41-0.47.1 tomcat6-admin-webapps-6.0.41-0.47.1 tomcat6-docs-webapp-6.0.41-0.47.1 tomcat6-javadoc-6.0.41-0.47.1 tomcat6-jsp-2_1-api-6.0.41-0.47.1 tomcat6-lib-6.0.41-0.47.1 tomcat6-servlet-2_5-api-6.0.41-0.47.1 tomcat6-webapps-6.0.41-0.47.1 References: https://www.suse.com/security/cve/CVE-2014-0227.html https://www.suse.com/security/cve/CVE-2014-0230.html https://www.suse.com/security/cve/CVE-2014-7810.html https://bugzilla.suse.com/906152 https://bugzilla.suse.com/917127 https://bugzilla.suse.com/926762 https://bugzilla.suse.com/931442 https://bugzilla.suse.com/932698 https://bugzilla.suse.com/934219 From sle-security-updates at lists.suse.com Mon Sep 21 01:10:00 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Mon, 21 Sep 2015 09:10:00 +0200 (CEST) Subject: SUSE-SU-2015:1581-1: important: Security update for openssh Message-ID: <20150921071001.022D332102@maintenance.suse.de> SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1581-1 Rating: important References: #673532 #903649 #905118 #914309 #916549 #932483 #936695 #938746 #943006 #943010 #945493 Cross-References: CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 Affected Products: SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: openssh was updated to fix several security issues and bugs. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. These non-security issues were fixed: - bsc#914309: sshd inherits oom_adj -17 on SIGHUP causing DoS potential for oom_killer. - bsc#673532: limits.conf fsize change in SLES10SP3 causing problems to WebSphere mqm user. - bsc#916549: Fixed support for aesXXX-gcm at openssh.com. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-openssh-12096=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-openssh-12096=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-openssh-12096=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-openssh-12096=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): openssh-6.2p2-0.21.1 openssh-askpass-6.2p2-0.21.1 openssh-askpass-gnome-6.2p2-0.21.3 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-6.2p2-0.21.1 openssh-askpass-6.2p2-0.21.1 openssh-askpass-gnome-6.2p2-0.21.3 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): openssh-6.2p2-0.21.1 openssh-askpass-6.2p2-0.21.1 openssh-askpass-gnome-6.2p2-0.21.3 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): openssh-askpass-gnome-debuginfo-6.2p2-0.21.3 openssh-debuginfo-6.2p2-0.21.1 openssh-debugsource-6.2p2-0.21.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-5352.html https://www.suse.com/security/cve/CVE-2015-5600.html https://www.suse.com/security/cve/CVE-2015-6563.html https://www.suse.com/security/cve/CVE-2015-6564.html https://bugzilla.suse.com/673532 https://bugzilla.suse.com/903649 https://bugzilla.suse.com/905118 https://bugzilla.suse.com/914309 https://bugzilla.suse.com/916549 https://bugzilla.suse.com/932483 https://bugzilla.suse.com/936695 https://bugzilla.suse.com/938746 https://bugzilla.suse.com/943006 https://bugzilla.suse.com/943010 https://bugzilla.suse.com/945493 From sle-security-updates at lists.suse.com Tue Sep 22 02:09:39 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 22 Sep 2015 10:09:39 +0200 (CEST) Subject: SUSE-SU-2015:1592-1: important: Security update for the Linux Kernel Message-ID: <20150922080939.307A432102@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1592-1 Rating: important References: #851068 #867362 #873385 #883380 #886785 #894936 #915517 #917830 #919463 #920110 #920250 #920733 #921430 #923245 #924701 #925705 #925881 #925903 #926240 #926953 #927355 #927786 #929142 #929143 #930092 #930761 #930934 #931538 #932348 #932458 #933429 #933896 #933904 #933907 #933936 #934742 #934944 #935053 #935572 #935705 #935866 #935906 #936077 #936423 #936637 #936831 #936875 #936925 #937032 #937402 #937444 #937503 #937641 #937855 #939910 #939994 #940338 #940398 #942350 Cross-References: CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-0777 CVE-2015-1420 CVE-2015-1805 CVE-2015-2150 CVE-2015-2830 CVE-2015-4167 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 CVE-2015-5707 Affected Products: SUSE Linux Enterprise Real Time Extension 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 45 fixes is now available. Description: The SUSE Linux Enterprise 11 SP3 Realtime kernel was updated to receive various security and bugfixes. The following feature was added for RT: - FATE#317131: The SocketCAN (Peak PCI) driver was added for CAN bus support. Following security bugs were fixed: - CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code (bsc#940338). - CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-1420: A race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517). - CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705). - CVE-2015-4167: The UDF filesystem in the Linux kernel was vulnerable to a crash which could occur while fetching inode information from a corrupted/malicious udf file system image. (bsc#933907). - CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731: Various issues in handling UDF filesystems in the Linux kernel allowed the corruption of kernel memory and other issues. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash. (bsc#933904 bsc#933896) - CVE-2015-2150: The Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bsc#919463). - CVE-2015-0777: drivers/xen/usbback/usbback.c as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830). - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240). - CVE-2015-1805: The Linux kernels implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (bsc#933429). Also the following non-security bugs were fixed: - audit: keep inode pinned (bsc#851068). - btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#942350). - btrfs: check if previous transaction aborted to avoid fs corruption (bnc#942350). - btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#942350). - cifs: Fix missing crypto allocation (bnc#937402). - client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bnc#932348). - drm: ast,cirrus,mgag200: use drm_can_sleep (bnc#883380, bsc#935572). - drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: Do not do full cleanup if mgag200_device_init fails. - ext3: Fix data corruption in inodes with journalled data (bsc#936637) - ext4: handle SEEK_HOLE/SEEK_DATA generically (bsc#934944). - fanotify: Fix deadlock with permission events (bsc#935053). - fork: reset mm->pinned_vm (bnc#937855). - hrtimer: prevent timer interrupt DoS (bnc#886785). - hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - IB/core: Fix mismatch between locked and pinned pages (bnc#937855). - iommu/amd: Fix memory leak in free_pagetable (bsc#935866). - iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538). - iommu/amd: Handle large pages correctly in free_pagetable (bsc#935866). - ipr: Increase default adapter init stage change timeout (bsc#930761). