The OVAL Repository 5.4 2015-09-03T06:27:20.706-04:00 SUSE Linux Enterprise Desktop 12 compat-openssl098 This update fixes the following security issues: - CVE-2015-4000 (boo#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (boo#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (boo#934489) * Exploitable out-of-bounds read in X509_cmp_time Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 cups-filters cups-filters was updated to fix one security issue. This security issue was fixed: - CVE-2015-2265: Remote command execution in remove_bad_chars() (bnc#921753). This non-security issue was fixed: - LSB compliance of foomatic-rip (bnc#915545). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 dnsmasq The DNS server dnsmasq was updated to fix one security issue and one non-security bug. The following vulnerability was fixed: * CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read heap memory, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 evolution-data-server evolution-data-server was updated to disable support for SSLv3. This security issues was fixed: - SSLv3 POODLE attack (CVE-2014-3566) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 openldap2 openldap2 was updated to fix two security issues and one non-security bug. The following vulnerabilities were fixed: * A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897 CVE-2015-1545) * A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914 CVE-2015-1546) The following non-security issue was fixed: * Prevent connection-0 (internal connection) from showing up in the monitor backend (bnc#905959) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 gnome-settings-daemon gnome-settings-daemon was updated to fix a bug and a security issue: Security issue fixed: - CVE-2014-7300: The lockscreen can be bypassed with the Print Screen button. Bug fixed: - Do not hide the cursor while there was no mutter running (bsc#905158). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 curl curl was updated to fix five security issues. The following vulnerabilities were fixed: * CVE-2015-3143: curl could re-use NTML authenticateds connections * CVE-2015-3144: curl could access memory out of bounds with zero length host names * CVE-2015-3145: curl cookie parser could access memory out of boundary * CVE-2015-3148: curl could treat Negotiate as not connection-oriented * CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 autofs autofs was updated to fix one security issue. This security issue was fixed: - CVE-2014-8169: Prevent potential privilege escalation via interpreter load path for program-based automount maps (bnc#917977). These non-security issues were fixed: - Dont pass sloppy option for other than nfs mounts (bnc#901448, bnc#916203) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 gstreamer-0_10-plugins-bad gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 wpa_supplicant wpa_supplicant was updated to fix three security issues: - CVE-2015-0210: wpa_supplicant: broken certificate subject check this adds the "domain_match" config option from upstream (additional to the already existing domain_suffix_match) - CVE-2014-3686: hostapd command execution - CVE-2015-1863: P2P SSID processing vulnerability Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 perl-YAML-LibYAML erl-YAML-LibYAML was updated to fix three security issues. These security issues were fixed: - CVE-2013-6393: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performed an incorrect cast, which allowed remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggered a heap-based buffer overflow (bnc#860617, bnc#911782). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 gdm The GNOME Display Manager was updated to fix several bugs: Security issue fixed: - Removed gdm-fingerprint and gdm-smartcard pamfiles that allowed unlocking the screen without password or fingerprint if fingerprint reader support was enabled. (boo#900836). Bugs fixed: - Fix support for DISPLAYMANAGER_STARTS_XSERVER from /etc/sysconfig/displaymanager (bsc#919723). - Ensure ShowLocalGreeter configuration key is properly handled (bgo#743440). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 gd The graphics drawing library gd was updated to fix one security issue. The following vulnerability was fixed: * possible buffer read overflow (CVE-2014-9709) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 vorbis-tools Vorbis tools was updated to fix division by zero and integer overflows by crafted WAV files (CVE-2014-9638, CVE-2014-9639, bnc#914439, bnc#914441), that would allow attackers to crash the vorbis tools processes. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 gnutls gnutls was updated to fix one security issue. - Fixed parsing problem in elliptic curve blobs over TLS that could lead to remote crashes (CVE-2014-8564). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 tigervnc This update for tigervnc provides the following fixes: - Fixed integer overflow flaw, leading to a heap-based buffer overflow in screen size handling. (CVE-2014-8240) - Send correctly keys that don't type any characters, such as CTRL+Space. (bnc#906922) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 flash-player This flash-player security version update fixes the following issues: - Security update to 11.2.202.425 (bsc#909219): * APSB14-27, CVE-2014-0580, CVE-2014-0587, CVE-2014-8443, CVE-2014-9162, CVE-2014-9163, CVE-2014-9164 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 ImageMagick ImageMagick was updated to fix four security issues. These security issues were fixed: - Crafted JPEG file could lead to DOS (CVE-2014-8716). - Out-of-bounds memory access in PCX parser (CVE-2014-8355). - Out-of-bounds memory access in resize code (CVE-2014-8354). - Out-of-bounds memory error in DCM decode (CVE-2014-8562). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 cpio This cpio security update fixes the following buffer overflow issue and two non security issues: - fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112) - prevent cpio from extracting over a symlink (bnc#658010) - fix a truncation check in mt Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 compat-openssl098 compat-openssl098 was updated to fix three security issues. NOTE: this update alone DOESN'T FIX the POODLE SSL protocol vulnerability. OpenSSL only adds downgrade detection support for client applications. See https://www.suse.com/support/kb/doc.php?id=7015773 for mitigations. These security issues were fixed: - Session ticket memory leak (CVE-2014-3567). - Fixed build option no-ssl3 (CVE-2014-3568). - Added support for TLS_FALLBACK_SCSV (CVE-2014-3566). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 file file was updated to fix one security issue. This security issue was fixed: - Out-of-bounds read in elf note headers (CVE-2014-3710). This non-security issues was fixed: - Correctly identify GDBM files created by libgdbm4 (bnc#888308). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 flash-player Adobe Flash Player was updated to 11.2.202.411, fixing security issues and bugs. For more information please read: http://helpx.adobe.com/security/products/flash-player/apsb14-22.html Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 wget wget was updated to fix one security issue. This security issue was fixed: - FTP symlink arbitrary filesystem access (CVE-2014-4877). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 rsyslog This update for rsyslog provides the following fixes: - Fixed remote PRI DoS vulnerability patch (CVE-2014-3683, bnc#899756) - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package (bnc#890228) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 libreoffice libreoffice was updated to version 4.3.3.2 to fix two security issues: These security issues were fixed: - "Document as E-mail" vulnerability (bnc#900218). - Impress remote control use-after-free vulnerability (CVE-2014-3693). Various other fixes are included in the update. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 mariadb mariadb was updated to version 10.0.16 to fix 40 security issues. These security issues were fixed: - CVE-2015-0411: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption (bnc#915911). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 java-1_7_0-openjdk OpenJDK was updated to icedtea 2.5.3 (OpenJDK 7u71) fixing security issues and bugs. * Security: - S8015256: Better class accessibility - S8022783, CVE-2014-6504: Optimize C2 optimizations - S8035162: Service printing service - S8035781: Improve equality for annotations - S8036805: Correct linker method lookup. - S8036810: Correct linker field lookup - S8036936: Use local locales - S8037066, CVE-2014-6457: Secure transport layer - S8037846, CVE-2014-6558: Ensure streaming of input cipher streams - S8038364: Use certificate exceptions correctly - S8038899: Safer safepoints - S8038903: More native monitor monitoring - S8038908: Make Signature more robust - S8038913: Bolster XML support - S8039509, CVE-2014-6512: Wrap sockets more thoroughly - S8039533, CVE-2014-6517: Higher resolution resolvers - S8041540, CVE-2014-6511: Better use of pages in font processing - S8041529: Better parameterization of parameter lists - S8041545: Better validation of generated rasters - S8041564, CVE-2014-6506: Improved management of logger resources - S8041717, CVE-2014-6519: Issue with class file parser - S8042609, CVE-2014-6513: Limit splashiness of splash images - S8042797, CVE-2014-6502: Avoid strawberries in LogRecord - S8044274, CVE-2014-6531: Proper property processing Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 update-test-security This is a security update to test the software update stack. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 pidgin This pidgin security update fixes the following issues: - bnc#902408: remote information leak via crafted XMPP message. (CVE-2014-3698) - bnc#902410: denial of service parsing Groupwise server message. (CVE-2014-3696) - bnc#902409: crash in MXit protocol plug-in. (CVE-2014-3695) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 spice The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 openssl openssl was updated to fix four security issues. These security issues were fixed: - SRTP Memory Leak (CVE-2014-3513). - Session Ticket Memory Leak (CVE-2014-3567). - Fixed incomplete no-ssl3 build option (CVE-2014-3568). - Add support for TLS_FALLBACK_SCSV (CVE-2014-3566). NOTE: This update alone DOESN'T FIX the POODLE SSL protocol vulnerability. OpenSSL only adds downgrade detection support for client applications. See https://www.suse.com/support/kb/doc.php?id=7015773 for mitigations. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 openssl This update of openssl fixes the following security issues: - CVE-2015-4000 (bsc#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (bsc#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (bsc#934489) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 flash-player flash-player was updated to fix one security issue. This security issue was fixed: - Hardening against a code execution flaw (CVE-2014-8439). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 flash-player flash-player was updated to version 11.2.202.418 to fix 18 security issues. These security issues were fixed: - Memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). - Use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). - A double free vulnerability that could lead to code execution (CVE-2014-0574). - Type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). - An information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). - A heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). - A permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442). More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb14-24.html Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 MozillaFirefox mozilla-nss - update to Firefox 31.2.0 ESR (bnc#900941) * MFSA 2014-74/CVE-2014-1574/CVE-2014-1575 (bmo#1001994, bmo#1011354, bmo#1018916, bmo#1020034, bmo#1023035, bmo#1032208, bmo#1033020, bmo#1034230, bmo#1061214, bmo#1061600, bmo#1064346, bmo#1072044, bmo#1072174) Miscellaneous memory safety hazards (rv:33.0/rv:31.2) * MFSA 2014-75/CVE-2014-1576 (bmo#1041512) Buffer overflow during CSS manipulation * MFSA 2014-76/CVE-2014-1577 (bmo#1012609) Web Audio memory corruption issues with custom waveforms * MFSA 2014-77/CVE-2014-1578 (bmo#1063327) Out-of-bounds write with WebM video * MFSA 2014-79/CVE-2014-1581 (bmo#1068218) Use-after-free interacting with text directionality * MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981) Inconsistent video sharing within iframe * MFSA 2014-82/CVE-2014-1583 (bmo#1015540) Accessing cross-origin objects via the Alarms API - SSLv3 is disabled by default. See README.POODLE for more detailed information. - disable call home features - update to 3.17.2 (bnc#900941) Bugfix release * bmo#1049435 - Importing an RSA private key fails if p < q * bmo#1057161 - NSS hangs with 100% CPU on invalid EC key * bmo#1078669 - certutil crashes when using the --certVersion parameter - changes from earlier version of the 3.17 branch: update to 3.17.1 (bnc#897890) * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405) RSA Signature Forgery in NSS * Change library's signature algorithm default to SHA256 * Add support for draft-ietf-tls-downgrade-scsv * Add clang-cl support to the NSS build system * Implement TLS 1.3: * Part 1. Negotiate TLS 1.3 * Part 2. Remove deprecated cipher suites andcompression. * Add support for little-endian powerpc64 update to 3.17 * required for Firefox 33 New functionality: * When using ECDHE, the TLS server code may be configured to generate a fresh ephemeral ECDH key for each handshake, by setting the SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means the server's ephemeral ECDH key is reused for multiple handshakes. This option does not affect the TLS client code, which always generates a fresh ephemeral ECDH key for each handshake. New Macros * SSL_REUSE_SERVER_ECDHE_KEY Notable Changes: * The manual pages for the certutil and pp tools have been updated to document the new parameters that had been added in NSS 3.16.2. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 Bash was updated to fix unexpected code execution with environment variables (CVE-2014-6271). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 python ython, python-base, python-doc was updated to fix one security issue. This security issue was fixed: - Fixed potential buffer overflow in buffer() (CVE-2014-7185). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 is installed. Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Desktop 12 is installed. Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED