Marcus Updateinfo to OVAL Converter 5.5 2019-09-27T08:38:51 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the LibVNCServer Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-2450 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the Mesa-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-1993 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the MozillaFirefox Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6077 CVE-2007-0008 CVE-2007-0009 CVE-2007-0078 CVE-2007-0079 CVE-2007-0775 CVE-2007-0776 CVE-2007-0777 CVE-2007-0780 CVE-2007-0800 CVE-2007-0981 CVE-2007-0995 CVE-2007-0996 CVE-2007-3089 CVE-2007-3285 CVE-2007-3656 CVE-2007-3670 CVE-2007-3734 CVE-2007-3735 CVE-2007-3736 CVE-2007-3737 CVE-2007-3738 CVE-2008-0412 CVE-2008-0414 CVE-2008-0415 CVE-2008-0417 CVE-2008-0418 CVE-2008-0419 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 CVE-2008-0594 CVE-2008-3836 CVE-2008-4063 CVE-2008-4064 CVE-2008-4070 CVE-2008-5913 CVE-2009-0040 CVE-2009-0352 CVE-2009-0353 CVE-2009-0354 CVE-2009-0355 CVE-2009-0356 CVE-2009-0357 CVE-2009-0358 CVE-2009-0652 CVE-2009-0771 CVE-2009-0772 CVE-2009-0773 CVE-2009-0774 CVE-2009-0775 CVE-2009-0776 CVE-2009-0777 CVE-2009-1044 CVE-2009-1169 CVE-2009-1302 CVE-2009-1303 CVE-2009-1304 CVE-2009-1305 CVE-2009-1306 CVE-2009-1307 CVE-2009-1308 CVE-2009-1309 CVE-2009-1310 CVE-2009-1311 CVE-2009-1312 CVE-2009-1313 CVE-2009-1563 CVE-2009-1571 CVE-2009-2470 CVE-2009-2654 CVE-2009-3069 CVE-2009-3070 CVE-2009-3071 CVE-2009-3072 CVE-2009-3073 CVE-2009-3074 CVE-2009-3075 CVE-2009-3077 CVE-2009-3078 CVE-2009-3079 CVE-2009-3274 CVE-2009-3370 CVE-2009-3371 CVE-2009-3372 CVE-2009-3373 CVE-2009-3374 CVE-2009-3375 CVE-2009-3376 CVE-2009-3377 CVE-2009-3378 CVE-2009-3379 CVE-2009-3380 CVE-2009-3381 CVE-2009-3383 CVE-2009-3388 CVE-2009-3389 CVE-2009-3555 CVE-2009-3979 CVE-2009-3980 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3988 CVE-2010-0159 CVE-2010-0160 CVE-2010-0162 CVE-2010-0173 CVE-2010-0174 CVE-2010-0175 CVE-2010-0176 CVE-2010-0177 CVE-2010-0178 CVE-2010-0179 CVE-2010-0181 CVE-2010-0182 CVE-2010-0183 CVE-2010-0654 CVE-2010-1121 CVE-2010-1125 CVE-2010-1196 CVE-2010-1197 CVE-2010-1198 CVE-2010-1199 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-1205 CVE-2010-1206 CVE-2010-1208 CVE-2010-1209 CVE-2010-1211 CVE-2010-1212 CVE-2010-1213 CVE-2010-1214 CVE-2010-1585 CVE-2010-2751 CVE-2010-2752 CVE-2010-2753 CVE-2010-2754 CVE-2010-2755 CVE-2010-2760 CVE-2010-2762 CVE-2010-2764 CVE-2010-2765 CVE-2010-2766 CVE-2010-2767 CVE-2010-2768 CVE-2010-2769 CVE-2010-3166 CVE-2010-3167 CVE-2010-3168 CVE-2010-3169 CVE-2010-3170 CVE-2010-3173 CVE-2010-3174 CVE-2010-3175 CVE-2010-3176 CVE-2010-3177 CVE-2010-3178 CVE-2010-3179 CVE-2010-3180 CVE-2010-3182 CVE-2010-3183 CVE-2010-3765 CVE-2010-3766 CVE-2010-3767 CVE-2010-3768 CVE-2010-3769 CVE-2010-3770 CVE-2010-3771 CVE-2010-3772 CVE-2010-3773 CVE-2010-3775 CVE-2010-3776 CVE-2010-3777 CVE-2010-3778 CVE-2011-0051 CVE-2011-0053 CVE-2011-0054 CVE-2011-0055 CVE-2011-0056 CVE-2011-0057 CVE-2011-0059 CVE-2011-0061 CVE-2011-0062 CVE-2011-0065 CVE-2011-0066 CVE-2011-0067 CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0073 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 CVE-2011-0083 CVE-2011-0084 CVE-2011-0085 CVE-2011-1202 CVE-2011-2362 CVE-2011-2363 CVE-2011-2364 CVE-2011-2365 CVE-2011-2371 CVE-2011-2372 CVE-2011-2373 CVE-2011-2374 CVE-2011-2376 CVE-2011-2377 CVE-2011-2378 CVE-2011-2980 CVE-2011-2981 CVE-2011-2982 CVE-2011-2983 CVE-2011-2995 CVE-2011-2996 CVE-2011-2997 CVE-2011-3000 CVE-2011-3001 CVE-2011-3002 CVE-2011-3003 CVE-2011-3004 CVE-2011-3005 CVE-2011-3026 CVE-2011-3062 CVE-2011-3101 CVE-2011-3232 CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 CVE-2012-0441 CVE-2012-0452 CVE-2012-0467 CVE-2012-0468 CVE-2012-0469 CVE-2012-0470 CVE-2012-0471 CVE-2012-0472 CVE-2012-0473 CVE-2012-0474 CVE-2012-0477 CVE-2012-0478 CVE-2012-0479 CVE-2012-0759 CVE-2012-1937 CVE-2012-1939 CVE-2012-1940 CVE-2012-1941 CVE-2012-1944 CVE-2012-1945 CVE-2012-1946 CVE-2012-1947 CVE-2012-1948 CVE-2012-1949 CVE-2012-1950 CVE-2012-1951 CVE-2012-1952 CVE-2012-1953 CVE-2012-1954 CVE-2012-1955 CVE-2012-1956 CVE-2012-1957 CVE-2012-1958 CVE-2012-1959 CVE-2012-1960 CVE-2012-1961 CVE-2012-1962 CVE-2012-1963 CVE-2012-1964 CVE-2012-1965 CVE-2012-1966 CVE-2012-1967 CVE-2012-1970 CVE-2012-1972 CVE-2012-1973 CVE-2012-1974 CVE-2012-1975 CVE-2012-1976 CVE-2012-3956 CVE-2012-3957 CVE-2012-3958 CVE-2012-3959 CVE-2012-3960 CVE-2012-3961 CVE-2012-3962 CVE-2012-3963 CVE-2012-3964 CVE-2012-3966 CVE-2012-3967 CVE-2012-3968 CVE-2012-3969 CVE-2012-3970 CVE-2012-3972 CVE-2012-3976 CVE-2012-3978 CVE-2012-3980 CVE-2012-3982 CVE-2012-3986 CVE-2012-3988 CVE-2012-3990 CVE-2012-3991 CVE-2012-3992 CVE-2012-3993 CVE-2012-3994 CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4181 CVE-2012-4182 CVE-2012-4183 CVE-2012-4184 CVE-2012-4185 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 CVE-2012-4192 CVE-2012-4193 CVE-2012-4194 CVE-2012-4195 CVE-2012-4196 CVE-2012-4201 CVE-2012-4202 CVE-2012-4207 CVE-2012-4209 CVE-2012-4210 CVE-2012-4212 CVE-2012-4213 CVE-2012-4214 CVE-2012-4215 CVE-2012-4216 CVE-2012-4217 CVE-2012-4218 CVE-2012-5829 CVE-2012-5830 CVE-2012-5833 CVE-2012-5835 CVE-2012-5838 CVE-2012-5839 CVE-2012-5840 CVE-2012-5841 CVE-2012-5842 CVE-2012-5843 CVE-2013-0744 CVE-2013-0745 CVE-2013-0746 CVE-2013-0747 CVE-2013-0748 CVE-2013-0749 CVE-2013-0750 CVE-2013-0752 CVE-2013-0753 CVE-2013-0754 CVE-2013-0755 CVE-2013-0756 CVE-2013-0757 CVE-2013-0758 CVE-2013-0760 CVE-2013-0761 CVE-2013-0762 CVE-2013-0763 CVE-2013-0764 CVE-2013-0766 CVE-2013-0767 CVE-2013-0768 CVE-2013-0769 CVE-2013-0770 CVE-2013-0771 CVE-2013-0773 CVE-2013-0774 CVE-2013-0775 CVE-2013-0776 CVE-2013-0780 CVE-2013-0782 CVE-2013-0783 CVE-2013-0787 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the NetworkManager Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0365 CVE-2009-0578 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the NetworkManager-gnome Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0365 CVE-2009-0578 CVE-2009-4144 CVE-2009-4145 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the OpenEXR Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-1720 CVE-2009-1721 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the PackageKit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-4311 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the PolicyKit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1658 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the aaa_base Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0461 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the acpid Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0798 CVE-2011-4578 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the amavisd-new Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2005-1349 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ant Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-2098 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the apache2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-3747 CVE-2006-5752 CVE-2007-1862 CVE-2007-1863 CVE-2007-3304 CVE-2007-3847 CVE-2007-4465 CVE-2007-5000 CVE-2007-6388 CVE-2007-6420 CVE-2007-6421 CVE-2007-6422 CVE-2007-6750 CVE-2008-0005 CVE-2008-1678 CVE-2008-2364 CVE-2008-2939 CVE-2009-1191 CVE-2009-1195 CVE-2009-1890 CVE-2009-1891 CVE-2009-3094 CVE-2009-3095 CVE-2009-3555 CVE-2010-0408 CVE-2010-0434 CVE-2010-1452 CVE-2010-2068 CVE-2011-3192 CVE-2011-3348 CVE-2011-3368 CVE-2011-3607 CVE-2011-3639 CVE-2011-4317 CVE-2012-0031 CVE-2012-0053 CVE-2012-0883 CVE-2012-2687 CVE-2012-3499 CVE-2012-4557 CVE-2012-4558 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the apache2-mod_jk Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0774 CVE-2008-5519 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the apache2-mod_perl Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1349 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the apache2-mod_php53 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-7243 CVE-2007-4783 CVE-2007-4840 CVE-2007-4887 CVE-2008-0599 CVE-2010-2225 CVE-2010-2950 CVE-2010-3436 CVE-2010-3709 CVE-2010-3710 CVE-2010-4150 CVE-2010-4645 CVE-2011-0420 CVE-2011-0421 CVE-2011-0708 CVE-2011-1092 CVE-2011-1153 CVE-2011-1398 CVE-2011-1466 CVE-2011-2202 CVE-2011-3379 CVE-2011-4153 CVE-2011-4388 CVE-2011-4566 CVE-2011-4885 CVE-2012-0057 CVE-2012-0781 CVE-2012-0788 CVE-2012-0789 CVE-2012-0807 CVE-2012-0830 CVE-2012-0831 CVE-2012-1172 CVE-2012-1823 CVE-2012-2143 CVE-2012-2311 CVE-2012-2335 CVE-2012-2336 CVE-2012-2386 CVE-2012-2688 CVE-2012-3365 CVE-2013-1635 CVE-2013-1643 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the apache2-mod_security2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-5031 CVE-2012-2751 CVE-2012-4528 CVE-2013-1915 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ark Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2725 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the avahi Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5461 CVE-2006-6870 CVE-2007-3372 CVE-2008-5081 CVE-2009-0758 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the bind Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4339 CVE-2007-2925 CVE-2007-2926 CVE-2009-0696 CVE-2009-4022 CVE-2011-1910 CVE-2011-2464 CVE-2011-4313 CVE-2012-1667 CVE-2012-3817 CVE-2012-4244 CVE-2012-5166 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the boost-license Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-0171 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the bzip2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1372 CVE-2010-0405 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the cifs-utils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-3403 CVE-2007-0452 CVE-2007-2444 CVE-2007-2446 CVE-2007-2447 CVE-2007-4138 CVE-2007-4572 CVE-2007-5398 CVE-2007-6015 CVE-2008-1105 CVE-2008-3789 CVE-2008-4314 CVE-2009-0022 CVE-2009-1886 CVE-2009-1888 CVE-2009-2813 CVE-2009-2906 CVE-2009-2948 CVE-2010-0547 CVE-2010-0728 CVE-2010-0787 CVE-2011-1678 CVE-2012-1586 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the clamav Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4182 CVE-2006-5295 CVE-2006-5874 CVE-2007-0897 CVE-2007-0898 CVE-2007-1745 CVE-2007-1997 CVE-2007-6335 CVE-2007-6336 CVE-2007-6337 CVE-2007-6595 CVE-2007-6596 CVE-2008-0318 CVE-2008-0728 CVE-2008-1100 CVE-2008-2713 CVE-2010-0405 CVE-2011-2721 CVE-2011-3627 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the compat-libldap-2_3-0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-1164 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the coolkey Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4129 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the cron Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-2607 CVE-2010-0424 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the cups Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0104 CVE-2007-3387 CVE-2007-4351 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 CVE-2008-0047 CVE-2008-1373 CVE-2008-1693 CVE-2008-1722 CVE-2008-3641 CVE-2009-0163 CVE-2009-0949 CVE-2009-2820 CVE-2009-3553 CVE-2010-0302 CVE-2010-0393 CVE-2010-0540 CVE-2010-0542 CVE-2010-1748 CVE-2010-2431 CVE-2010-2432 CVE-2010-2941 CVE-2011-2896 CVE-2011-3170 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the