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - kdump: fix crash_kexec()/smp_send_stop() race in panic() (bnc#937444). - kernel: add panic_on_warn. (bsc#934742) - kvm: irqchip: Break up high order allocations of kvm_irq_routing_table (bnc#926953). - libata: prevent HSM state change race between ISR and PIO (bsc#923245). - md: use kzalloc() when bitmap is disabled (bsc#939994). - megaraid_sas: Use correct reset sequence in adp_reset() (bsc#894936). - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - mm/hugetlb: check for pte NULL pointer in __page_check_address() (bnc#929143). - mm: restrict access to slab files under procfs and sysfs (bnc#936077). - net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference (bsc#867362). - net: Fix "ip rule delete table 256" (bsc#873385). - net: ipv6: fib: do not sleep inside atomic lock (bsc#867362). - net/mlx4_core: Do not disable SRIOV if there are active VFs (bsc#927355). - nfsd: Fix nfsv4 opcode decoding error (bsc#935906). - nfsd: support disabling 64bit dir cookies (bnc#937503). - nfs: never queue requests with rq_cong set on the sending queue (bsc#932458). - nfsv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error (bsc#939910). - pagecache limit: add tracepoints (bnc#924701). - pagecache limit: Do not skip over small zones that easily (bnc#925881). - pagecache limit: export debugging counters via /proc/vmstat (bnc#924701). - pagecache limit: fix wrong nr_reclaimed count (bnc#924701). - pagecache limit: reduce starvation due to reclaim retries (bnc#925903). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - pci: Disable Bus Master only on kexec reboot (bsc#920110). - pci: disable Bus Master on PCI device shutdown (bsc#920110). - pci: Disable Bus Master unconditionally in pci_device_shutdown() (bsc#920110). - pci: Don't try to disable Bus Master on disconnected PCI devices (bsc#920110). - perf, nmi: Fix unknown NMI warning (bsc#929142). - perf/x86/intel: Move NMI clearing to end of PMI handler (bsc#929142). - rtlwifi: rtl8192cu: Fix kernel deadlock (bnc#927786). - sched: fix __sched_setscheduler() vs load balancing race (bnc#921430) - scsi_error: add missing case statements in scsi_decide_disposition() (bsc#920733). - scsi: Set hostbyte status in scsi_check_sense() (bsc#920733). - scsi: set host msg status correctly (bnc#933936) - scsi: vmw_pvscsi: Fix pvscsi_abort() function (bnc#940398 bsc#930934). - st: null pointer dereference panic caused by use after kref_put by st_open (bsc#936875). - udf: Remove repeated loads blocksize (bsc#933907). - usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset (bnc#937641). - vmxnet3: Bump up driver version number (bsc#936423). - vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423). - vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423). - vmxnet3: Register shutdown handler for device (fwd) (bug#936423). - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - x86, tls: Interpret an all-zero struct user_desc as "no segment" (bsc#920250). - x86, tls, ldt: Stop checking lm in LDT_empty (bsc#920250). - xenbus: add proper handling of XS_ERROR from Xenbus for transactions. - xfs: avoid mounting of xfs filesystems with inconsistent option (bnc#925705) - zcrypt: Fixed reset and interrupt handling of AP queues (bnc#936925, LTC#126491). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Real Time Extension 11-SP3: zypper in -t patch slertesp3-kernel-rt-201509-12099=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-rt-201509-12099=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Real Time Extension 11-SP3 (x86_64): kernel-rt-3.0.101.rt130-0.33.40.1 kernel-rt-base-3.0.101.rt130-0.33.40.1 kernel-rt-devel-3.0.101.rt130-0.33.40.1 kernel-rt_trace-3.0.101.rt130-0.33.40.1 kernel-rt_trace-base-3.0.101.rt130-0.33.40.1 kernel-rt_trace-devel-3.0.101.rt130-0.33.40.1 kernel-source-rt-3.0.101.rt130-0.33.40.1 kernel-syms-rt-3.0.101.rt130-0.33.40.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-rt-debuginfo-3.0.101.rt130-0.33.40.1 kernel-rt-debugsource-3.0.101.rt130-0.33.40.1 kernel-rt_trace-debuginfo-3.0.101.rt130-0.33.40.1 kernel-rt_trace-debugsource-3.0.101.rt130-0.33.40.1 References: https://www.suse.com/security/cve/CVE-2014-9728.html https://www.suse.com/security/cve/CVE-2014-9729.html https://www.suse.com/security/cve/CVE-2014-9730.html https://www.suse.com/security/cve/CVE-2014-9731.html https://www.suse.com/security/cve/CVE-2015-0777.html https://www.suse.com/security/cve/CVE-2015-1420.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-2150.html https://www.suse.com/security/cve/CVE-2015-2830.html https://www.suse.com/security/cve/CVE-2015-4167.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://www.suse.com/security/cve/CVE-2015-5707.html https://bugzilla.suse.com/851068 https://bugzilla.suse.com/867362 https://bugzilla.suse.com/873385 https://bugzilla.suse.com/883380 https://bugzilla.suse.com/886785 https://bugzilla.suse.com/894936 https://bugzilla.suse.com/915517 https://bugzilla.suse.com/917830 https://bugzilla.suse.com/919463 https://bugzilla.suse.com/920110 https://bugzilla.suse.com/920250 https://bugzilla.suse.com/920733 https://bugzilla.suse.com/921430 https://bugzilla.suse.com/923245 https://bugzilla.suse.com/924701 https://bugzilla.suse.com/925705 https://bugzilla.suse.com/925881 https://bugzilla.suse.com/925903 https://bugzilla.suse.com/926240 https://bugzilla.suse.com/926953 https://bugzilla.suse.com/927355 https://bugzilla.suse.com/927786 https://bugzilla.suse.com/929142 https://bugzilla.suse.com/929143 https://bugzilla.suse.com/930092 https://bugzilla.suse.com/930761 https://bugzilla.suse.com/930934 https://bugzilla.suse.com/931538 