The OVAL Repository 5.4 2015-09-03T06:27:21.971-04:00 SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 clamav clamav was updated to version 0.98.5 to fix three security issues and several non-security issues. These security issues have been fixed: * Crash when scanning maliciously crafted yoda's crypter files (CVE-2013-6497). * Heap-based buffer overflow when scanning crypted PE files (CVE-2014-9050). * Crash when using 'clamscan -a'. These non-security issues have been fixed: * Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. * Addition of shared library support for LLVM versions 3.1 - 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. * Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs. * Resolution of many of the warning messages from ClamAV compilation. * Improved detection of malicious PE files. * ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode (bnc#904207). * Fix server socket setup code in clamd (bnc#903489). * Change updateclamconf to prefer the state of the old config file even for commented-out options (bnc#903719). * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix configuration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Security Issues: * CVE-2013-6497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6497> * CVE-2014-9050 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9050> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 wget wget was updated to fix one security issue: * FTP symbolic link arbitrary filesystem access (CVE-2014-4877). Security Issues: * CVE-2014-4877 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL This OpenSSL update fixes the following issues: * Session Ticket Memory Leak (CVE-2014-3567) * Build option no-ssl3 is incomplete ((CVE-2014-3568) * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE) Security Issues: * CVE-2014-3567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-3568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 Mozilla Firefox * CVE-2014-1588 * CVE-2014-1589 * CVE-2014-1590 * CVE-2014-1591 * CVE-2014-1592 * CVE-2014-1593 * CVE-2014-1594 * CVE-2014-1595 ]]> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 MozillaFirefox * CVE-2014-1575 * CVE-2014-1576 * CVE-2014-1577 * CVE-2014-1578 * CVE-2014-1581 * CVE-2014-1583 * CVE-2014-1585 * CVE-2014-1586 ]]> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 apache2 This update for Apache moves function ap_timeout_parameter_parse() to the public API that can be used by modules. This fixes a regression in mod_cgid introduced by the previous update. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 at This update for the at(1) job manager fixes a regression caused by the latest security updates for bash. at(1) now sanitizes the environment it passes to the shell, allowing only variables whose keys are of the form /^[A-Z_][A-Z0-9_]/i. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 glibc This glibc update fixes a critical privilege escalation problem and the following security and non security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#772242: Replace scope handing with master state * bnc#779320: Fix buffer overflow in strcoll (CVE-2012-4412) * bnc#818630: Fall back to localhost if no nameserver defined * bnc#828235: Fix missing character in IBM-943 charset * bnc#828637: Fix use of alloca in gaih_inet * bnc#834594: Fix readdir_r with long file names (CVE-2013-4237) Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 apache2 * CVE-2013-6438 * CVE-2014-0226 * CVE-2014-0231 * CVE-2013-1862 * CVE-2013-1896 ]]> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 bash ash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Additionally, the following bugs have been fixed: * Avoid possible buffer overflow when expanding the /dev/fd prefix with e.g. the test built-in. (CVE-2012-3410) * Enable workaround for changed behavior of sshd. (bnc#688469) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> * CVE-2012-3410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3410> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 glibc * CVE-2014-4043 * CVE-2013-4332 * CVE-2013-4237 * CVE-2013-0242 * CVE-2012-4412 ]]> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 bash ash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 MozillaFirefox Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 mozilla-nss Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 bash The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 timezone This update provides the latest timezone information (2014g) for your system, including the following changes: * Russia will subtract an hour from most of its time zones on 2014-10-26 at 02:00 local time. * Turks & Caicos are switching from US eastern time to UTC-4 year-round, modeled as a switch from EST/EDT to AST on 2014-11-02 at 02:00. * Many past time stamps were updated for correctness. * Many time zone abbreviations were adjusted or fixed. * Many performance enhancements and fixes in the time zone manipulation utilities. * A new file 'zone1970.tab' was added. The new file's extended format allows multiple country codes per zone. New applications should use the new file. * Some code fixes in 'localtime', 'zic', 'mktime' and 'yearistype'. For a comprehensive list of changes, refer to the release announces from ICANN: * http://mm.icann.org/pipermail/tz-announce/2014-August/000023.html <http://mm.icann.org/pipermail/tz-announce/2014-August/000023.html> * http://mm.icann.org/pipermail/tz-announce/2014-August/000024.html <http://mm.icann.org/pipermail/tz-announce/2014-August/000024.html> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 mozilla-nss Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 OpenSSL This OpenSSL update fixes the following security issues: * bnc#890764: Information leak in pretty printing functions. (CVE-2014-3508) * bnc#890767: Double Free when processing DTLS packets. (CVE-2014-3505) * bnc#890768: DTLS memory exhaustion. (CVE-2014-3506) * bnc#890769: DTLS memory leak from zero-length fragments. (CVE-2014-3507) * bnc#890770: DTLS anonymous EC(DH) denial of service. (CVE-2014-3510) Security Issues: * CVE-2014-3508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3508> * CVE-2014-3505 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3505> * CVE-2014-3506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3506> * CVE-2014-3507 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507> * CVE-2014-3510 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3510> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Mozilla Firefox Mozilla Firefox has been updated to 24.6.0 to fix the security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Java IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 apache2 This update fixes the following security issues with apache2 httpd: * Improper LD_LIBRARY_PATH handling (CVE-2012-0883 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883 > ) * Filename escaping problem (CVE-2012-2687 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2687 > ) Additionally, some non-security bugs have been fixed as enumerated in the changelog of the RPM. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 Java IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 timezone This update provides the latest timezone information for your system. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 xinetd Xinetd receives a LTSS roll-up update to fix two security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 PHP5 PHP5 has been updated to fix four security vulnerabilities. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 wireshark wireshark was updated to 1.8.5 (bnc#801131), fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mozilla Firefox MozillaFirefox has been updated to the 17.0.4ESR release. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 GnuTLS GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 squid A denial of service problem in Squid via invalid Content-Length headers and memory leaks has been fixed. (CVE-2012-5643,CVE-2013-0189, SQUID-2012:1) Also a logrotate permission issue has been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 parted This collective update for parted provides the following fixes: * Fix automatic correcting of GPT label which can cause problems on systems which use dmraid * Fix issues while resizing ReiserFS file systems with YaST2, when parted could either hang or fail to resize the file system. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 ipmitool This collective update for ipmitool provides the following fixes: * Fix reading of FRU data from servers where FRU/SDR device #0, LUN 0 is absent (bnc#789624) * Fix a string handling problem in ipmi_sel.c that could cause a segmentation fault (bnc#788393) * Fix reading of sensors from some specific servers over lanplus (bnc#794160) * Handle "BCDplus" fields in FRU descriptors correctly * Retrieve and print sensor data records (sdr) correctly (bnc#761203) * Do not crash in fru command if the lanplus password is wrong (bnc#767413) * Do not crash (assert(0)/abort) when BMC replies with the wrong session id (bnc#729514) * Fix detection if it is no longer connected to BMC (bnc#739377) * Fix ipmitool on UV10 systems (bnc#614916) * Add sanity checks for erroneous SDR data (bnc#604896). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Linux Kernel The SUSE Linux Enterprise Server 10 SP3 LTSS received a roll up update to fix several security and non-security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 MozillaFirefox Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 MozillaFirefox MozillaFirefox was updated to version 24.6.0 to fix six security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 MozillaFirefox MozillaFirefox was updated to version 24.6.0 to fix six security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Chile is changing its DST rules * Estimate Morocco 2013-2038 transitions for Ramadan * New alias Europe/Busingen for Europe/Zurich * New zones Asia/Khandyga, Asia/Ust-Nera * Libya moving to CET, but with DST. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Java IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 apparmor-profiles This update for apparmor-profiles provides fixes in ntpd's profile which is allowing the daemon to access all needed files in /proc. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 nfs-utils This update fixes a DNS spoofing problem with NFS rpc-gssd. (CVE-2013-1923)(bnc#813464) Security Issue reference: * CVE-2013-1923 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1923 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Perl This update of Perl 5 fixes the following security issues: * fix rehash DoS [bnc#804415] [CVE-2013-1667] * improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] * fix glob denial of service [bnc#796014] [CVE-2011-2728] * sanitize input in Maketext.pm [bnc#797060] [CVE-2012-6329] * make getgrent work with long group entries [bnc#788388] Security Issue reference: * CVE-2013-1667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1667 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 apache2 This Apache2 LTSS roll-up update for SUSE Linux Enterprise 10 SP3 LTSS fixes some security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 Mozilla Firefox Mozilla Firefox has been updated to the 24.7ESR security release. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 supportutils This update fixes the following issues: - supportconfig: 2.25-370 - supportconfig: 2.25-359 - supportconfig: 2.25-358 - supportconfig: 2.25-350 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 Mozilla Firefox MozillaFirefox has been updated to the 17.0.5ESR release fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 lvm2 The following issue has been fixed: * SLE-10-SP4 LVM2 pvmove event deregistration failed: No such device (bnc#748617) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Java IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 xorg-x11-server In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue. Security Issue reference: * CVE-2013-1940 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1940 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 gpg This update for gpg provides the following fixes: * Set proper file permissions when en/de-crypting files (bnc#780943) * Fix an issue that could cause corruption of the public keys database. (CVE-2012-6085, bnc#798465) Security Issue reference: * CVE-2012-6085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libtiff This update fixes two buffer overflow security issues with libtiff: * CVE-2013-1960 * CVE-2013-1961 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 nagios This update fixes a stack overflow in the nagios web interface. CVE-2012-6096 has been assigned. Security Issue reference: * CVE-2012-6096 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6096 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 autofs5 This collective update for AutoFS provides fixes for some issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 poppler This update of poppler fixes the following vulnerabilities: * CVE-2013-1788: Various invalid memory issues could be used by attackers supplying PDFs to crash the PDF viewer or potentially execute code. * CVE-2013-1789: A crash in poppler could be used by attackers providing PDFs to crash the PDF viewer. * CVE-2013-1790: An uninitialized memory read could be used by attackers providing PDFs to crash the PDF viewer. This also fixes that transparent background in images are rendered black with evince. (bnc#745620). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 ibutils Various tmp races in ibdiagnet of ibutils have been fixed that could have been used by local attackers on machines where infiband was debugged to gain privileges. Security Issue reference: * CVE-2013-1894 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1894 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Modules This update for the Modules package provides one fix for Python support. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 Java 1.4.2 IBM Java 1.4.2 has been updated to SR13-FP17 fixing bugs and security issues. http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 lzo lzo has been updated to fix a potential denial of service issue or possible remote code execution by allowing an attacker, if the LZO decompression algorithm is used in a threaded or kernel context, to corrupt memory structures that control the flow of execution in other contexts. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 compat-curl2 This update of compat-curl2 fixes a security vulnerability: * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Linux kernel The SUSE Linux Enterprise 10 SP4 kernel has been updated to fix various bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 clamav This update contains clamav 0.97.8 which fixes security issues (bnc#816865): * CVE-2013-2020: Fix heap corruption * CVE-2013-2021: Fix overflow due to PDF key length computation. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 quagga Quagga received an update fixing two security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Linux kernel This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 release-notes-sles This update provides the latest version of the release notes for SUSE Linux Enterprise Server 10 SP4 LTSS which documents the update of Mozilla Firefox to version 24 ESR. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 Java IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 glibc This collective update for the GNU C library (glibc) provides the following fixes: * Fix stack overflow in getaddrinfo with many results (bnc#813121, CVE-2013-1914) * Fix locking in _IO_cleanup (bnc#796982) * Fix buffer overflow in glob (bnc#691365) * Fix memory leak in execve (bnc#805899) Security Issue reference: * CVE-2013-1914 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libxml2 libxml2 has been updated to fix entity expansion problems: * CVE-2013-0338: Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause "out of memory" denial of service conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 CUPS This update for CUPS adjusts the translations of site templates to send the session ID on POST operations. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 xorg-x11 This update of xorg-x11 fixes several security vulnerabilities. * Bug 815451- X.Org Security Advisory: May 23, 2013 * Bug 821664 - libX11 * Bug 821671 - libXv * Bug 821670 - libXt * Bug 821669 - libXrender * Bug 821668 - libXp * Bug 821667 - libXfixes * Bug 821665 - libXext * Bug 821663 - libFS, libXcursor, libXi, libXinerama, libXRes, libXtst, libXvMC, libXxf86dga, libXxf86vm, libdmx Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Morocco's midsummer transitions this year are July 7 and August 10 * Israel now falls back from DST on the last Sunday of October * Palestine observed DST starting March 29, 2013 * From 2013 on, Gaza and Hebron both observe DST. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update of curl fixes several security issues. * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 java-1_6_0-ibm IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 OpenSSL OpenSSL has been updated to fix several security issues: * CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable "OPENSSL_NO_DEFAULT_ZLIB" to "no" enables compression again. Please note that openssl on SUSE Linux Enterprise 10 is not built with compression support. * CVE-2013-0169: Timing attacks against TLS could be used by physically local attackers to gain access to transmitted plain text or private keymaterial. This issue is also known as the "Lucky-13" issue. * CVE-2013-0166: A OCSP invalid key denial of service issue was fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 ksh This update to Korn Shell 93u+ provides fixes for many issues, including: * Fix segmentation fault on typeset on ENV variable. (bnc#803613) * Do not free data which is used later on in the hash tree of reloaded shell functions. (bnc#795324) * Make sure that tty is closed even if an interrupt arrived during close. (bnc#790315) * Fix truncation of variables when TMOUT is used. (bnc#808956) * Fix syntax error on command substitution in here-document. (bnc#804998) * Make Shift_JIS patch more reliable as requested by upstream. For a comprehensive list of fixes please refer to the package's change log. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 ClamAV ClamAV has been updated to the 0.97.7 release that contains various security related hardening fixes. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 GnuTLS This GnuTLS update fixes incorrect padding which weakens the encryption. CVE-2013-1619 has been assigned to this issue. Security Issue reference: * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Samba The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed. Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure (CVE-2012-1586). Also a uninitialized memory read bug in talloc_free() has been fixed. (bnc#764577). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 IBM Java IBM Java 1.4.2 has been updated to SR13 FP16 which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OFED ds-ping in the OFED stack could have triggered a kernel BUG, which could have caused a local denial of service attack. (CVE-2012-2372) Security Issue reference: * CVE-2012-2372 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2372 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 sudo This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775, CVE-2013-1776, CVE-2013-2776 and CVE-2013-2777. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL OpenSSL has been updated to fix several security issues: * CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable "OPENSSL_NO_DEFAULT_ZLIB" to "no" enables compression again. * CVE-2013-0169: Timing attacks against TLS could be used by physically local attackers to gain access to transmitted plain text or private keymaterial. This issue is also known as the "Lucky-13" issue. * CVE-2013-0166: A OCSP invalid key denial of service issue was fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 java-1_4_2-ibm IBM Java 1.4.2 has been updated to SR13-FP18 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bug has been fixed: * mark files in jre/bin and bin/ as executable (bnc#823034) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libxslt libxslt has been updated to fix two denial of service issues via crashes by NULL pointer dereference on attacker supplied XSLT scripts (CVE-2012-6139). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 krb5 This krb5 update fixes a security issue. * kpasswd UDP ping-pong (bug#825985 / CVE-2002-2443) Security Issue reference: * CVE-2002-2443 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2443 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 Apache Apache2 has been updated to fix multiple XSS flaws. * CVE-2012-4558: Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server potentially allowed remote attackers to inject arbitrary web script or HTML via a crafted string. * CVE-2012-3499: Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server allowed remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Samba This collective update for Samba provides the following fixes: * Fix 'map untrusted to domain' with NTLMv2. (bnc#817919) * Fix logon of AD users with many group memberships. (bnc#657026) * CIFS: do not restart during dhcp lease renewal when IP address remains the same. (bnc#573246) * Relicense source/client/{mount.cifs,mount.h,mtab.c}.c under GPLv2+ Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Mozilla Firefox Mozilla Firefox is updated to the 10.0.12ESR version. This is a roll-up update for LTSS. It fixes a lot of security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 compat-curl2 This update of compat-curl2 fixes several security issues. * fixes for the cookie domain tailmatch vulnerability (bnc#814655) * updated curl CA-Cert Bundle (bnc#810010) * fixes for a potential BEAST attack (bnc#742306) Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 release-notes-sles This announcement marks the end of the security and maintenance patch period for SUSE Linux Enterprise Server 10 Service Pack 4 and the end of General Support for SUSE Linux Enterprise 10. In order to keep your systems up to date and secure, please migrate your systems to SUSE Linux Enterprise Server 11 Service Pack 3. All customers with active SUSE Linux Enterprise