curl Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0037 CVE-2009-2417 CVE-2010-4180 CVE-2011-2192 CVE-2011-3389 CVE-2013-1944 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the cvs Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-0804 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the cyrus-imapd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3235 CVE-2011-3372 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the dbus-1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6107 CVE-2008-0595 CVE-2008-3834 CVE-2008-4311 CVE-2009-1189 CVE-2010-4352 CVE-2012-3524 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the dbus-1-glib Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-1172 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the dhcp Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0692 CVE-2009-1892 CVE-2011-0997 CVE-2011-2748 CVE-2011-2749 CVE-2011-4539 CVE-2011-4868 CVE-2012-3570 CVE-2012-3571 CVE-2012-3954 CVE-2012-3955 CVE-2013-2266 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the dhcpcd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0997 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the e2fsprogs Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-5497 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ecryptfs-utils-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1831 CVE-2011-1832 CVE-2011-1833 CVE-2011-1834 CVE-2011-3145 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ed Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-3916 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the emacs Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-5795 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the enscript Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-3863 CVE-2008-4306 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the evince Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5864 CVE-2010-2640 CVE-2010-2641 CVE-2010-2642 CVE-2010-2643 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the evolution-data-server Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3257 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the expat Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2625 CVE-2009-3560 CVE-2012-0876 CVE-2012-1147 CVE-2012-1148 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the fetchmail Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5867 CVE-2006-5974 CVE-2007-1558 CVE-2007-4565 CVE-2009-2666 CVE-2011-1947 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the file-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1536 CVE-2007-2799 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the findutils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-2452 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the foomatic-filters Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2697 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the freeradius-server Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-4474 CVE-2011-4966 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the freetype2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1351 CVE-2009-0946 CVE-2010-2497 CVE-2010-2805 CVE-2010-3053 CVE-2010-3054 CVE-2010-3311 CVE-2010-3814 CVE-2010-3855 CVE-2011-0226 CVE-2011-2895 CVE-2011-3256 CVE-2011-3439 CVE-2012-1126 CVE-2012-1127 CVE-2012-1128 CVE-2012-1129 CVE-2012-1130 CVE-2012-1131 CVE-2012-1132 CVE-2012-1133 CVE-2012-1134 CVE-2012-1135 CVE-2012-1136 CVE-2012-1137 CVE-2012-1138 CVE-2012-1139 CVE-2012-1140 CVE-2012-1141 CVE-2012-1142 CVE-2012-1143 CVE-2012-1144 CVE-2012-5668 CVE-2012-5669 CVE-2012-5670 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the fuse Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3297 CVE-2011-0541 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the fvwm2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5969 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the g3utils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-4936 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-2756 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ghostscript-fonts-other Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0196 CVE-2009-0583 CVE-2009-0584 CVE-2009-0792 CVE-2009-3743 CVE-2010-1869 CVE-2010-4054 CVE-2012-4405 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the glib2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-2371 CVE-2008-4316 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the glibc Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-5029 CVE-2011-2483 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gmime Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-0409 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gnome-screensaver Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-0887 CVE-2010-0414 CVE-2010-0422 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gnutls Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4790 CVE-2008-1948 CVE-2008-1949 CVE-2008-1950 CVE-2008-4989 CVE-2009-2730 CVE-2009-3555 CVE-2011-4128 CVE-2012-0390 CVE-2012-1569 CVE-2012-1573 CVE-2013-1619 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gpg2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-3746 CVE-2006-6169 CVE-2008-1530 CVE-2010-2547 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gstreamer-0_10-plugins-base Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0586 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gstreamer-0_10-plugins-good Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1686 CVE-2009-0386 CVE-2009-0387 CVE-2009-0397 CVE-2009-1932 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gtk2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0010 CVE-2011-2485 CVE-2012-2370 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the guestfs-data Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-2124 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gvim Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-2438 CVE-2007-2953 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the gzip Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2624 CVE-2010-0001 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the hplip Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2004-0801 CVE-2007-5208 CVE-2010-4267 CVE-2011-2697 CVE-2011-2722 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the hyper-v Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-2669 CVE-2012-5532 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ibutils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-3277 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ipsec-tools Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1841 CVE-2008-3652 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the jakarta-commons-httpclient3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-5783 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the java-1_6_0-ibm Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1187 CVE-2008-1188 CVE-2008-1189 CVE-2008-1190 CVE-2008-1191 CVE-2008-1192 CVE-2008-1193 CVE-2008-1194 CVE-2008-1195 CVE-2008-1196 CVE-2008-5351 CVE-2009-3555 CVE-2010-0771 CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549 CVE-2010-3550 CVE-2010-3551 CVE-2010-3553 CVE-2010-3555 CVE-2010-3556 CVE-2010-3557 CVE-2010-3558 CVE-2010-3559 CVE-2010-3560 CVE-2010-3562 CVE-2010-3563 CVE-2010-3565 CVE-2010-3566 CVE-2010-3567 CVE-2010-3568 CVE-2010-3569 CVE-2010-3571 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574 CVE-2010-4476 CVE-2012-0551 CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-1541 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1721 CVE-2012-1722 CVE-2012-1725 CVE-2012-3143 CVE-2012-3159 CVE-2012-3213 CVE-2012-3216 CVE-2012-3342 CVE-2012-5068 CVE-2012-5069 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5075 CVE-2012-5079 CVE-2012-5081 CVE-2012-5083 CVE-2012-5084 CVE-2012-5089 CVE-2013-0169 CVE-2013-0351 CVE-2013-0409 CVE-2013-0419 CVE-2013-0423 CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0438 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0445 CVE-2013-0446 CVE-2013-0450 CVE-2013-0485 CVE-2013-0809 CVE-2013-1473 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 CVE-2013-1481 CVE-2013-1486 CVE-2013-1487 CVE-2013-1493 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the java-1_7_0-ibm Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-0547 CVE-2012-0551 CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-1541 CVE-2012-1682 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717 CVE-2012-1718 CVE-2012-1719 CVE-2012-1721 CVE-2012-1722 CVE-2012-1725 CVE-2012-1726 CVE-2012-3136 CVE-2012-3143 CVE-2012-3159 CVE-2012-3174 CVE-2012-3213 CVE-2012-3216 CVE-2012-3342 CVE-2012-4681 CVE-2012-5067 CVE-2012-5069 CVE-2012-5070 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5074 CVE-2012-5075 CVE-2012-5076 CVE-2012-5077 CVE-2012-5079 CVE-2012-5081 CVE-2012-5083 CVE-2012-5084 CVE-2012-5086 CVE-2012-5087 CVE-2012-5088 CVE-2012-5089 CVE-2013-0169 CVE-2013-0351 CVE-2013-0409 CVE-2013-0419 CVE-2013-0422 CVE-2013-0423 CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0431 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0437 CVE-2013-0438 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0444 CVE-2013-0445 CVE-2013-0446 CVE-2013-0449 CVE-2013-0450 CVE-2013-0485 CVE-2013-0809 CVE-2013-1473 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 CVE-2013-1484 CVE-2013-1485 CVE-2013-1486 CVE-2013-1487 CVE-2013-1493 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the jpeg Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-2806 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kbd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0460 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kde4-kgreeter-plugins Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-0436 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kdebase3-runtime Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4569 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kdelibs3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3820 CVE-2007-4224 CVE-2007-4225 CVE-2008-1671 CVE-2009-0689 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kdelibs4 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0689 CVE-2011-1168 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kdenetwork4-filesharing Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-1000 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kernel-default Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-0007 CVE-2008-0009 CVE-2008-0010 CVE-2008-1375 CVE-2008-1669 CVE-2008-1673 CVE-2008-1675 CVE-2008-3528 CVE-2008-3831 CVE-2008-5079 CVE-2008-5182 CVE-2008-5300 CVE-2009-0029 CVE-2009-3939 CVE-2009-4026 CVE-2009-4027 CVE-2009-4131 CVE-2009-4138 CVE-2009-4536 CVE-2009-4537 CVE-2009-4538 CVE-2010-0415 CVE-2010-0622 CVE-2010-0623 CVE-2010-1146 CVE-2010-1173 CVE-2010-1437 CVE-2010-1641 CVE-2010-2066 CVE-2010-2798 CVE-2010-2803 CVE-2010-2942 CVE-2010-2943 CVE-2010-2946 CVE-2010-2954 CVE-2010-2955 CVE-2010-2959 CVE-2010-2960 CVE-2010-2962 CVE-2010-2963 CVE-2010-3015 CVE-2010-3078 CVE-2010-3079 CVE-2010-3080 CVE-2010-3081 CVE-2010-3084 CVE-2010-3296 CVE-2010-3297 CVE-2010-3298 CVE-2010-3301 CVE-2010-3310 CVE-2010-3437 CVE-2010-3699 CVE-2010-3705 CVE-2010-3861 CVE-2010-3873 CVE-2010-3874 CVE-2010-3875 CVE-2010-3876 CVE-2010-3877 