https://bugzilla.suse.com/932348 https://bugzilla.suse.com/932458 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/933896 https://bugzilla.suse.com/933904 https://bugzilla.suse.com/933907 https://bugzilla.suse.com/933936 https://bugzilla.suse.com/934742 https://bugzilla.suse.com/934944 https://bugzilla.suse.com/935053 https://bugzilla.suse.com/935572 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/935866 https://bugzilla.suse.com/935906 https://bugzilla.suse.com/936077 https://bugzilla.suse.com/936423 https://bugzilla.suse.com/936637 https://bugzilla.suse.com/936831 https://bugzilla.suse.com/936875 https://bugzilla.suse.com/936925 https://bugzilla.suse.com/937032 https://bugzilla.suse.com/937402 https://bugzilla.suse.com/937444 https://bugzilla.suse.com/937503 https://bugzilla.suse.com/937641 https://bugzilla.suse.com/937855 https://bugzilla.suse.com/939910 https://bugzilla.suse.com/939994 https://bugzilla.suse.com/940338 https://bugzilla.suse.com/940398 https://bugzilla.suse.com/942350 From sle-security-updates at lists.suse.com Tue Sep 22 08:09:41 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Tue, 22 Sep 2015 16:09:41 +0200 (CEST) Subject: SUSE-SU-2015:1602-1: Security update for python modules Message-ID: <20150922140941.B2AEE32101@maintenance.suse.de> SUSE Security Update: Security update for python modules ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1602-1 Rating: low References: #914910 #928205 #933758 Affected Products: SUSE OpenStack Cloud Compute 5 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for several python modules provides the following security fix and improvements. - python-keystonemiddleware: + Fix s3_token middleware parsing insecure option (bsc#928205, CVE-2015-1852) - python-novaclient: + Update novaclient shell to use shared arguments from Session (bnc#933758) + Support using the Keystone V3 API from the Nova CLI (bnc#933758) - python-swiftclient: + Add dependency to python-setuptools (bnc#914910) - python-glanceclient: + Remove deprecation warning Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Compute 5: zypper in -t patch SUSE-SLE12-CLOUD-5-2015-570=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud Compute 5 (noarch): python-glanceclient-0.15.0-3.1 python-keystoneclient-1.0.0-19.1 python-keystoneclient-doc-1.0.0-19.1 python-keystonemiddleware-1.2.0-4.1 python-novaclient-2.20.0-6.1 python-novaclient-doc-2.20.0-6.1 python-swiftclient-2.3.1-3.1 python-swiftclient-doc-2.3.1-3.1 References: https://bugzilla.suse.com/914910 https://bugzilla.suse.com/928205 https://bugzilla.suse.com/933758 From sle-security-updates at lists.suse.com Wed Sep 23 03:09:58 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 23 Sep 2015 11:09:58 +0200 (CEST) Subject: SUSE-SU-2015:1611-1: important: Security update for the Linux Kernel Message-ID: <20150923090958.4BA8332102@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1611-1 Rating: important References: #851068 #867362 #873385 #883380 #886785 #894936 #915517 #917830 #919463 #920110 #920250 #920733 #921430 #923245 #924701 #925705 #925881 #925903 #926240 #926953 #927355 #927786 #929142 #929143 #930092 #930761 #930934 #931538 #932348 #932458 #933429 #933896 #933904 #933907 #933936 #934742 #934944 #935053 #935572 #935705 #935866 #935906 #936077 #936423 #936637 #936831 #936875 #936925 #937032 #937402 #937444 #937503 #937641 #937855 #939910 #939994 #940338 #940398 #942350 Cross-References: CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-0777 CVE-2015-1420 CVE-2015-1805 CVE-2015-2150 CVE-2015-2830 CVE-2015-4167 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 CVE-2015-5707 Affected Products: SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 45 fixes is now available. Description: The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. Following security bugs were fixed: - CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code (bsc#940338). - CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-1420: A race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517). - CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705). - CVE-2015-4167: The UDF filesystem in the Linux kernel was vulnerable to a crash which could occur while fetching inode information from a corrupted/malicious udf file system image. (bsc#933907). - CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731: Various issues in handling UDF filesystems in the Linux kernel allowed the corruption of kernel memory and other issues. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash. (bsc#933904 bsc#933896) - CVE-2015-2150: The Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bsc#919463). - CVE-2015-0777: drivers/xen/usbback/usbback.c as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830). - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240). - CVE-2015-1805: The Linux kernels implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (bsc#933429). Also the following non-security bugs were fixed: - audit: keep inode pinned (bsc#851068). - btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#942350). - btrfs: check if previous transaction aborted to avoid fs corruption (bnc#942350). - btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#942350). - cifs: Fix missing crypto allocation (bnc#937402). - client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bnc#932348). - drm: ast,cirrus,mgag200: use drm_can_sleep (bnc#883380, bsc#935572). - drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: Do not do full cleanup if mgag200_device_init fails. - ext3: Fix data corruption in inodes with journalled data (bsc#936637) - ext4: handle SEEK_HOLE/SEEK_DATA generically (bsc#934944). - fanotify: Fix deadlock with permission events (bsc#935053). - fork: reset mm->pinned_vm (bnc#937855). - hrtimer: prevent timer interrupt DoS (bnc#886785). - hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - IB/core: Fix mismatch between locked and pinned pages (bnc#937855). - iommu/amd: Fix memory leak in free_pagetable (bsc#935866). - iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538). - iommu/amd: Handle large pages correctly in free_pagetable (bsc#935866). - ipr: Increase default adapter init stage change timeout (bsc#930761). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - kdump: fix crash_kexec()/smp_send_stop() race in panic() (bnc#937444). - kernel: add panic_on_warn. (bsc#934742) - kvm: irqchip: Break up high order allocations of kvm_irq_routing_table (bnc#926953). - libata: prevent HSM state change race between ISR and PIO (bsc#923245). - md: use kzalloc() when bitmap is disabled (bsc#939994). - megaraid_sas: Use correct reset sequence in adp_reset() (bsc#894936). - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - mm/hugetlb: check for pte NULL pointer in __page_check_address() (bnc#929143). - mm: restrict access to slab files under procfs and sysfs (bnc#936077). - net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference (bsc#867362). - net: Fix "ip rule delete table 256" (bsc#873385). - net: ipv6: fib: do not sleep inside atomic lock (bsc#867362). - net/mlx4_core: Do not disable SRIOV if there are active VFs (bsc#927355). - nfsd: Fix nfsv4 opcode decoding error (bsc#935906). - nfsd: support disabling 64bit dir cookies (bnc#937503). - nfs: never queue requests with rq_cong set on the sending queue (bsc#932458). - nfsv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error (bsc#939910). - pagecache limit: add tracepoints (bnc#924701). - pagecache limit: Do not skip over small zones that easily (bnc#925881). - pagecache limit: export debugging counters via /proc/vmstat (bnc#924701). - pagecache limit: fix wrong nr_reclaimed count (bnc#924701). - pagecache limit: reduce starvation due to reclaim retries (bnc#925903). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - pci: Disable Bus Master only on kexec reboot (bsc#920110). - pci: disable Bus Master on PCI device shutdown (bsc#920110). - pci: Disable Bus Master unconditionally in pci_device_shutdown() (bsc#920110). - pci: Don't try to disable Bus Master on disconnected PCI devices (bsc#920110). - perf, nmi: Fix unknown NMI warning (bsc#929142). - perf/x86/intel: Move NMI clearing to end of PMI handler (bsc#929142). - rtlwifi: rtl8192cu: Fix kernel deadlock (bnc#927786). - sched: fix __sched_setscheduler() vs load balancing race (bnc#921430) - scsi_error: add missing case statements in scsi_decide_disposition() (bsc#920733). - scsi: Set hostbyte status in scsi_check_sense() (bsc#920733). - scsi: set host msg status correctly (bnc#933936) - scsi: vmw_pvscsi: Fix pvscsi_abort() function (bnc#940398 bsc#930934). - st: null pointer dereference panic caused by use after kref_put by st_open (bsc#936875). - udf: Remove repeated loads blocksize (bsc#933907). - usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset (bnc#937641). - vmxnet3: Bump up driver version number (bsc#936423). - vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423). - vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423). - vmxnet3: Register shutdown handler for device (fwd) (bug#936423). - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - x86, tls: Interpret an all-zero struct user_desc as "no segment" (bsc#920250). - x86, tls, ldt: Stop checking lm in LDT_empty (bsc#920250). - xenbus: add proper handling of XS_ERROR from Xenbus for transactions. - xfs: avoid mounting of xfs filesystems with inconsistent option (bnc#925705) - zcrypt: Fixed reset and interrupt handling of AP queues (bnc#936925, LTC#126491). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-kernel-201508-12100=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-kernel-201508-12100=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-201508-12100=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-kernel-201508-12100=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-kernel-201508-12100=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): kernel-default-3.0.101-0.47.67.2 kernel-default-base-3.0.101-0.47.67.2 kernel-default-devel-3.0.101-0.47.67.2 kernel-source-3.0.101-0.47.67.2 kernel-syms-3.0.101-0.47.67.2 kernel-trace-3.0.101-0.47.67.2 kernel-trace-base-3.0.101-0.47.67.2 kernel-trace-devel-3.0.101-0.47.67.2 kernel-xen-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): kernel-bigsmp-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586): kernel-pae-3.0.101-0.47.67.2 kernel-pae-base-3.0.101-0.47.67.2 kernel-pae-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-0.47.67.2 kernel-default-base-3.0.101-0.47.67.2 kernel-default-devel-3.0.101-0.47.67.2 kernel-source-3.0.101-0.47.67.2 kernel-syms-3.0.101-0.47.67.2 kernel-trace-3.0.101-0.47.67.2 kernel-trace-base-3.0.101-0.47.67.2 kernel-trace-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (i586 x86_64): kernel-ec2-3.0.101-0.47.67.2 kernel-ec2-base-3.0.101-0.47.67.2 kernel-ec2-devel-3.0.101-0.47.67.2 kernel-xen-3.0.101-0.47.67.2 kernel-xen-base-3.0.101-0.47.67.2 kernel-xen-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (x86_64): kernel-bigsmp-3.0.101-0.47.67.2 kernel-bigsmp-base-3.0.101-0.47.67.2 kernel-bigsmp-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (s390x): kernel-default-man-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (ppc64): kernel-ppc64-3.0.101-0.47.67.2 kernel-ppc64-base-3.0.101-0.47.67.2 kernel-ppc64-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-SP3 (i586): kernel-pae-3.0.101-0.47.67.2 kernel-pae-base-3.0.101-0.47.67.2 kernel-pae-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-bigsmp-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): kernel-default-3.0.101-0.47.67.2 kernel-default-base-3.0.101-0.47.67.2 kernel-default-devel-3.0.101-0.47.67.2 kernel-default-extra-3.0.101-0.47.67.2 kernel-source-3.0.101-0.47.67.2 kernel-syms-3.0.101-0.47.67.2 kernel-trace-devel-3.0.101-0.47.67.2 kernel-xen-3.0.101-0.47.67.2 kernel-xen-base-3.0.101-0.47.67.2 kernel-xen-devel-3.0.101-0.47.67.2 kernel-xen-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): kernel-bigsmp-devel-3.0.101-0.47.67.2 - SUSE Linux Enterprise Desktop 11-SP3 (i586): kernel-pae-3.0.101-0.47.67.2 kernel-pae-base-3.0.101-0.47.67.2 kernel-pae-devel-3.0.101-0.47.67.2 kernel-pae-extra-3.0.101-0.47.67.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-0.47.67.2 kernel-default-debugsource-3.0.101-0.47.67.2 kernel-trace-debuginfo-3.0.101-0.47.67.2 kernel-trace-debugsource-3.0.101-0.47.67.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-0.47.67.2 kernel-ec2-debugsource-3.0.101-0.47.67.2 kernel-xen-debuginfo-3.0.101-0.47.67.2 kernel-xen-debugsource-3.0.101-0.47.67.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (x86_64): kernel-bigsmp-debuginfo-3.0.101-0.47.67.2 kernel-bigsmp-debugsource-3.0.101-0.47.67.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (ppc64): kernel-ppc64-debuginfo-3.0.101-0.47.67.2 kernel-ppc64-debugsource-3.0.101-0.47.67.2 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586): kernel-pae-debuginfo-3.0.101-0.47.67.2 kernel-pae-debugsource-3.0.101-0.47.67.2 References: https://www.suse.com/security/cve/CVE-2014-9728.html https://www.suse.com/security/cve/CVE-2014-9729.html https://www.suse.com/security/cve/CVE-2014-9730.html https://www.suse.com/security/cve/CVE-2014-9731.html https://www.suse.com/security/cve/CVE-2015-0777.html https://www.suse.com/security/cve/CVE-2015-1420.html https://www.suse.com/security/cve/CVE-2015-1805.html https://www.suse.com/security/cve/CVE-2015-2150.html https://www.suse.com/security/cve/CVE-2015-2830.html https://www.suse.com/security/cve/CVE-2015-4167.html https://www.suse.com/security/cve/CVE-2015-4700.html https://www.suse.com/security/cve/CVE-2015-5364.html https://www.suse.com/security/cve/CVE-2015-5366.html https://www.suse.com/security/cve/CVE-2015-5707.html https://bugzilla.suse.com/851068 https://bugzilla.suse.com/867362 https://bugzilla.suse.com/873385 https://bugzilla.suse.com/883380 https://bugzilla.suse.com/886785 https://bugzilla.suse.com/894936 https://bugzilla.suse.com/915517 https://bugzilla.suse.com/917830 https://bugzilla.suse.com/919463 https://bugzilla.suse.com/920110 https://bugzilla.suse.com/920250 https://bugzilla.suse.com/920733 https://bugzilla.suse.com/921430 https://bugzilla.suse.com/923245 https://bugzilla.suse.com/924701 https://bugzilla.suse.com/925705 https://bugzilla.suse.com/925881 https://bugzilla.suse.com/925903 https://bugzilla.suse.com/926240 https://bugzilla.suse.com/926953 https://bugzilla.suse.com/927355 https://bugzilla.suse.com/927786 https://bugzilla.suse.com/929142 https://bugzilla.suse.com/929143 https://bugzilla.suse.com/930092 https://bugzilla.suse.com/930761 https://bugzilla.suse.com/930934 https://bugzilla.suse.com/931538 https://bugzilla.suse.com/932348 https://bugzilla.suse.com/932458 https://bugzilla.suse.com/933429 https://bugzilla.suse.com/933896 https://bugzilla.suse.com/933904 https://bugzilla.suse.com/933907 https://bugzilla.suse.com/933936 https://bugzilla.suse.com/934742 https://bugzilla.suse.com/934944 https://bugzilla.suse.com/935053 https://bugzilla.suse.com/935572 https://bugzilla.suse.com/935705 https://bugzilla.suse.com/935866 https://bugzilla.suse.com/935906 https://bugzilla.suse.com/936077 https://bugzilla.suse.com/936423 https://bugzilla.suse.com/936637 https://bugzilla.suse.com/936831 https://bugzilla.suse.com/936875 https://bugzilla.suse.com/936925 https://bugzilla.suse.com/937032 https://bugzilla.suse.com/937402 https://bugzilla.suse.com/937444 https://bugzilla.suse.com/937503 https://bugzilla.suse.com/937641 https://bugzilla.suse.com/937855 https://bugzilla.suse.com/939910 https://bugzilla.suse.com/939994 https://bugzilla.suse.com/940338 https://bugzilla.suse.com/940398 https://bugzilla.suse.com/942350 From sle-security-updates at lists.suse.com Wed Sep 23 08:06:48 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 23 Sep 2015 16:06:48 +0200 (CEST) Subject: SUSE-SU-2015:1612-1: moderate: Security update for kernel-source Message-ID: <20150923140648.8CD3632101@maintenance.suse.de> SUSE Security Update: Security update for kernel-source ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1612-1 Rating: moderate References: #924525 #936916 #944001 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The SUSE Linux Enterprise 12 kernel was updated to version 3.12.44-52.13 to receive various bugfixes. - Btrfs: don't initialize a space info as full to prevent ENOSPC (bsc#944001). - kernel/kvm: Fix MSA3/MSA4 detection (bsc#936916, LTC#127868). - zcrypt: Fixed reset and interrupt handling of AP queues (bsc#936916, LTC#126491). - Update s390x kABI files after gcc update (bsc#924525). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-588=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-588=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-588=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-588=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-588=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-588=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.44-52.18.1 kernel-default-debugsource-3.12.44-52.18.1 kernel-default-extra-3.12.44-52.18.1 kernel-default-extra-debuginfo-3.12.44-52.18.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.44-52.18.1 kernel-obs-build-debugsource-3.12.44-52.18.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.44-52.18.3 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.44-52.18.1 kernel-default-base-3.12.44-52.18.1 kernel-default-base-debuginfo-3.12.44-52.18.1 kernel-default-debuginfo-3.12.44-52.18.1 kernel-default-debugsource-3.12.44-52.18.1 kernel-default-devel-3.12.44-52.18.1 kernel-syms-3.12.44-52.18.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.44-52.18.1 kernel-xen-base-3.12.44-52.18.1 kernel-xen-base-debuginfo-3.12.44-52.18.1 kernel-xen-debuginfo-3.12.44-52.18.1 kernel-xen-debugsource-3.12.44-52.18.1 kernel-xen-devel-3.12.44-52.18.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.44-52.18.1 kernel-macros-3.12.44-52.18.1 kernel-source-3.12.44-52.18.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.44-52.18.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.44-52.18.1 kernel-ec2-debuginfo-3.12.44-52.18.1 kernel-ec2-debugsource-3.12.44-52.18.1 kernel-ec2-devel-3.12.44-52.18.1 kernel-ec2-extra-3.12.44-52.18.1 kernel-ec2-extra-debuginfo-3.12.44-52.18.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_44-52_18-default-1-4.2 kgraft-patch-3_12_44-52_18-xen-1-4.2 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.44-52.18.1 kernel-default-debuginfo-3.12.44-52.18.1 kernel-default-debugsource-3.12.44-52.18.1 kernel-default-devel-3.12.44-52.18.1 kernel-default-extra-3.12.44-52.18.1 kernel-default-extra-debuginfo-3.12.44-52.18.1 kernel-syms-3.12.44-52.18.1 kernel-xen-3.12.44-52.18.1 kernel-xen-debuginfo-3.12.44-52.18.1 kernel-xen-debugsource-3.12.44-52.18.1 kernel-xen-devel-3.12.44-52.18.