Server subscriptions can migrate to SUSE Linux Enterprise Server 11 Service Pack 3 at no additional cost. For more information on how to upgrade to SUSE Linux Enterprise Server 11 Service Pack 3, please read: https://www.suse.com/support/kb/doc.php?id=7012368 <https://www.suse.com/support/kb/doc.php?id=7012368> Please make sure that you applied all maintenance updates provided for SUSE Linux Enterprise Server 10 Service Pack 4 before starting the migration. If you want to receive continued support for SUSE Linux Enterprise Server 10 Service Pack 4, SUSE offers an optional Long Term Service Pack Support program. For more information about this, please see: https://www.suse.com/support/programs/long-term-service-pack -support.html <https://www.suse.com/support/programs/long-term-service-pac k-support.html> Contact your SUSE sales representative if you would like to purchase Long Term Service Pack Support. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 IBM Java 1.4.2 IBM Java 1.4.2 has been updated to SR13-FP18 to fix bugs and security issues: CVE-2013-3009, CVE-2013-3011, CVE-2013-3012, CVE-2013-2469, CVE-2013-2465, CVE-2013-2464, CVE-2013-2463, CVE-2013-2473, CVE-2013-2472, CVE-2013-2471, CVE-2013-2470, CVE-2013-2459, CVE-2013-2456, CVE-2013-2447, CVE-2013-2452, CVE-2013-2446, CVE-2013-2450, CVE-2013-1500 Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also following bug has been fixed: * mark files in jre/bin and bin/ as executable (bnc#823034) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Haiti uses US daylight-saving rules this year * Paraguay will end DST on March 24 this year * Morocco does not observe DST during Ramadan. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 java-1_5_0-ibm IBM Java 1.5.0 was updated to SR16-FP3 to fix bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 util-linux This collective update for util-linux provides the following fixes and enhancements: Fix creation of partitions spanning across the entire disk (", , ") in sfdisk(8). (bnc#808155) Fix typos in taskset(1) man page. (bnc#771925) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 gpg This GnuPG LTSS roll-up update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed. * CVE-2013-4242: GnuPG allowed local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. * CVE-2012-6085: The read_block function in g10/import.c in GnuPG 1.4.x, when importing a key, allowed remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 wireshark wireshark has been updated to 1.8.6 which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Update to version 2013h (bnc#850462): o Lybia has switched back to UTC+2 o Western Sahara uses Morocco's DST rules o Acre switches from UTC-4 to UTC-5 on Nov. 10th * Define TM_GMTOFF and TM_ZONE like glibc did (bnc#807624) * Correct path expansion for local time link (bnc#845530). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Linux kernel The SUSE Linux Enterprise Server 10 SP3 LTSS kernel received a roll up update to fix lots of moderate security issues and several bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 libtiff This tiff LTSS roll up update fixes several security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 libxml2 This is a LTSS rollup update for the libxml2 library that fixes various security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 nfs-utils nfs-utils receives hereby a LTSS roll-up security and bugfix update. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 curl This update for curl adds Digicert and TC TrustCenter Class 2 CA II certificates to the CA bundle. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Apache Apache2 has been updated to fix multiple security issues: This update fixes the following issues: * CVE-2012-4558: Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server potentially allowed remote attackers to inject arbitrary web script or HTML via a crafted string. * CVE-2012-3499: Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server allowed remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Jordan switches back to standard time at 00:00 on December 20 2013 * The compile-time flag NOSOLAR has been removed * The files solar87, solar88, solar89 are no longer distributed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 IBM Java 1.6.0 IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bugs have been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) * check if installed qa_filelist is not empty (bnc#831936) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 GnuTLS This update of GnuTLS fixes a regression introduced by the previous update that could have resulted in a Denial of Service (application crash). Security Issue reference: * CVE-2013-2116 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 mozilla-nspr mozilla-nss Mozilla NSPR and NSS were updated to fix various security bugs that could be used to crash the browser or potentially execute code. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Java IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 nfs-utils This update for the NFS support utilities (nfs-utils) provides the following fixes: * Allow gssd to work with more than 1024 connections, depending on the 'nofile' resource limit. Increase this limit to 4096 before starting rpc.gssd * Fix a signal handling issue that could cause silent termination of the rpc.idmapd daemon Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mesa This update of Mesa fixes multiple integer overflows. Security Issue reference: * CVE-2013-1993 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1993 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mozilla Firefox Mozilla Firefox has been updated to the 17.0.6ESR security release. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 Mozilla Firefox This update to Firefox 17.0.8esr (bnc#833389) addresses the following issues: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8) * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 IBM Java 6 IBM Java 6 was updated to version SR15-FP1 which received security and bugfixes. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Java 1.5.0 IBM Java 1.5.0 has been updated to SR13-FP2 which fixes several bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 strongswan This strongswan update fixes security issues and bugs: * CVE-2013-5018: Specially crafted XAuth usernames and EAP identities can cause a crash in strongswan. * CVE-2013-6075: A crafted ID packet can be used by remote attackers to crash the server or potentially gain authentication privileges under certain circumstances. Also a bug with route recursion limits was fixed: * Charon SEGFAULT when left=%any / recursion limit (bnc#840826). Security Issues: * CVE-2013-5018 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5018 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Morocco now observes DST from the last Sunday in March to the last Sunday in October, not April to September respectively. * Tocantins will very likely not observe DST starting this spring * Jordan will likely stay at UTC+3 indefinitely * Palestine will fall back at 00:00, not 01:00 * This year Fiji will start DST on October 27, not October 20 * Use WIB/WITA/WIT rather than WIT/CIT/EIT for alphabetic Indonesian time zone abbreviations since 1932 * Use ART (UTC-3, standard time), rather than WARST (also UTC-3, but daylight saving time) for San Luis, Argentina since 2009. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 ksh This update for Korn Shell provides fixes for the following issues: * #808449: set -k does not work properly with ksh-93t-13.17 and higher * #814135: crash in bestreclaim() after traversing a memory block with a very large size * #824187: set -k breaks aliases with ksh-93u. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 timezone This update provides the latest timezone information for your system. The changes in detail are: * Turkey begins DST on 2014-03-31, not 2014-03-30 * Misc changes affecting past time stamps * An uninitialized-storage bug in 'localtime' has been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. Also the CA-Cert Bundle has been updated to the current state. Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 sudo This LTSS rollup update fixes the following security issues which allowed to bypass the sudo authentication. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Xen The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS Xen hypervisor and toolset have been updated to fix various security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Xen The SUSE Linux Enterprise 10 Service Pack 3 LTSS Xen hypervisor and toolset have been updated. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 openssl-certs The openssl-certs package was updated to match the certificates contained in the Mozilla NSS 3.15.4 release. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 krb5 This update for Kerberos 5 provides the following fixes and enhancements: * Improved compatibility with processes that handle large numbers of open files (bnc#787272) * Fixed memory leak in gss_accept_sec_context() and other functions (bnc#808191) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 openswan This openswan update fixes a remote buffer overflow issue (bnc#824316 / CVE-2013-2053). Security Issue reference: * CVE-2013-2053 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2053 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 libxml2 libxml2 has been updated to fix the following security issue: * CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL OpenSSL has been updated to fix an attack on ECDSA Nonces. Using the FLUSH+RELOAD Cache Side-channel Attack the Nonces could be recovered. (CVE-2014-0076) The update also enables use of SHA-2 family certificate verification of X.509 certificates used in todays SSL certificate infrastructure. Security Issue reference: * CVE-2014-0076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Linux Kernel The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Linux Kernel The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 IBM Java 5 IBM Java 5 was updated to SR 16 FP 6 to fix several bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 gnutls The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 timezone This update provides the latest timezone information for your system. The changes in detail are: * Egypt observes DST starting 2014-05-15 at 24:00 * Crimea switched to Moscow time on 2014-03-30 at 02:00 local time * New entry for Troll Station, Antarctica. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 IBM Java 6 IBM Java 6 was updated to version 6 SR16 to fix several security issues and various other bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update for curl adds Digicert certificates to the CA bundle. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 ZMD ZMD was updated to roll in fixes already done in SUSE Linux Enterprise 10 SP4 branch, and to enable the usage of the current nu.novell.com certificates. ZMD was switched to use /etc/ssl/certs as trust storage. (bnc#723034) Various SSL certificate handling issues were fixed as follows: * Skip password protected or invalid PKCS12 certificates. (bnc#751782) * Skip invalid SPC certificates. (bnc#754502) * Skip broken certificates. (bnc#751782) Bugs in the logrotate scripts were fixed. (bnc#719869) ZMD now also retrieves and handles susedata.xml.gz. (bnc#722339) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 timezone The latest update to timezone 2014c introduced changes in the binary format of timezone files generated by zic(1) to improve handling of low-valued timestamps. This change caused problems for some applications that rely on the stability of the binary format, so this update reverts it. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 libxslt libxslt received a security update to fix a security issue: * CVE-2013-4520: The XSL implementation in libxslt allowed remote attackers to cause a denial of service (crash) via an invalid DTD. (addendum due to incomplete fix for CVE-2012-2825) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Mozilla Firefox This Mozilla Firefox update provides several security and non-security fixes. MozillaFirefox has been updated to 24.5.0esr, which fixes the following issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to 3.16 * required for Firefox 29 * CVE-2014-1492_ In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Mozilla Firefox This Mozilla Firefox update provides several security and non-security fixes. Mozilla Firefox has been updated to the 24.5.0esr version, which fixes the following issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to version 3.16 * required for Firefox 29 * CVE-2014-1492_ In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 gnutls The GnuTLS library received a critical security fix and other updates. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL OpenSSL was updated to fix the following security vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 PHP5 The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-1635 and CVE-2013-1643 (bnc#807707): o reading system files via untrusted SOAP input o soap.wsdl_cache_dir function did not honour PHP open_basedir * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 suse-build-key The SUSE GPG signing keys that are used for repository integrity checking have been extended to March 17th, 2018. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 IBM Java 5 IBM Java 5 SR16-FP4 has been released which fixes lots of bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 strongswan The following security issue is fixed by this update: * bnc#870572: strongswan has been updated to fix an authentication problem where attackers could have bypassed the IKEv2 authentication. (CVE-2014-2338) Security Issue reference: * CVE-2014-2338 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2338 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 java-1_5_0-ibm IBM Java 1.5.0 has been updated to SR16-FP3 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bug has been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 IBM Java 6 IBM Java 6 was updated to version SR15-FP1 which received security and bug fixes. More information at: http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_Ja nuary_14_2014_CPU <http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_J anuary_14_2014_CPU> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 libtiff This tiff update fixes several security issues. * bnc#834477: CVE-2013-4232 CVE-2013-4231: tiff: buffer overflows/use after free problem * bnc#834779: CVE-2013-4243: libtiff (gif2tiff): heap-based buffer overflow in readgifimage() * bnc#834788: CVE-2013-4244: libtiff (gif2tiff): OOB Write in LZW decompressor Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 java-1_6_0-ibm IBM Java 6 was updated to SR13 FP1, fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Xorg This update for xorg-x11 provides fixes for the following issues: * 743810: Xnest to remote machine displays black screen * 805590: Xvnc server crashes while launching Java Swing application. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 glibc This collective update for the GNU C library (glibc) provides the following fixes and enhancements: Security issues fixed: - Fix stack overflow in getaddrinfo with many results. (bnc#813121, CVE-2013-1914) - Fixed another stack overflow in getaddrinfo with many results (bnc#828637) - Fix buffer overflow in glob. (bnc#691365) (CVE-2010-4756) - Fix array overflow in floating point parser [bnc#775690] (CVE-2012-3480) - Fix strtod integer/buffer overflows [bnc#775690] (CVE-2012-3480) - Make addmntent return errors also for cached streams. [bnc #676178, CVE-2011-1089] - Fix overflows in vfprintf. [bnc #770891, CVE 2012-3406] - Add vfprintf-nargs.diff for possible format string overflow. [bnc #747768, CVE-2012-0864] - Check values from file header in __tzfile_read. [bnc #735850, CVE-2009-5029] Also several bugs were fixed: - Fix locking in _IO_cleanup. (bnc#796982) - Fix memory leak in execve. (bnc#805899) - Fix nscd timestamps in logging (bnc#783196) - Fix perl script error message (bnc#774467) - Fall back to localhost if no nameserver defined (bnc#818630) - Fix incomplete results from nscd. [bnc #753756] - Fix a deadlock in dlsym in case the symbol isn't found, for multithreaded programs. [bnc #760216] - Fix problem with TLS and dlopen. [#732110] - Backported regex fix for skipping of valid EUC-JP matches [bnc#743689] - Fixed false regex match on incomplete chars in EUC-JP [bnc#743689] - Add glibc-pmap-timeout.diff in order to fix useless connection attempts to NFS servers. [bnc #661460] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 wireshark This wireshark version update to 1.6.16 includes several security and general bug