CVE-2010-3880 CVE-2010-3881 CVE-2010-4072 CVE-2010-4073 CVE-2010-4075 CVE-2010-4076 CVE-2010-4077 CVE-2010-4082 CVE-2010-4083 CVE-2010-4157 CVE-2010-4158 CVE-2010-4160 CVE-2010-4162 CVE-2010-4163 CVE-2010-4164 CVE-2010-4165 CVE-2010-4169 CVE-2010-4175 CVE-2010-4243 CVE-2010-4251 CVE-2010-4258 CVE-2010-4342 CVE-2010-4529 CVE-2010-4656 CVE-2010-4668 CVE-2011-0521 CVE-2011-0710 CVE-2011-0711 CVE-2011-0712 CVE-2011-1016 CVE-2011-1017 CVE-2011-1020 CVE-2011-1083 CVE-2011-1160 CVE-2011-1180 CVE-2011-1182 CVE-2011-1478 CVE-2011-1573 CVE-2011-1577 CVE-2011-1593 CVE-2011-2182 CVE-2011-2183 CVE-2011-2203 CVE-2011-2479 CVE-2011-2491 CVE-2011-2494 CVE-2011-2495 CVE-2011-2496 CVE-2011-3191 CVE-2011-4086 CVE-2011-4097 CVE-2011-4127 CVE-2011-4131 CVE-2011-4604 CVE-2011-4622 CVE-2012-0038 CVE-2012-0045 CVE-2012-0056 CVE-2012-0207 CVE-2012-1090 CVE-2012-1097 CVE-2012-1146 CVE-2012-1179 CVE-2012-1601 CVE-2012-2119 CVE-2012-2133 CVE-2012-2136 CVE-2012-2137 CVE-2012-2372 CVE-2012-2373 CVE-2012-2390 CVE-2012-2663 CVE-2012-2745 CVE-2012-3412 CVE-2012-3430 CVE-2012-4461 CVE-2012-5517 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-0871 CVE-2013-0913 CVE-2013-1767 CVE-2013-1774 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-1848 CVE-2013-2094 CVE-2013-2850 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the krb5 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6143 CVE-2006-6144 CVE-2007-0956 CVE-2007-0957 CVE-2007-1216 CVE-2007-2442 CVE-2007-2443 CVE-2007-2798 CVE-2007-3999 CVE-2007-4000 CVE-2007-4743 CVE-2007-5894 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972 CVE-2008-0062 CVE-2008-0063 CVE-2008-0947 CVE-2008-0948 CVE-2009-0844 CVE-2009-0845 CVE-2009-0846 CVE-2009-0847 CVE-2009-4212 CVE-2010-0629 CVE-2010-1321 CVE-2010-1323 CVE-2011-0281 CVE-2011-0282 CVE-2011-1526 CVE-2011-4862 CVE-2013-1415 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the krb5-doc Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3999 CVE-2007-4000 CVE-2007-4743 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the krb5-plugin-kdb-ldap Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0956 CVE-2007-0957 CVE-2007-1216 CVE-2007-2442 CVE-2007-2443 CVE-2007-2798 CVE-2007-3999 CVE-2007-4000 CVE-2007-4743 CVE-2010-0629 CVE-2010-1321 CVE-2010-1323 CVE-2011-0281 CVE-2011-0282 CVE-2011-1526 CVE-2011-4862 CVE-2013-1415 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the kvm Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-2382 CVE-2008-5714 CVE-2012-2652 CVE-2012-3515 CVE-2013-2007 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the lcms Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0581 CVE-2009-0723 CVE-2009-0733 CVE-2009-0793 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ldapsmb Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-3403 CVE-2007-0452 CVE-2007-2444 CVE-2007-2446 CVE-2007-2447 CVE-2007-4138 CVE-2007-4572 CVE-2007-5398 CVE-2007-6015 CVE-2008-1105 CVE-2008-3789 CVE-2008-4314 CVE-2009-0022 CVE-2009-1886 CVE-2009-1888 CVE-2009-2813 CVE-2009-2906 CVE-2009-2948 CVE-2010-0547 CVE-2010-0728 CVE-2010-0787 CVE-2010-0926 CVE-2010-1635 CVE-2010-1642 CVE-2010-2063 CVE-2010-3069 CVE-2011-0719 CVE-2011-2522 CVE-2011-2694 CVE-2012-0817 CVE-2012-0870 CVE-2012-1182 CVE-2012-2111 CVE-2013-0213 CVE-2013-0214 CVE-2013-0454 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libMagickCore1-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5456 CVE-2007-1667 CVE-2007-1797 CVE-2007-4985 CVE-2007-4986 CVE-2007-4987 CVE-2007-4988 CVE-2012-0247 CVE-2012-0248 CVE-2012-0259 CVE-2012-0260 CVE-2012-1185 CVE-2012-1186 CVE-2012-1610 CVE-2012-1798 CVE-2012-3437 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libQtWebKit4-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4811 CVE-2009-0945 CVE-2011-3193 CVE-2011-3922 CVE-2012-4929 CVE-2012-6093 CVE-2013-0254 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libadns1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1447 CVE-2008-4100 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libapr-util1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2412 CVE-2010-1623 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libapr1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2412 CVE-2011-0419 CVE-2011-1928 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libarchive2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5680 CVE-2007-3641 CVE-2007-3644 CVE-2007-3645 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libcap-progs Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-4099 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libcgroup1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1006 CVE-2011-1022 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libdrm Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-3831 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libecpg6 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4769 CVE-2007-4772 CVE-2007-6067 CVE-2007-6600 CVE-2007-6601 CVE-2009-4034 CVE-2009-4136 CVE-2010-1169 CVE-2010-1170 CVE-2010-3433 CVE-2012-3488 CVE-2012-3489 CVE-2013-0255 CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libexif Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-6351 CVE-2007-6352 CVE-2012-2812 CVE-2012-2813 CVE-2012-2814 CVE-2012-2836 CVE-2012-2837 CVE-2012-2840 CVE-2012-2841 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libexiv2-4 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-6353 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libfreebl3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-3170 CVE-2011-3389 CVE-2013-0743 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libgdiplus0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-1526 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libgnomesu Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1946 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libgtop Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0235 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libicu-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4770 CVE-2007-4771 CVE-2008-1036 CVE-2009-0153 CVE-2010-4409 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libltdl7 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3736 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libmusicbrainz4 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4197 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libmysqlclient15-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-0903 CVE-2006-4226 CVE-2006-4227 CVE-2007-5969 CVE-2007-6303 CVE-2007-6304 CVE-2008-2079 CVE-2008-4456 CVE-2008-7247 CVE-2009-2446 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 CVE-2009-4484 CVE-2009-5026 CVE-2010-1626 CVE-2010-1848 CVE-2010-1849 CVE-2010-1850 CVE-2010-3833 CVE-2010-3834 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 CVE-2012-2122 CVE-2012-5611 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libneon27 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0157 CVE-2008-3746 CVE-2009-2473 CVE-2009-2474 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libnetpbm10 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-4274 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libnewt0_52 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2905 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libopensc2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-2235 CVE-2009-0368 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libopenssl0_9_8 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2006-7250 CVE-2007-3108 CVE-2007-4995 CVE-2007-5135 CVE-2008-0891 CVE-2008-1672 CVE-2008-5077 CVE-2009-0590 CVE-2009-0591 CVE-2009-0789 CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1386 CVE-2009-1387 CVE-2009-3245 CVE-2009-3555 CVE-2009-4355 CVE-2010-0740 CVE-2010-2939 CVE-2010-3864 CVE-2010-4180 CVE-2010-4252 CVE-2011-0014 CVE-2011-3210 CVE-2011-4108 CVE-2011-4109 CVE-2011-4354 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2011-5095 CVE-2012-0050 CVE-2012-0884 CVE-2012-1165 CVE-2012-2110 CVE-2012-2131 CVE-2012-2333 CVE-2012-4929 CVE-2013-0166 CVE-2013-0169 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libotr2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-3461 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libpng12-0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5793 CVE-2008-3964 CVE-2008-5907 CVE-2008-6218 CVE-2009-0040 CVE-2009-2042 CVE-2009-5063 CVE-2010-0205 CVE-2010-1205 CVE-2010-2249 CVE-2011-2501 CVE-2011-2690 CVE-2011-2691 CVE-2011-2692 CVE-2011-3026 CVE-2011-3048 CVE-2012-3425 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libpoppler-glib4 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0104 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 CVE-2008-2950 CVE-2009-0755 CVE-2009-0756 CVE-2009-0791 CVE-2009-0799 CVE-2009-0800 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181 CVE-2009-1182 CVE-2009-1183 CVE-2009-1187 CVE-2009-1188 CVE-2009-3607 CVE-2009-3608 CVE-2010-3702 CVE-2010-3703 CVE-2010-3704 CVE-2013-1790 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libproxy0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-4505 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libpulse-browse0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-0008 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libpython2_6-1_0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3560 CVE-2009-3720 CVE-2010-3493 CVE-2011-1015 CVE-2011-1521 CVE-2011-4944 CVE-2012-0845 CVE-2012-1150 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the librpcsecgss Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3999 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the librsvg Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-3146 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libsamplerate Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-5008 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libsndfile Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4974 CVE-2009-0186 CVE-2009-1788 CVE-2009-1791 CVE-2009-4835 CVE-2011-2696 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libsnmp15-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-4309 CVE-2008-6123 CVE-2012-2141 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libsoup-2_4-1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5876 CVE-2011-2524 CVE-2012-2132 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libsss_idmap0 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-4341 CVE-2011-1758 CVE-2013-0219 CVE-2013-0220 CVE-2013-0287 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libtiff3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1586 CVE-2008-2327 CVE-2009-2285 CVE-2009-2347 CVE-2010-1411 CVE-2010-4665 CVE-2011-0191 CVE-2011-0192 CVE-2011-1167 CVE-2012-1173 CVE-2012-2088 CVE-2012-2113 CVE-2012-3401 CVE-2012-4447 CVE-2012-4564 CVE-2012-5581 CVE-2013-1960 CVE-2013-1961 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libtspi1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-0698 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libupsclient1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-2944 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libvirt Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-5086 CVE-2010-2242 CVE-2011-1146 CVE-2011-1486 CVE-2011-2511 CVE-2011-4600 