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.44-52.18.1 kernel-macros-3.12.44-52.18.1 kernel-source-3.12.44-52.18.1 References: https://bugzilla.suse.com/924525 https://bugzilla.suse.com/936916 https://bugzilla.suse.com/944001 From sle-security-updates at lists.suse.com Wed Sep 23 08:07:41 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 23 Sep 2015 16:07:41 +0200 (CEST) Subject: SUSE-SU-2015:1614-1: important: Security update for flash-player Message-ID: <20150923140741.D047932101@maintenance.suse.de> SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1614-1 Rating: important References: #946880 Cross-References: CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579 CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584 CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.521 (APSB15-23 bsc#946880) fixing several security issues: More information can be found on: https://helpx.adobe.com/security/products/flash-player/apsb15-23.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-12101=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-flash-player-12101=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.521-0.17.1 flash-player-gnome-11.2.202.521-0.17.1 flash-player-kde4-11.2.202.521-0.17.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): flash-player-11.2.202.521-0.17.1 flash-player-gnome-11.2.202.521-0.17.1 flash-player-kde4-11.2.202.521-0.17.1 References: https://www.suse.com/security/cve/CVE-2015-5567.html https://www.suse.com/security/cve/CVE-2015-5568.html https://www.suse.com/security/cve/CVE-2015-5570.html https://www.suse.com/security/cve/CVE-2015-5571.html https://www.suse.com/security/cve/CVE-2015-5572.html https://www.suse.com/security/cve/CVE-2015-5573.html https://www.suse.com/security/cve/CVE-2015-5574.html https://www.suse.com/security/cve/CVE-2015-5575.html https://www.suse.com/security/cve/CVE-2015-5576.html https://www.suse.com/security/cve/CVE-2015-5577.html https://www.suse.com/security/cve/CVE-2015-5578.html https://www.suse.com/security/cve/CVE-2015-5579.html https://www.suse.com/security/cve/CVE-2015-5580.html https://www.suse.com/security/cve/CVE-2015-5581.html https://www.suse.com/security/cve/CVE-2015-5582.html https://www.suse.com/security/cve/CVE-2015-5584.html https://www.suse.com/security/cve/CVE-2015-5587.html https://www.suse.com/security/cve/CVE-2015-5588.html https://www.suse.com/security/cve/CVE-2015-6676.html https://www.suse.com/security/cve/CVE-2015-6677.html https://www.suse.com/security/cve/CVE-2015-6678.html https://www.suse.com/security/cve/CVE-2015-6679.html https://www.suse.com/security/cve/CVE-2015-6682.html https://bugzilla.suse.com/946880 From sle-security-updates at lists.suse.com Wed Sep 23 08:08:54 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 23 Sep 2015 16:08:54 +0200 (CEST) Subject: SUSE-SU-2015:1618-1: important: Security update for flash-player Message-ID: <20150923140855.0078432101@maintenance.suse.de> SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1618-1 Rating: important References: #946880 Cross-References: CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579 CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584 CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.521 (APSB15-23 bsc#946880) fixing several security issues: More information can be found on: https://helpx.adobe.com/security/products/flash-player/apsb15-23.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-581=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-581=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): flash-player-11.2.202.521-102.1 flash-player-gnome-11.2.202.521-102.1 - SUSE Linux Enterprise Desktop 12 (x86_64): flash-player-11.2.202.521-102.1 flash-player-gnome-11.2.202.521-102.1 References: https://www.suse.com/security/cve/CVE-2015-5567.html https://www.suse.com/security/cve/CVE-2015-5568.html https://www.suse.com/security/cve/CVE-2015-5570.html https://www.suse.com/security/cve/CVE-2015-5571.html https://www.suse.com/security/cve/CVE-2015-5572.html https://www.suse.com/security/cve/CVE-2015-5573.html https://www.suse.com/security/cve/CVE-2015-5574.html https://www.suse.com/security/cve/CVE-2015-5575.html https://www.suse.com/security/cve/CVE-2015-5576.html https://www.suse.com/security/cve/CVE-2015-5577.html https://www.suse.com/security/cve/CVE-2015-5578.html https://www.suse.com/security/cve/CVE-2015-5579.html https://www.suse.com/security/cve/CVE-2015-5580.html https://www.suse.com/security/cve/CVE-2015-5581.html https://www.suse.com/security/cve/CVE-2015-5582.html https://www.suse.com/security/cve/CVE-2015-5584.html https://www.suse.com/security/cve/CVE-2015-5587.html https://www.suse.com/security/cve/CVE-2015-5588.html https://www.suse.com/security/cve/CVE-2015-6676.html https://www.suse.com/security/cve/CVE-2015-6677.html https://www.suse.com/security/cve/CVE-2015-6678.html https://www.suse.com/security/cve/CVE-2015-6679.html https://www.suse.com/security/cve/CVE-2015-6682.html https://bugzilla.suse.com/946880 From sle-security-updates at lists.suse.com Thu Sep 24 07:09:59 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Thu, 24 Sep 2015 15:09:59 +0200 (CEST) Subject: SUSE-SU-2015:1626-1: moderate: Security update for libgcrypt Message-ID: <20150924130959.4F04B3213B@maintenance.suse.de> SUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1626-1 Rating: moderate References: #920057 Cross-References: CVE-2014-3591 CVE-2015-0837 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following issues: * Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. (bsc#920057) * Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-libgcrypt-12102=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-libgcrypt-12102=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-libgcrypt-12102=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-libgcrypt-12102=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-libgcrypt-12102=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-libgcrypt-12102=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-libgcrypt-12102=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-libgcrypt-12102=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-libgcrypt-12102=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libgcrypt-devel-1.5.0-0.19.