fixes. http://www.wireshark.org/docs/relnotes/wireshark-1.6.16.html <http://www.wireshark.org/docs/relnotes/wireshark-1.6.16.htm l> * The CAPWAP dissector could crash. Discovered by Laurent Butti. (CVE-2013-4074) * The HTTP dissector could overrun the stack. Discovered by David Keeler. (CVE-2013-4081) * The DCP ETSI dissector could crash. (CVE-2013-4083) http://www.wireshark.org/docs/relnotes/wireshark-1.6.15.html <http://www.wireshark.org/docs/relnotes/wireshark-1.6.15.htm l> * The ASN.1 BER dissector could crash. ( CVE-2013-3556 CVE-2013-3557 ) The releases also fix various non-security issues. Additionally, a crash in processing SCTP filters has been fixed. (bug#816887) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 openssl-certs The openssl-certs certificate store was updated with Mozilla certdata.txt 1.85. The following changes were done: - new "Actalis Authentication Root CA" - new "Trustis FPS Root CA" - new "StartCom Certification Authority" - new "StartCom Certification Authority G2" - new "Buypass Class 2 Root CA" - new "Buypass Class 3 Root CA" - updated: "Sonera Class2 CA": remove code-signing - updated: "thawte Primary Root CA": added code-signing - updated: "Trustis_FPS_Root_CA.pem": added code-signing - updated: VeriSign Class 3 Public Primary Certification Authority - G5": added code-signing, email-protection Mozilla tracker bug: https://bugzilla.mozilla.org/show_bug.cgi?id=757197 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL The TLS/SSL library OpenSSL was updated to provide support for SSL X.509 certificate hashes sha256, sha384 and sha512, which become more common. The Novell Update servers that host updates for SUSE Linux Enterprise will switch to these certificates in the near future. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 nfs-client This update for the NFS support utilities (nfs-client, nfs-kernel-server) enhances gssd to work with more than 1024 connections, respecting the 'nofile' resource limit. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 IBM Java IBM Java 1.6.0 has been updated to SR13-FP2 fixing bugs and security issues. [http://www.ibm.com/developerworks/java/jdk/alerts/)(http:// www.ibm.com/developerworks/java/jdk/alerts/) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 libxslt libxslt receives hereby a LTSS roll-up security update to fix several security issues: * CVE-2013-4520: The XSL implementation in libxslt allowed remote attackers to cause a denial of service (crash) via an invalid DTD. (addendum due to incomplete fix for CVE-2012-2825) * CVE-2012-6139: libxslt allowed remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c. * CVE-2012-2825: The XSL implementation in libxslt allowed remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors. * CVE-2011-3970: libxslt allowed remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 openssl-certs The openssl-certs package was updated to match the certificates contained in the Mozilla NSS 3.15.4 release. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 Mozilla Firefox Mozilla Firefox has been updated to the 17.0.7 ESR version, which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 11.x is installed. Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Desktop 10 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 strongswan This update fixes the ECDSA signature vulnerability in strongswan. CVE-2013-2944 was assigned to this issue. Security Issue reference: * CVE-2013-2944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2944 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Mozilla Firefox Update to Firefox 17.0.8esr (bnc#833389) to address: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8) * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 Linux kernel The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 ibutils This update for InfiniBand Diagnostic Tools (ibutils) fixes a syntax error that affected the ibdiagnet, ibdiagpath and ibdiagui utilities. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 11.x is installed. Maria Kedovskaya DRAFT INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 mono-core This update adds handling of SHA256 hashes to parts of the X509 Certificate classes in the C# implementation of Mono. Recently released new root certificates using SHA256 hashing triggered a uncaught exception within mono that lead to termination of the zmd.exe process, or other users of the X509Store C# class. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 gpg This GnuPG LTSS roll-up update fixes two security issues: * CVE-2013-4351: GnuPG treated no-usage-permitted keys as all-usages-permitted. * CVE-2013-4402: An infinite recursion in the compressed packet parser was fixed. * CVE-2013-4242: GnuPG allowed local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. * CVE-2012-6085: The read_block function in g10/import.c in GnuPG 1.4.x, when importing a key, allowed remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 OpenSSL OpenSSL has been updated to fix an attack on ECDSA Nonces. Using the FLUSH+RELOAD Cache Side-channel Attack the Nonces could have been recovered. (CVE-2014-0076) Security Issue reference: * CVE-2014-0076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 mono-core This update adds handling of SHA256 hashes to parts of the X509 Certificate classes in the C# implementation of Mono. Recently released new root certificates using SHA256 hashing triggered a uncaught exception within mono that lead to termination of the zmd.exe process, or other users of the X509Store C# class. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Server 10 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10:server