CVE-2012-3445 CVE-2012-4423 CVE-2013-1962 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libvorbis Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3106 CVE-2008-1419 CVE-2008-1420 CVE-2008-1423 CVE-2009-2663 CVE-2009-3379 CVE-2012-0444 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libxcrypt Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2483 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libxml2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-6284 CVE-2008-4225 CVE-2008-4226 CVE-2008-4409 CVE-2009-2414 CVE-2009-2416 CVE-2010-4494 CVE-2011-1944 CVE-2011-2821 CVE-2011-3102 CVE-2011-3919 CVE-2012-0841 CVE-2012-2807 CVE-2012-5134 CVE-2013-0338 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libxslt Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1767 CVE-2011-3970 CVE-2012-2825 CVE-2012-6139 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the libzip1 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0421 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the log4net Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-0743 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the logrotate Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1098 CVE-2011-1154 CVE-2011-1155 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the logwatch Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1018 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the lvm2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2526 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the mailman Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-2191 CVE-2006-2941 CVE-2006-3636 CVE-2010-3089 CVE-2010-3090 CVE-2011-0707 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the man Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4250 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the mipv6d Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2522 CVE-2010-2523 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the mono-core Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0217 CVE-2010-1459 CVE-2010-3332 CVE-2010-4159 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the mozilla-xulrunner192 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-5913 CVE-2009-3555 CVE-2010-0164 CVE-2010-0165 CVE-2010-0166 CVE-2010-0167 CVE-2010-0168 CVE-2010-0169 CVE-2010-0170 CVE-2010-0171 CVE-2010-0172 CVE-2010-0173 CVE-2010-0174 CVE-2010-0176 CVE-2010-0177 CVE-2010-0178 CVE-2010-0179 CVE-2010-0181 CVE-2010-0182 CVE-2010-0654 CVE-2010-1028 CVE-2010-1121 CVE-2010-1125 CVE-2010-1196 CVE-2010-1197 CVE-2010-1198 CVE-2010-1199 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 CVE-2010-1205 CVE-2010-1206 CVE-2010-1207 CVE-2010-1208 CVE-2010-1209 CVE-2010-1210 CVE-2010-1211 CVE-2010-1212 CVE-2010-1213 CVE-2010-1214 CVE-2010-1215 CVE-2010-1585 CVE-2010-2751 CVE-2010-2752 CVE-2010-2753 CVE-2010-2754 CVE-2010-2755 CVE-2010-2760 CVE-2010-2762 CVE-2010-2764 CVE-2010-2765 CVE-2010-2766 CVE-2010-2767 CVE-2010-2768 CVE-2010-2769 CVE-2010-3166 CVE-2010-3167 CVE-2010-3168 CVE-2010-3169 CVE-2010-3170 CVE-2010-3173 CVE-2010-3174 CVE-2010-3175 CVE-2010-3176 CVE-2010-3177 CVE-2010-3178 CVE-2010-3179 CVE-2010-3180 CVE-2010-3182 CVE-2010-3183 CVE-2010-3765 CVE-2010-3766 CVE-2010-3767 CVE-2010-3768 CVE-2010-3769 CVE-2010-3770 CVE-2010-3771 CVE-2010-3772 CVE-2010-3773 CVE-2010-3775 CVE-2010-3776 CVE-2010-3777 CVE-2010-3778 CVE-2011-0051 CVE-2011-0053 CVE-2011-0054 CVE-2011-0055 CVE-2011-0056 CVE-2011-0057 CVE-2011-0059 CVE-2011-0061 CVE-2011-0062 CVE-2011-0065 CVE-2011-0066 CVE-2011-0067 CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0073 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 CVE-2011-0083 CVE-2011-0084 CVE-2011-0085 CVE-2011-1202 CVE-2011-2362 CVE-2011-2363 CVE-2011-2364 CVE-2011-2365 CVE-2011-2371 CVE-2011-2372 CVE-2011-2373 CVE-2011-2374 CVE-2011-2376 CVE-2011-2377 CVE-2011-2378 CVE-2011-2980 CVE-2011-2981 CVE-2011-2982 CVE-2011-2983 CVE-2011-2995 CVE-2011-2996 CVE-2011-2999 CVE-2011-3000 CVE-2011-3001 CVE-2011-3026 CVE-2011-3647 CVE-2011-3648 CVE-2011-3650 CVE-2011-3659 CVE-2011-3666 CVE-2011-3670 CVE-2012-0442 CVE-2012-0443 CVE-2012-0444 CVE-2012-0449 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the mutt Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1558 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the nagios Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-5803 CVE-2011-1523 CVE-2012-6096 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the nagios-plugins Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-5623 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the nfs-client Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-1923 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ntp Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0159 CVE-2009-1252 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ofed Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-1693 CVE-2010-3904 CVE-2010-4649 CVE-2011-3345 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the openCryptoki Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-4454 CVE-2012-4455 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the openslp Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-3609 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the openssh Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-0225 CVE-2007-4752 CVE-2008-1483 CVE-2010-5107 CVE-2011-5000 CVE-2012-0814 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the openvpn Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4339 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the opie Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2489 CVE-2011-2490 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pam Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0579 CVE-2009-0887 CVE-2011-3148 CVE-2011-3149 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pam_krb5 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-3825 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pam_ldap Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-5170 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pam_mount Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-5138 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pango Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0020 CVE-2011-0064 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pcsc-ccid Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-4530 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pcsc-lite Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-0407 CVE-2010-4531 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the perl-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-5116 CVE-2010-1168 CVE-2010-1447 CVE-2010-2761 CVE-2010-4410 CVE-2010-4411 CVE-2010-4777 CVE-2011-1487 CVE-2011-2728 CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the perl-HTML-Parser Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3627 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the perl-Tk Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4484 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the perl-libwww-perl Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0633 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the perl-spamassassin Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-0451 CVE-2007-2873 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the postgresql Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4769 CVE-2007-4772 CVE-2007-6067 CVE-2007-6600 CVE-2007-6601 CVE-2009-3555 CVE-2009-4034 CVE-2009-4136 CVE-2010-0442 CVE-2010-1169 CVE-2010-1170 CVE-2010-3433 CVE-2010-4014 CVE-2010-4015 CVE-2012-0866 CVE-2012-0868 CVE-2012-2143 CVE-2012-2655 CVE-2012-3488 CVE-2012-3489 CVE-2013-0255 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the puppet Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-0156 CVE-2011-1986 CVE-2011-3848 CVE-2011-3869 CVE-2011-3870 CVE-2011-3871 CVE-2011-3872 CVE-2012-1987 CVE-2012-1988 CVE-2012-1989 CVE-2012-3864 CVE-2012-3865 CVE-2012-3867 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pure-ftpd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0411 CVE-2011-3171 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the python Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-2052 CVE-2008-1721 CVE-2008-2315 CVE-2008-2316 CVE-2008-3142 CVE-2008-3143 CVE-2008-3144 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the python-pam Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-1502 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the pyxml Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3560 CVE-2009-3720 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the qt3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-4811 CVE-2007-0242 CVE-2007-3388 CVE-2007-4137 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the quagga Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-2223 CVE-2007-1995 CVE-2010-1674 CVE-2010-1675 CVE-2010-2948 CVE-2010-2949 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the radvd Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-3602 CVE-2011-3603 CVE-2011-3604 CVE-2011-3605 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the rsync Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4091 CVE-2007-6199 CVE-2011-1097 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the rsyslog Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-3200 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the ruby Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-3694 CVE-2006-5467 CVE-2006-6303 CVE-2007-5162 CVE-2007-5770 CVE-2008-1145 CVE-2008-3790 CVE-2009-0642 CVE-2009-1904 CVE-2009-4492 CVE-2010-0541 CVE-2011-0188 CVE-2011-1004 CVE-2011-1005 CVE-2011-2686 CVE-2011-2705 CVE-2011-3009 CVE-2011-4815 CVE-2012-4466 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the sblim-sfcb Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-3381 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the socat Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2799 CVE-2012-0219 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the squid Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-0478 CVE-2009-2855 CVE-2010-0308 CVE-2010-0639 CVE-2012-5643 CVE-2013-0188 CVE-2013-0189 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the squid3 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2005-0094 CVE-2011-3205 CVE-2011-4096 CVE-2012-5643 CVE-2013-0188 CVE-2013-0189 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the squidGuard Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-3700 CVE-2009-3826 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the star Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4134 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the stunnel Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-1762 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the sudo Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-0426 CVE-2010-0427 CVE-2012-2337 CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-2777 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the sysconfig Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-4182 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the syslog-ng Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-5110 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the