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libgcrypt-devel-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): libgcrypt-devel-1.5.0-0.19.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (ppc64 s390x x86_64): libgcrypt-devel-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): libgcrypt11-1.5.0-0.19.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libgcrypt11-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libgcrypt11-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libgcrypt11-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libgcrypt11-x86-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): libgcrypt11-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libgcrypt11-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libgcrypt11-x86-1.5.0-0.19.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): libgcrypt11-1.5.0-0.19.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libgcrypt11-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): libgcrypt11-1.5.0-0.19.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libgcrypt11-32bit-1.5.0-0.19.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): libgcrypt-debuginfo-1.5.0-0.19.1 libgcrypt-debugsource-1.5.0-0.19.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): libgcrypt-debuginfo-1.5.0-0.19.1 libgcrypt-debugsource-1.5.0-0.19.1 References: https://www.suse.com/security/cve/CVE-2014-3591.html https://www.suse.com/security/cve/CVE-2015-0837.html https://bugzilla.suse.com/920057 From sle-security-updates at lists.suse.com Fri Sep 25 07:09:55 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 25 Sep 2015 15:09:55 +0200 (CEST) Subject: SUSE-SU-2015:1633-1: important: Security update for php5 Message-ID: <20150925130955.190443213B@maintenance.suse.de> SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1633-1 Rating: important References: #935074 #942291 #942293 #942294 #942295 #942296 #944302 #945402 #945403 #945412 #945428 Cross-References: CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has three fixes is now available. Description: This update of PHP5 brings several security fixes. Security fixes: * CVE-2015-6831: A use after free vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#942291] [bnc#942294] [bnc#942295] * CVE-2015-6832: A dangling pointer in the unserialization of ArrayObject items could be used to crash php or potentially execute code. [bnc#942293] * CVE-2015-6833: A directory traversal when extracting ZIP files could be used to overwrite files outside of intended area. [bnc#942296] * CVE-2015-6834: A Use After Free Vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#945403] * CVE-2015-6835: A Use After Free Vulnerability in session unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#945402] * CVE-2015-6836: A SOAP serialize_function_call() type confusion leading to remote code execution problem was fixed. [bnc#945428] * CVE-2015-6837 CVE-2015-6838: Two NULL pointer dereferences in the XSLTProcessor class were fixed. [bnc#945412] Bugfixes: * Compare with SQL_NULL_DATA correctly [bnc#935074] * If MD5 was disabled in net-snmp we have to disable the used MD5 function in ext/snmp/snmp.c as well. (bsc#944302) Also the Suhosin framework was updated to 0.9.38. [fate#319325] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-603=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-603=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): php5-debuginfo-5.5.14-36.1 php5-debugsource-5.5.14-36.1 php5-devel-5.5.14-36.1 - SUSE Linux Enterprise Module for Web Scripting 12 (ppc64le s390x x86_64): apache2-mod_php5-5.5.14-36.1 apache2-mod_php5-debuginfo-5.5.14-36.1 php5-5.5.14-36.1 php5-bcmath-5.5.14-36.1 php5-bcmath-debuginfo-5.5.14-36.1 php5-bz2-5.5.14-36.1 php5-bz2-debuginfo-5.5.14-36.1 php5-calendar-5.5.14-36.1 php5-calendar-debuginfo-5.5.14-36.1 php5-ctype-5.5.14-36.1 php5-ctype-debuginfo-5.5.14-36.1 php5-curl-5.5.14-36.1 php5-curl-debuginfo-5.5.14-36.1 php5-dba-5.5.14-36.1 php5-dba-debuginfo-5.5.14-36.1 php5-debuginfo-5.5.14-36.1 php5-debugsource-5.5.14-36.1 php5-dom-5.5.14-36.1 php5-dom-debuginfo-5.5.14-36.1 php5-enchant-5.5.14-36.1 php5-enchant-debuginfo-5.5.14-36.1 php5-exif-5.5.14-36.1 php5-exif-debuginfo-5.5.14-36.1 php5-fastcgi-5.5.14-36.1 php5-fastcgi-debuginfo-5.5.14-36.1 php5-fileinfo-5.5.14-36.1 php5-fileinfo-debuginfo-5.5.14-36.1 php5-fpm-5.5.14-36.1 php5-fpm-debuginfo-5.5.14-36.1 php5-ftp-5.5.14-36.1 php5-ftp-debuginfo-5.5.14-36.1 php5-gd-5.5.14-36.1 php5-gd-debuginfo-5.5.14-36.1 php5-gettext-5.5.14-36.1 php5-gettext-debuginfo-5.5.14-36.1 php5-gmp-5.5.14-36.1 php5-gmp-debuginfo-5.5.14-36.1 php5-iconv-5.5.14-36.1 php5-iconv-debuginfo-5.5.14-36.1 php5-intl-5.5.14-36.1 php5-intl-debuginfo-5.5.14-36.1 php5-json-5.5.14-36.1 php5-json-debuginfo-5.5.14-36.1 php5-ldap-5.5.14-36.1 php5-ldap-debuginfo-5.5.14-36.1 php5-mbstring-5.5.14-36.1 php5-mbstring-debuginfo-5.5.14-36.1 php5-mcrypt-5.5.14-36.1 php5-mcrypt-debuginfo-5.5.14-36.1 php5-mysql-5.5.14-36.1 php5-mysql-debuginfo-5.5.14-36.1 php5-odbc-5.5.14-36.1 php5-odbc-debuginfo-5.5.14-36.1 php5-opcache-5.5.14-36.1 php5-opcache-debuginfo-5.5.14-36.1 php5-openssl-5.5.14-36.1 php5-openssl-debuginfo-5.5.14-36.1 php5-pcntl-5.5.14-36.1 php5-pcntl-debuginfo-5.5.14-36.1 php5-pdo-5.5.14-36.1 php5-pdo-debuginfo-5.5.14-36.1 php5-pgsql-5.5.14-36.1 php5-pgsql-debuginfo-5.5.14-36.1 php5-posix-5.5.14-36.1 php5-posix-debuginfo-5.5.14-36.1 php5-pspell-5.5.14-36.1 php5-pspell-debuginfo-5.5.14-36.1 php5-shmop-5.5.14-36.1 php5-shmop-debuginfo-5.5.14-36.1 php5-snmp-5.5.14-36.1 php5-snmp-debuginfo-5.5.14-36.1 php5-soap-5.5.14-36.1 php5-soap-debuginfo-5.5.14-36.1 php5-sockets-5.5.14-36.1 php5-sockets-debuginfo-5.5.14-36.1 php5-sqlite-5.5.14-36.1 php5-sqlite-debuginfo-5.5.14-36.1 php5-suhosin-5.5.14-36.1 php5-suhosin-debuginfo-5.5.14-36.1 php5-sysvmsg-5.5.14-36.1 php5-sysvmsg-debuginfo-5.5.14-36.1 php5-sysvsem-5.5.14-36.1 php5-sysvsem-debuginfo-5.5.14-36.1 php5-sysvshm-5.5.14-36.1 php5-sysvshm-debuginfo-5.5.14-36.1 php5-tokenizer-5.5.14-36.1 php5-tokenizer-debuginfo-5.5.14-36.1 php5-wddx-5.5.14-36.1 php5-wddx-debuginfo-5.5.14-36.1 php5-xmlreader-5.5.14-36.1 php5-xmlreader-debuginfo-5.5.14-36.1 php5-xmlrpc-5.5.14-36.1 php5-xmlrpc-debuginfo-5.5.14-36.1 php5-xmlwriter-5.5.14-36.1 php5-xmlwriter-debuginfo-5.5.14-36.1 php5-xsl-5.5.14-36.1 php5-xsl-debuginfo-5.5.14-36.1 php5-zip-5.5.14-36.1 php5-zip-debuginfo-5.5.14-36.1 php5-zlib-5.5.14-36.1 php5-zlib-debuginfo-5.5.14-36.