sysstat Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3852 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the system-config-printer Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-4405 CVE-2012-4510 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the systemtap Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2009-2911 CVE-2009-4273 CVE-2012-0875 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the t1lib Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552 CVE-2011-1553 CVE-2011-1554 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the taglib Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-1108 CVE-2012-1584 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the tar Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2001-1267 CVE-2002-0399 CVE-2006-6097 CVE-2010-0624 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the tftp Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2199 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the tgt Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-0001 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the tomcat6 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-1232 CVE-2008-1947 CVE-2008-2370 CVE-2008-2938 CVE-2008-5515 CVE-2009-0033 CVE-2009-0580 CVE-2009-0781 CVE-2009-0783 CVE-2009-2693 CVE-2009-2901 CVE-2009-2902 CVE-2010-1157 CVE-2010-2227 CVE-2010-3718 CVE-2010-4172 CVE-2011-0013 CVE-2011-0534 CVE-2011-1184 CVE-2011-2204 CVE-2011-2526 CVE-2011-3190 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 CVE-2012-2733 CVE-2012-3546 CVE-2012-4431 CVE-2012-4534 CVE-2012-5568 CVE-2012-5885 CVE-2012-5886 CVE-2012-5887 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the unixODBC_23 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-1145 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the unrar Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-3726 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the unzip Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2005-2475 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the virt-utils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-1922 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the vte Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2713 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the w3m Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6772 CVE-2010-2074 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the wget Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6719 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the wireshark Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-1932 CVE-2006-4574 CVE-2006-4805 CVE-2006-5468 CVE-2006-5469 CVE-2006-5740 CVE-2007-0456 CVE-2007-0457 CVE-2007-0458 CVE-2007-0459 CVE-2009-1210 CVE-2009-1267 CVE-2009-1268 CVE-2009-1269 CVE-2009-2560 CVE-2009-2562 CVE-2009-3549 CVE-2009-3550 CVE-2009-3829 CVE-2009-4377 CVE-2010-0304 CVE-2010-1455 CVE-2010-2992 CVE-2010-2993 CVE-2010-2994 CVE-2010-2995 CVE-2010-3445 CVE-2010-4300 CVE-2010-4301 CVE-2010-4538 CVE-2011-0024 CVE-2011-0538 CVE-2011-0713 CVE-2011-1138 CVE-2011-1139 CVE-2011-1140 CVE-2011-1143 CVE-2011-1590 CVE-2011-1591 CVE-2011-1592 CVE-2011-1957 CVE-2011-1958 CVE-2011-1959 CVE-2011-2174 CVE-2011-2175 CVE-2011-2597 CVE-2011-2698 CVE-2011-3266 CVE-2011-3360 CVE-2011-3483 CVE-2012-1593 CVE-2012-1595 CVE-2012-1596 CVE-2012-2392 CVE-2012-2393 CVE-2012-2394 CVE-2012-4048 CVE-2012-4049 CVE-2012-4285 CVE-2012-4288 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 CVE-2012-4292 CVE-2012-4293 CVE-2012-4296 CVE-2012-5592 CVE-2012-5593 CVE-2012-5594 CVE-2012-5595 CVE-2012-5596 CVE-2012-5597 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-5601 CVE-2012-5602 CVE-2013-1572 CVE-2013-1573 CVE-2013-1574 CVE-2013-1575 CVE-2013-1576 CVE-2013-1577 CVE-2013-1578 CVE-2013-1579 CVE-2013-1580 CVE-2013-1581 CVE-2013-1582 CVE-2013-1583 CVE-2013-1584 CVE-2013-1585 CVE-2013-1586 CVE-2013-1587 CVE-2013-1588 CVE-2013-1589 CVE-2013-1590 CVE-2013-2475 CVE-2013-2476 CVE-2013-2477 CVE-2013-2478 CVE-2013-2479 CVE-2013-2480 CVE-2013-2481 CVE-2013-2482 CVE-2013-2483 CVE-2013-2484 CVE-2013-2485 CVE-2013-2486 CVE-2013-2487 CVE-2013-2488 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the x3270 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2012-5662 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xdg-utils Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-0386 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xen Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-1320 CVE-2007-1321 CVE-2007-1322 CVE-2007-1323 CVE-2007-1366 CVE-2007-3919 CVE-2011-1898 CVE-2012-0029 CVE-2012-0217 CVE-2012-2625 CVE-2012-3432 CVE-2012-3433 CVE-2012-3494 CVE-2012-3495 CVE-2012-3496 CVE-2012-3497 CVE-2012-3498 CVE-2012-3515 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 CVE-2012-5510 CVE-2012-5511 CVE-2012-5513 CVE-2012-5514 CVE-2012-5515 CVE-2012-5525 CVE-2012-5634 CVE-2012-6075 CVE-2013-0151 CVE-2013-0152 CVE-2013-0153 CVE-2013-1917 CVE-2013-1918 CVE-2013-1919 CVE-2013-1920 CVE-2013-1922 CVE-2013-1952 CVE-2013-2007 CVE-2013-2072 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xorg-x11 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2007-4568 CVE-2011-0465 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xorg-x11-Xvnc Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-6101 CVE-2006-6102 CVE-2006-6103 CVE-2007-1003 CVE-2007-5760 CVE-2007-6427 CVE-2007-6428 CVE-2007-6429 CVE-2008-0006 CVE-2008-1377 CVE-2008-1379 CVE-2008-2360 CVE-2008-2361 CVE-2008-2362 CVE-2010-2240 CVE-2010-4818 CVE-2010-4819 CVE-2011-4028 CVE-2011-4029 CVE-2013-1940 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xorg-x11-libs-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-2895 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xorg-x11-libxcb-32bit Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2013-2064 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xorg-x11-server-dmx Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2010-2240 CVE-2011-4028 CVE-2011-4029 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the xterm Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-2383 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the yast2 Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2011-3177 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the yast2-core Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2008-4311 CVE-2011-2483 CVE-2011-3177 SUSE Linux Enterprise Server 11 SP3 These are all security issues found in the zoo Package on the GA media of SUSE Linux Enterprise Server 11 SP3. Moderate CVE-2006-0855 CVE-2007-1669 SUSE OpenStack Cloud 5 This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled. They can be re-enabled by exporting the following environment variable MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/modules-Q16/coders/vulnerable/ (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) Important SUSE bug 978061 CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 SUSE OpenStack Cloud 5 This update for ImageMagick fixes the following issues: - bsc#978061: A vulnerability in ImageMagick's "https" module allowed users to execute arbitrary shell commands on the host performing the image conversion. The issue had the potential for remote command injection. This update mitigates the vulnerability by disabling all access to the "https" module in the "delegates.xml" config file. (CVE-2016-3714) Important SUSE bug 978061 CVE-2016-3714 SUSE OpenStack Cloud 5 This update for ImageMagick fixes the following issues: - CVE-2016-5118: popen() shell vulnerability via filenames (bsc#982178) Important SUSE bug 982178 CVE-2016-5118 SUSE OpenStack Cloud 5 This update to MozillaFirefox 38.8.0 ESR fixes the following security issues (bsc#977333): - CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381) Important SUSE bug 977333 SUSE bug 977374 SUSE bug 977376 SUSE bug 977381 SUSE bug 977386 CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 SUSE OpenStack Cloud 5 MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss were updated to fix nine security issues. MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed: - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) These non-security issues were fixed: - Fix crashes on aarch64 * Determine page size at runtime (bsc#984006) * Allow aarch64 to work in safe mode (bsc#985659) - Fix crashes on mainframes All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details. Important SUSE bug 983549 SUSE bug 983638 SUSE bug 983639 SUSE bug 983643 SUSE bug 983646 SUSE bug 983651 SUSE bug 983652 SUSE bug 983653 SUSE bug 983655 SUSE bug 984006 SUSE bug 985659 CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2828 CVE-2016-2831 CVE-2016-2834 SUSE OpenStack Cloud 5 MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809): * MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) * MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed * MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content * MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 * MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering * MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus * MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown * MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events * MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes * MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback * MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation * MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects * MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file * CVE-2016-6354: Fix for possible buffer overrun (bsc#990856) Also a temporary workaround was added: - Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628) Important SUSE bug 989196 SUSE bug 990628 SUSE bug 990856 SUSE bug 991809 CVE-2016-2830 CVE-2016-2835 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-2839 CVE-2016-5252 CVE-2016-5254 CVE-2016-5258 CVE-2016-5259 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-6354 SUSE OpenStack Cloud 5 MozillaFirefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701): The following security issue were fixed: * MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString * MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin * MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList * MFSA 2016-86/CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState * MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick * MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame * MFSA 2016-86/CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap * MFSA 2016-86/CVE-2016-5281: use-after-free in DOMSVGLength * MFSA 2016-86/CVE-2016-5284: Add-on update site certificate pin expiration * MFSA 2016-86/CVE-2016-5250: Resource Timing API is storing resources sent by the previous page * MFSA 2016-86/CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel * MFSA 2016-86/CVE-2016-5257: Various memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 Important SUSE bug 999701 CVE-2016-5250 CVE-2016-5257 CVE-2016-5261 CVE-2016-5270 CVE-2016-5272 CVE-2016-5274 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5280 CVE-2016-5281 CVE-2016-5284 SUSE OpenStack Cloud 5 MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: * MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES * MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution * MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees * MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements * MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms * MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments * MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag * MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs * MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 * MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information. Also the following bug was fixed: - Fix fontconfig issue (bsc#1000751) on 32bit systems as well. Important SUSE bug 1000751 SUSE bug 1015422 CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 SUSE OpenStack Cloud 5 MozillaFirefox 45 ESR was updated to 45.7 to fix the following issues (bsc#1021991): * MFSA 2017-02/CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bsc#1021818) * MFSA 2017-02/CVE-2017-5396: Use-after-free with Media Decoder (bsc#1021821) * MFSA 2017-02/CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bsc#1021823) * MFSA 2017-02/CVE-2017-5380: Potential use-after-free during DOM manipulations (bsc#1021819) * MFSA 2017-02/CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bsc#1021820) * MFSA 2017-02/CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (bsc#1021824) * MFSA 2017-02/CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bsc#1021814) * MFSA 2017-02/CVE-2017-5376: Use-after-free in XSL (bsc#1021817) * MFSA 2017-02/CVE-2017-5383: Location bar spoofing with unicode characters (bsc#1021822) Please see https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ for more information. Important SUSE bug 1021814 SUSE bug 1021817 SUSE bug 1021818 SUSE bug 1021819 SUSE bug 1021820 SUSE bug 1021821 SUSE bug 1021822 SUSE bug 1021823 SUSE bug 1021824 SUSE bug 1021991 CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5386 CVE-2017-5390 CVE-2017-5396 SUSE OpenStack Cloud 5 This update for MozillaFirefox to ESR 45.8 fixes the following issues: Security issues fixed (bsc#1028391): - CVE-2017-5402: Use-after-free working with events in FontFace objects - CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP - CVE-2017-5401: Memory Corruption when handling ErrorResult - CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters - CVE-2017-5404: Use-after-free working with ranges in selections - CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports - CVE-2017-5408: Cross-origin reading of video captions in violation of CORS - CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service - CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 Bugfixes: - fix crashes on Itanium (bsc#1027527) Important SUSE bug 1027527 SUSE bug 1028391 CVE-2017-5398 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5404 CVE-2017-5405 CVE-2017-5407 CVE-2017-5408 CVE-2017-5409 CVE-2017-5410 SUSE OpenStack Cloud 5 Mozilla Firefox was updated to the Firefox ESR release 45.9. Mozilla NSS was updated to support TLS 1.3 (close to release draft) and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes. Security issues fixed in Firefox (bsc#1035082) - MFSA 2017-11/CVE-2017-5469: Potential Buffer overflow in flex-generated code - MFSA 2017-11/CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - MFSA 2017-11/CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing - MFSA 2017-11/CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing - MFSA 2017-11/CVE-2017-5437: Vulnerabilities in Libevent library - MFSA 2017-11/CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 - MFSA 2017-11/CVE-2017-5435: Use-after-free during transaction processing in the editor - MFSA 2017-11/CVE-2017-5434: Use-after-free during focus handling - MFSA 2017-11/CVE-2017-5433: Use-after-free in SMIL animation functions - MFSA 2017-11/CVE-2017-5432: Use-after-free in text input selection - MFSA 2017-11/CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - MFSA 2017-11/CVE-2017-5465: Out-of-bounds read in ConvolvePixel - MFSA 2017-11/CVE-2017-5460: Use-after-free in frame selection - MFSA 2017-11/CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - MFSA 2017-11/CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - MFSA 2017-11/CVE-2017-5447: Out-of-bounds read during glyph processing - MFSA 2017-11/CVE-2017-5444: Buffer overflow while parsing application/http-index-format content - MFSA 2017-11/CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content - MFSA 2017-11/CVE-2017-5442: Use-after-free during style changes - MFSA 2017-11/CVE-2017-5443: Out-of-bounds write during BinHex decoding - MFSA 2017-11/CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing - MFSA 2017-11/CVE-2017-5441: Use-after-free with selection during scroll events - MFSA 2017-11/CVE-2017-5459: Buffer overflow in WebGL Mozilla NSS was updated to 3.29.5, bringing new features and fixing bugs: - Update to NSS 3.29.5: * MFSA 2017-11/CVE-2017-5461: Rare crashes in the base 64 decoder and encoder were fixed. * MFSA 2017-11/CVE-2017-5462: A carry over bug in the RNG was fixed. * CVE-2016-9574: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA (bsc#1015499). * requires NSPR >= 4.13.1 - Update to NSS 3.29.3 * enables TLS 1.3 by default - Fixed a bug in hash computation (and build with GCC 7 which complains about shifts of boolean values). (bsc#1030071, bmo#1348767) - Update to NSS 3.28.3 This is a patch release to fix binary compatibility issues. - Update to NSS 3.28.1 This is a patch release to update the list of root CA certificates. * The following CA certificates were Removed CN = Buypass Class 2 CA 1 CN = Root CA Generalitat Valenciana OU = RSA Security 2048 V3 * The following CA certificates were Added OU = AC RAIZ FNMT-RCM CN = Amazon Root CA 1 CN = Amazon Root CA 2 CN = Amazon Root CA 3 CN = Amazon Root CA 4 CN = LuxTrust Global Root 2 CN = Symantec Class 1 Public Primary Certification Authority - G4 CN = Symantec Class 1 Public Primary Certification Authority - G6 CN = Symantec Class 2 Public Primary Certification Authority - G4 CN = Symantec Class 2 Public Primary Certification Authority - G6 * The version number of the updated root CA list has been set to 2.11 - Update to NSS 3.28 New functionality: * NSS includes support for TLS 1.3 draft -18. This includes a number of improvements to TLS 1.3: - The signed certificate timestamp, used in certificate transparency, is supported in TLS 1.3. - Key exporters for TLS 1.3 are supported. This includes the early key exporter, which can be used if 0-RTT is enabled. Note that there is a difference between TLS 1.3 and key exporters in older versions of TLS. TLS 1.3 does not distinguish between an empty context and no context. - The TLS 1.3 (draft) protocol can be enabled, by defining NSS_ENABLE_TLS_1_3=1 when building NSS. - NSS includes support for the X25519 key exchange algorithm, which is supported and enabled by default in all versions of TLS. Notable Changes: * NSS can no longer be compiled with support for additional elliptic curves. This was previously possible by replacing certain NSS source files. * NSS will now detect the presence of tokens that support additional elliptic curves and enable those curves for use in TLS. Note that this detection has a one-off performance cost, which can be avoided by using the SSL_NamedGroupConfig function to limit supported groups to those that NSS provides. * PKCS#11 bypass for TLS is no longer supported and has been removed. * Support for "export" grade SSL/TLS cipher suites has been removed. * NSS now uses the signature schemes definition in TLS 1.3. This also affects TLS 1.2. NSS will now only generate signatures with the combinations of hash and signature scheme that are defined in TLS 1.3, even when negotiating TLS 1.2. - This means that SHA-256 will only be used with P-256 ECDSA certificates, SHA-384 with P-384 certificates, and SHA-512 with P-521 certificates. SHA-1 is permitted (in TLS 1.2 only) with any certificate for backward compatibility reasons. - NSS will now no longer assume that default signature schemes are supported by a peer if there was no commonly supported signature scheme. * NSS will now check if RSA-PSS signing is supported by the token that holds the private key prior to using it for TLS. * The certificate validation code contains checks to no longer trust certificates that are issued by old WoSign and StartCom CAs after October 21, 2016. This is equivalent to the behavior that Mozilla will release with Firefox 51. - Update to NSS 3.27.2 * Fixed SSL_SetTrustAnchors leaks (bmo#1318561) - raised the minimum softokn/freebl version to 3.28 as reported in (boo#1021636) - Update to NSS 3.26.2 New Functionality: * the selfserv test utility has been enhanced to support ALPN (HTTP/1.1) and 0-RTT * added support for the System-wide crypto policy available on Fedora Linux see http://fedoraproject.org/wiki/Changes/CryptoPolicy * introduced build flag NSS_DISABLE_LIBPKIX that allows compilation of NSS without the libpkix library Notable Changes: * The following CA certificate was Added CN = ISRG Root X1 * NPN is disabled and ALPN is enabled by default * the NSS test suite now completes with the experimental TLS 1.3 code enabled * several test improvements and additions, including a NIST known answer test Changes in 3.26.2 * MD5 signature algorithms sent by the server in CertificateRequest messages are now properly ignored. Previously, with rare server configurations, an MD5 signature algorithm might have been selected for client authentication and caused the client to abort the connection soon after. - Update to NSS 3.25 New functionality: * Implemented DHE key agreement for TLS 1.3 * Added support for ChaCha with TLS 1.3 * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF * In previous versions, when using client authentication with TLS 1.2, NSS only supported certificate_verify messages that used the same signature hash algorithm as used by the PRF. This limitation has been removed. Notable changes: * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3 * Regression fix: NSS no longer reports a failure if an application attempts to disable the SSLv2 protocol. * The list of trusted CA certificates has been updated to version 2.8 * The following CA certificate was Removed Sonera Class1 CA * The following CA certificates were Added Hellenic Academic and Research Institutions RootCA 2015 Hellenic Academic and Research Institutions ECC RootCA 2015 Certplus Root CA G1 Certplus Root CA G2 OpenTrust Root CA G1 OpenTrust Root CA G2 OpenTrust Root CA G3 - Update to NSS 3.24 New functionality: * NSS softoken has been updated with the latest National Institute of Standards and Technology (NIST) guidance (as of 2015): - Software integrity checks and POST functions are executed on shared library load. These checks have been disabled by default, as they can cause a performance regression. To enable these checks, you must define symbol NSS_FORCE_FIPS when building NSS. - Counter mode and Galois/Counter Mode (GCM) have checks to prevent counter overflow. - Additional CSPs are zeroed in the code. - NSS softoken uses new guidance for how many Rabin-Miller tests are needed to verify a prime based on prime size. * NSS softoken has also been updated to allow NSS to run in FIPS Level 1 (no password). This mode is triggered by setting the database password to the empty string. In FIPS mode, you may move from Level 1 to Level 2 (by setting an appropriate password), but not the reverse. * A SSL_ConfigServerCert function has been added for configuring SSL/TLS server sockets with a certificate and private key. Use this new function in place of SSL_ConfigSecureServer, SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses, and SSL_SetSignedCertTimestamps. SSL_ConfigServerCert automatically determines the certificate type from the certificate and private key. The caller is no longer required to use SSLKEAType explicitly to select a "slot" into which the certificate is configured (which incorrectly identifies a key agreement type rather than a certificate). Separate functions for configuring Online Certificate Status Protocol (OCSP) responses or Signed Certificate Timestamps are not needed, since these can be added to the optional SSLExtraServerCertData struct provided to SSL_ConfigServerCert. Also, partial support for RSA Probabilistic Signature Scheme (RSA-PSS) certificates has been added. Although these certificates can be configured, they will not be used by NSS in this version. * Deprecate the member attribute authAlgorithm of type SSLCipherSuiteInfo. Instead, applications should use the newly added attribute authType. * Add a shared library (libfreeblpriv3) on Linux platforms that define FREEBL_LOWHASH. * Remove most code related to SSL v2, including the ability to actively send a SSLv2-compatible client hello. However, the server-side implementation of the SSL/TLS protocol still supports processing of received v2-compatible client hello messages. * Disable (by default) NSS support in optimized builds for logging SSL/TLS key material to a logfile if the SSLKEYLOGFILE environment variable is set. To enable the functionality in optimized builds, you must define the symbol NSS_ALLOW_SSLKEYLOGFILE when building NSS. * Update NSS to protect it against the Cachebleed attack. * Disable support for DTLS compression. * Improve support for TLS 1.3. This includes support for DTLS 1.3. Note that TLS 1.3 support is experimental and not suitable for production use. - Update to NSS 3.23 New functionality: * ChaCha20/Poly1305 cipher and TLS cipher suites now supported * Experimental-only support TLS 1.3 1-RTT mode (draft-11). This code is not ready for production use. Notable changes: * The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers * The build time environment variable NSS_ENABLE_ZLIB has been renamed to NSS_SSL_ENABLE_ZLIB * The build time environment variable NSS_DISABLE_CHACHAPOLY was added, which can be used to prevent compilation of the ChaCha20/Poly1305 code. * The following CA certificates were Removed - Staat der Nederlanden Root CA - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado - NetLock Kozjegyzoi (Class A) Tanusitvanykiado - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado - VeriSign Class 1 Public PCA - G2 - VeriSign Class 3 Public PCA - VeriSign Class 3 Public PCA - G2 - CA Disig * The following CA certificates were Added + SZAFIR ROOT CA2 + Certum Trusted Network CA 2 * The following CA certificate had the Email trust bit turned on + Actalis Authentication Root CA Security fixes: * CVE-2016-2834: Memory safety bugs (boo#983639) MFSA-2016-61 bmo#1206283 bmo#1221620 bmo#1241034 bmo#1241037 - Update to NSS 3.22.3 * Increase compatibility of TLS extended master secret, don't send an empty TLS extension last in the handshake (bmo#1243641) * Fixed a heap-based buffer overflow related to the parsing of certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause a crash or execution of arbitrary code with the permissions of the user. (CVE-2016-1950, bmo#1245528) - Update to NSS 3.22.2 New functionality: * RSA-PSS signatures are now supported (bmo#1215295) * Pseudorandom functions based on hashes other than SHA-1 are now supported * Enforce an External Policy on NSS from a config file (bmo#1009429) - CVE-2016-8635: Fix for DH small subgroup confinement attack (bsc#1015547) Mozilla NSPR was updated to version 4.13.1: The previously released version 4.13 had changed pipes to be nonblocking by default, and as a consequence, PollEvent was changed to not block on clear. The NSPR development team received reports that these changes caused regressions in some applications that use NSPR, and it has been decided to revert the changes made in NSPR 4.13. NSPR 4.13.1 restores the traditional behavior of pipes and PollEvent. Mozilla NSPR update to version 4.13 had these changes: - PL_strcmp (and others) were fixed to return consistent results when one of the arguments is NULL. - PollEvent was fixed to not block on clear. - Pipes are always nonblocking. - PR_GetNameForIdentity: added thread safety lock and bound checks. - Removed the PLArena freelist. - Avoid some integer overflows. - fixed several comments. Important SUSE bug 1015499 SUSE bug 1015547 SUSE bug 1021636 SUSE bug 1030071 SUSE bug 1035082 SUSE bug 983639 CVE-2016-1950 CVE-2016-2834 CVE-2016-8635 CVE-2016-9574 CVE-2017-5429 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5437 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5469 SUSE OpenStack Cloud 5 This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements: - SHA256 cipher names change spelling from *_sha256 to *_sha_256. - Drop mod_nss_migrate.pl and use upstream migrate script instead. - Check for Apache user owner/group read permissions of NSS database at startup. - Update default ciphers to something more modern and secure. - Check for host and netstat commands in gencert before trying to use them. - Don't ignore NSSProtocol when NSSFIPS is enabled. - Use proper shell syntax to avoid creating /0 in gencert. - Add server support for DHE ciphers. - Extract SAN from server/client certificates into env. - Fix memory leaks and other coding issues caught by clang analyzer. - Add support for Server Name Indication (SNI) - Add support for SNI for reverse proxy connections. - Add RenegBufferSize? option. - Add support for TLS Session Tickets (RFC 5077). - Implement a slew more OpenSSL cipher macros. - Fix a number of illegal memory accesses and memory leaks. - Support for SHA384 ciphers if they are available in the version of NSS mod_nss is built against. - Add the SECURE_RENEG environment variable. - Add some hints when NSS database cannot be initialized. - Code cleanup including trailing whitespace and compiler warnings. - Modernize autotools configuration slightly, add config.h. - Add small test suite for SNI. - Add compatibility for mod_ssl-style cipher definitions. - Add Camelia ciphers. - Remove Fortezza ciphers. - Add TLSv1.2-specific ciphers. - Initialize cipher list when re-negotiating handshake. - Completely remove support for SSLv2. - Add support for sqlite NSS databases. - Compare subject CN and VS hostname during server start up. - Add support for enabling TLS v1.2. - Don't enable SSL 3 by default. (CVE-2014-3566) - Improve protocol testing. - Add nss_pcache man page. - Fix argument handling in nss_pcache. - Support httpd 2.4+. - Allow users to configure a helper to ask for certificate passphrases via NSSPassPhraseDialog. (bsc#975394) Moderate SUSE bug 975394 SUSE bug 979688 CVE-2013-4566 CVE-2014-3566 SUSE OpenStack Cloud 5 This update for bind fixes two assertion failures that could lead to a remote denial of service attack: - CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) - CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) Important SUSE bug 970072 SUSE bug 970073 CVE-2016-1285 CVE-2016-1286 SUSE OpenStack Cloud 5 The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. (CVE-2016-2776, bsc#1000362) Critical SUSE bug 1000362 CVE-2016-2776 SUSE OpenStack Cloud 5 This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). - Fix BIND to return a valid hostname in response to ldapdump queries. (bsc#965748) Important SUSE bug 1007829 SUSE bug 965748 CVE-2016-8864 SUSE OpenStack Cloud 5 This update for bind fixes the following issues: - Fix a potential assertion failure that could have been triggered by a malformed response to an ANY query, thereby facilitating a denial-of-service attack. [CVE-2016-9131, bsc#1018700, bsc#1018699] - Fix a potential assertion failure that could have been triggered by responding to a query with inconsistent DNSSEC information, thereby facilitating a denial-of-service attack. [CVE-2016-9147, bsc#1018701, bsc#1018699] - Fix potential assertion failure that could have been triggered by DNS responses that contain unusually-formed DS resource records, facilitating a denial-of-service attack. [CVE-2016-9444, bsc#1018702, bsc#1018699] Important SUSE bug 1018699 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 SUSE OpenStack Cloud 5 This update for bind fixes the following issues: - Fixed a possible denial of service vulnerability (affected only configurations using both DNS64 and RPZ, CVE-2017-3135, bsc#1024130) Moderate SUSE bug 1024130 CVE-2017-3135 SUSE OpenStack Cloud 5 This update for bind fixes the following security issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol. Important SUSE bug 1033466 SUSE bug 1033467 SUSE bug 1033468 SUSE bug 987866 SUSE bug 989528 CVE-2016-2775 CVE-2016-6170 CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 SUSE OpenStack Cloud 5 This update for bind fixes the following issues: - A regression in the fix for CVE-2017-3137 caused an assert in name.c (bsc#1034162) Important SUSE bug 1034162 CVE-2017-3137 SUSE OpenStack Cloud 5 bsdtar was updated to fix seven security issues. These security issues were fixed: - CVE-2015-8929: Memory leak in tar parser (bsc#985669). - CVE-2016-4809: Memory allocate error with symbolic links in cpio archives (bsc#984990). - CVE-2015-8920: Stack out of bounds read in ar parser (bsc#985675). - CVE-2015-8921: Global out of bounds read in mtree parser (bsc#985682). - CVE-2015-8924: Heap buffer read overflow in tar (bsc#985609). - CVE-2015-8918: Overlapping memcpy in CAB parser (bsc#985698). - CVE-2015-2304: Reject absolute paths in input mode of bsdcpio exactly when '..' is rejected (bsc#920870). Important SUSE bug 920870 SUSE bug 984990 SUSE bug 985609 SUSE bug 985669 SUSE bug 985675 SUSE bug 985682 SUSE bug 985698 CVE-2015-2304 CVE-2015-8918 CVE-2015-8920 CVE-2015-8921 CVE-2015-8924 CVE-2015-8929 CVE-2016-4809 SUSE OpenStack Cloud 5 This update for crowbar-barclamp-trove fixes the following issues: - Fix initial migration and schema revision. - Set the trove service password to random. (bsc#991729, CVE-2016-6829) Low SUSE bug 991729 CVE-2016-6829 SUSE OpenStack Cloud 5 This update for curl fixes the following issues: - CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389) - CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390) - CVE-2016-7141: Fixed incorrect reuse of client certificates (bsc#997420). Moderate SUSE bug 991389 SUSE bug 991390 SUSE bug 997420 CVE-2016-5419 CVE-2016-5420 CVE-2016-7141 SUSE OpenStack Cloud 5 This update for dhcp fixes the following issues: - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional (bsc#969820). Moderate SUSE bug 969820 CVE-2016-2774 SUSE OpenStack Cloud 5 This update for ghostscript-library fixes the following issues: - Multiple security vulnerabilities have been discovered where ghostscript's "-dsafer" flag did not provide sufficient protection