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-36.1 References: https://www.suse.com/security/cve/CVE-2015-6831.html https://www.suse.com/security/cve/CVE-2015-6832.html https://www.suse.com/security/cve/CVE-2015-6833.html https://www.suse.com/security/cve/CVE-2015-6834.html https://www.suse.com/security/cve/CVE-2015-6835.html https://www.suse.com/security/cve/CVE-2015-6836.html https://www.suse.com/security/cve/CVE-2015-6837.html https://www.suse.com/security/cve/CVE-2015-6838.html https://bugzilla.suse.com/935074 https://bugzilla.suse.com/942291 https://bugzilla.suse.com/942293 https://bugzilla.suse.com/942294 https://bugzilla.suse.com/942295 https://bugzilla.suse.com/942296 https://bugzilla.suse.com/944302 https://bugzilla.suse.com/945402 https://bugzilla.suse.com/945403 https://bugzilla.suse.com/945412 https://bugzilla.suse.com/945428 From sle-security-updates at lists.suse.com Fri Sep 25 07:15:02 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 25 Sep 2015 15:15:02 +0200 (CEST) Subject: SUSE-SU-2015:1637-1: moderate: Security update for coreutils Message-ID: <20150925131502.9DA243213B@maintenance.suse.de> SUSE Security Update: Security update for coreutils ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1637-1 Rating: moderate References: #866010 #901905 #907290 #921559 #928749 #930565 #933396 Cross-References: CVE-2015-4041 CVE-2015-4042 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has 5 fixes is now available. Description: This update for coreutils provides the following fixes: - Fix memory handling error with case insensitive sort using UTF-8. (CVE-2015-4041, CVE-2015-4042) - Ensure "df -a" shows all remote file system entries. - Only suppress remote mounts of separate exports with "df --total". - Document that "df -a" might list duplicated file systems. - Adjust references to info nodes in man pages. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-599=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-599=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): coreutils-8.22-9.1 coreutils-debuginfo-8.22-9.1 coreutils-debugsource-8.22-9.1 - SUSE Linux Enterprise Server 12 (noarch): coreutils-lang-8.22-9.1 - SUSE Linux Enterprise Desktop 12 (x86_64): coreutils-8.22-9.1 coreutils-debuginfo-8.22-9.1 coreutils-debugsource-8.22-9.1 - SUSE Linux Enterprise Desktop 12 (noarch): coreutils-lang-8.22-9.1 References: https://www.suse.com/security/cve/CVE-2015-4041.html https://www.suse.com/security/cve/CVE-2015-4042.html https://bugzilla.suse.com/866010 https://bugzilla.suse.com/901905 https://bugzilla.suse.com/907290 https://bugzilla.suse.com/921559 https://bugzilla.suse.com/928749 https://bugzilla.suse.com/930565 https://bugzilla.suse.com/933396 From sle-security-updates at lists.suse.com Fri Sep 25 13:10:22 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Fri, 25 Sep 2015 21:10:22 +0200 (CEST) Subject: SUSE-SU-2015:1643-1: important: Security update for Xen Message-ID: <20150925191022.A44473213B@maintenance.suse.de> SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1643-1 Rating: important References: #932770 #932996 #938344 #939712 Cross-References: CVE-2015-3209 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Xen was updated to fix the following security issues: * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM. (bsc#938344) * CVE-2015-3209: Heap overflow in QEMU's pcnet controller allowing guest to host escape. (bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (bsc#932996) * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model. (XSA-140, bsc#939712) Security Issues: * CVE-2015-5154 * CVE-2015-3209 * CVE-2015-4164 * CVE-2015-5165 Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): xen-3.2.3_17040_46-0.21.1 xen-devel-3.2.3_17040_46-0.21.1 xen-doc-html-3.2.3_17040_46-0.21.1 xen-doc-pdf-3.2.3_17040_46-0.21.1 xen-doc-ps-3.2.3_17040_46-0.21.1 xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-libs-3.2.3_17040_46-0.21.1 xen-tools-3.2.3_17040_46-0.21.1 xen-tools-domU-3.2.3_17040_46-0.21.1 xen-tools-ioemu-3.2.3_17040_46-0.21.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): xen-libs-32bit-3.2.3_17040_46-0.21.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.132.4-0.21.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4164.html https://www.suse.com/security/cve/CVE-2015-5154.html https://www.suse.com/security/cve/CVE-2015-5165.html https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://bugzilla.suse.com/938344 https://bugzilla.suse.com/939712 https://download.suse.com/patch/finder/?keywords=8837c9fd890aaac522c74dc7741b001c From sle-security-updates at lists.suse.com Wed Sep 30 04:09:20 2015 From: sle-security-updates at lists.suse.com (sle-security-updates at lists.suse.com) Date: Wed, 30 Sep 2015 12:09:20 +0200 (CEST) Subject: SUSE-SU-2015:1651-1: moderate: Recommended update for python-setuptools Message-ID: <20150930100920.D64D33213B@maintenance.suse.de> SUSE Security Update: Recommended update for python-setuptools ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1651-1 Rating: moderate References: #930189 Cross-References: CVE-2013-7440 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: python-setuptools was updated to fix one security issue. The following vulnerability was fixed: * CVE-2013-7440: Non-RFC6125-compliant host name matching was incorrect (bsc#930189) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-python-setuptools-12111=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-python-setuptools-12111=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-python-setuptools-12111=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-python-setuptools-12111=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): python-setuptools-0.6c11-6.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): python-setuptools-0.6c11-6.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): python-setuptools-0.6c11-6.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): python-setuptools-0.6c11-6.1 References: https://www.suse.com/security/cve/CVE-2013-7440.html https://bugzilla.suse.com/930189