against unintended access to the file system. Thus, a machine that would process a specially crafted Postscript file would potentially leak sensitive information to an attacker. (CVE-2013-5653, CVE-2016-7977, bsc#1001951) - Insufficient validation of the type of input in .initialize_dsc_parser used to allow remote code execution. (CVE-2016-7979, bsc#1001951) - An integer overflow in the gs_heap_alloc_bytes function used to allow remote attackers to cause a denial of service (crash) via specially crafted Postscript files. (CVE-2015-3228, boo#939342) Important SUSE bug 1001951 SUSE bug 939342 CVE-2013-5653 CVE-2015-3228 CVE-2016-7977 CVE-2016-7979 SUSE OpenStack Cloud 5 This update for ghostscript fixes the following security vulnerability: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) This update is a reissue including the SUSE Linux Enterprise 11 SP3 product. Important SUSE bug 1036453 CVE-2017-8291 SUSE OpenStack Cloud 5 The git package was updated to fix the following security issue: - Fix remote code execution with recursive fetch of submodules (bsc#948969). Moderate SUSE bug 948969 SUSE OpenStack Cloud 5 This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Important SUSE bug 971328 CVE-2016-2315 CVE-2016-2324 SUSE OpenStack Cloud 5 This security update for haproxy provides version 1.5.4 with various fixes, improvements and one security fix. * Update from version 1.4.24 to 1.5.4 => For a detailed description, please refer to the package changelog. Security Issues: * CVE-2014-6269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6269> SUSE bug 876438 SUSE bug 895849 CVE-2014-6269 SUSE OpenStack Cloud 5 haxproy was updated to backport various security fixes and related patches (bsc#937202) (bsc#937042) (CVE-2015-3281) + BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data + BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id + MEDIUM: ssl: replace standards DH groups with custom ones + BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten + MINOR: ssl: add a destructor to free allocated SSL ressources + BUG/MINOR: ssl: Display correct filename in error message + MINOR: ssl: load certificates in alphabetical order + BUG/MEDIUM: checks: fix conflicts between agent checks and ssl healthchecks + BUG/MEDIUM: ssl: force a full GC in case of memory shortage + BUG/MEDIUM: ssl: fix bad ssl context init can cause segfault in case of OOM. + BUG/MINOR: ssl: correctly initialize ssl ctx for invalid certificates + MINOR: ssl: add statement to force some ssl options in global. + MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to return DER formatted certs Also the init script was fixed for the haproxy status checks (bsc#947204) Moderate SUSE bug 937042 SUSE bug 937202 SUSE bug 947204 CVE-2015-3281 SUSE OpenStack Cloud 5 This IBM Java 1.6.0 SR16 FP25 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Important SUSE bug 977646 SUSE bug 977648 SUSE bug 977650 SUSE bug 979252 CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 SUSE OpenStack Cloud 5 IBM Java 6 was updated to version 6.0-16.30. Following security issue was fixed: CVE-2016-3485 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Important SUSE bug 992537 CVE-2016-3485 SUSE OpenStack Cloud 5 This update for java-1_6_0-ibm fixes the following issues: - Version update to 6.0-16.35 (bsc#1009280) fixing the following CVE's: CVE-2016-5568, CVE-2016-5556, CVE-2016-5573, CVE-2016-5597, CVE-2016-5554, CVE-2016-5542 Important SUSE bug 1009280 CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5597 SUSE OpenStack Cloud 5 This IBM Java 1.7.0 SR9 FP40 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Important SUSE bug 977646 SUSE bug 977648 SUSE bug 977650 SUSE bug 979252 CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 SUSE OpenStack Cloud 5 IBM Java 7 was updated to 7.1-9.50, fixing bugs and security issues (bsc#992537). Security issues fixed: CVE-2016-3485 CVE-2016-3511 CVE-2016-3598 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Important SUSE bug 992537 CVE-2016-3485 CVE-2016-3511 CVE-2016-3598 SUSE OpenStack Cloud 5 This update for java-1_7_0-ibm fixes the following issues: - Version update to 7.0-9.60 (bsc#1009280, bsc#992537) fixing the following CVE's: CVE-2016-5568, CVE-2016-5556, CVE-2016-5573, CVE-2016-5597, CVE-2016-5554, CVE-2016-5542 Important SUSE bug 1009280 SUSE bug 992537 CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5597 SUSE OpenStack Cloud 5 This update for java-1_7_1-ibm fixes the following issues: Security issue fixed: - CVE-2016-2183: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. (bsc#1027038) Moderate SUSE bug 1027038 CVE-2016-2183 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-3955: The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel allowed remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet (bnc#975945). - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bnc#986365). - CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel did not reset the PIT counter values during state restoration, which allowed guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions (bnc#960689). - CVE-2013-4312: The Linux kernel allowed local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c (bnc#839104). - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362). - CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572). - CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure was initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755). - CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213). - CVE-2016-1583: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling (bnc#983143). - CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandled NM (aka alternate name) entries containing \0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725). - CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267). - CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371). - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in the Linux kernel allowed local users to gain privileges via crafted ASN.1 data (bnc#979867). - CVE-2015-7833: The usbvision driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor (bnc#950998). - CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944). - CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401). - CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548). - CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762). - CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821). - CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879). - CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213). - CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822). - CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126). - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel did not properly determine the rate of challenge ACK segments, which made it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. (bsc#989152) - CVE-2016-6480: Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. (bsc#991608) The following non-security bugs were fixed: - Update patches.fixes/pci-determine-actual-vpd-size-on-first-access.patch (bsc#971729, bsc#974428). - Update PCI VPD size patch to upstream: * PCI: Determine actual VPD size on first access (bsc#971729). * PCI: Update VPD definitions (bsc#971729). (cherry picked from commit d2af5b7e0cd7ee2a54f02ad65ec300d16b3ad956) - Update patches.fixes/pci-update-vpd-definitions.patch (bsc#971729, bsc#974428). - cgroups: do not attach task to subsystem if migration failed (bnc#979274). - cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274). - fs/cifs: Fix cifs_uniqueid_to_ino_t() function for s390x (bsc#944309) - fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681) - hid: add ALWAYS_POLL quirk for a Logitech 0xc055 (bnc#962404). - hid: add HP OEM mouse to quirk ALWAYS_POLL (bsc#919351). - hid: add quirk for PIXART OEM mouse used by HP (bsc#919351). - hid-elo: kill not flush the work. - ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360). - ipv4: fix ineffective source address selection (bsc#980788). - ipvs: count pre-established TCP states as active (bsc#970114). - kabi, unix: properly account for FDs passed over unix sockets (bnc#839104). - mm/hugetlb.c: correct missing private flag clearing (VM Functionality, bnc#971446). - mm/hugetlb: fix backport of upstream commit 07443a85ad (VM Functionality, bnc#971446). - mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED (VM Functionality, bnc#986445). - nfs: Do not attempt to decode missing directory entries (bsc#980931). - nfs: fix memory corruption rooted in get_ih_name pointer math (bsc#984107). - nfs: reduce access cache shrinker locking (bnc#866130). - ppp: defer netns reference release for ppp channel (bsc#980371). - s390/cio: collect format 1 channel-path description data (bsc#966460,LTC#136434). - s390/cio: ensure consistent measurement state (bsc#966460,LTC#136434). - s390/cio: fix measurement characteristics memleak (bsc#966460,LTC#136434). - s390/cio: update measurement characteristics (bsc#966460,LTC#136434). - usbhid: add device USB_DEVICE_ID_LOGITECH_C077 (bsc#919351). - usbhid: more mice with ALWAYS_POLL (bsc#919351). - usbhid: yet another mouse with ALWAYS_POLL (bsc#919351). - veth: do not modify ip_summed (bsc#969149). - virtio_scsi: Implement eh_timed_out callback. - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065). - xfs: Avoid grabbing ilock when file size is not changed (bsc#983535). - xfs: avoid xfs_buf hang in lookup node directory corruption (bsc#989401). - xfs: only update the last_sync_lsn when a transaction completes (bsc#987709). Important SUSE bug 839104 SUSE bug 866130 SUSE bug 919351 SUSE bug 944309 SUSE bug 950998 SUSE bug 960689 SUSE bug 962404 SUSE bug 963655 SUSE bug 963762 SUSE bug 966460 SUSE bug 969149 SUSE bug 970114 SUSE bug 971126 SUSE bug 971360 SUSE bug 971446 SUSE bug 971729 SUSE bug 971944 SUSE bug 974428 SUSE bug 975945 SUSE bug 978401 SUSE bug 978821 SUSE bug 978822 SUSE bug 979213 SUSE bug 979274 SUSE bug 979548 SUSE bug 979681 SUSE bug 979867 SUSE bug 979879 SUSE bug 980371 SUSE bug 980725 SUSE bug 980788 SUSE bug 980931 SUSE bug 981267 SUSE bug 983143 SUSE bug 983213 SUSE bug 983535 SUSE bug 984107 SUSE bug 984755 SUSE bug 986362 SUSE bug 986365 SUSE bug 986445 SUSE bug 986572 SUSE bug 987709 SUSE bug 988065 SUSE bug 989152 SUSE bug 989401 SUSE bug 991608 CVE-2013-4312 CVE-2015-7513 CVE-2015-7833 CVE-2016-0758 CVE-2016-1583 CVE-2016-2053 CVE-2016-2187 CVE-2016-3134 CVE-2016-3955 CVE-2016-4470 CVE-2016-4482 CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4805 CVE-2016-4913 CVE-2016-4997 CVE-2016-5244 CVE-2016-5696 CVE-2016-5829 CVE-2016-6480 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP 3 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Important SUSE bug 1013533 SUSE bug 1013604 CVE-2016-9576 CVE-2016-9794 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following security bug: CVE-2017-2636: A race condition in the n_hdlc tty Linux kernel driver (drivers/tty/n_hdlc.c) could have been exploited to gain a local privilege escalation (bnc#1027565) Important SUSE bug 1027565 CVE-2017-2636 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654). - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015 (bnc#956707). - CVE-2015-7515: An out of bounds memory access in the aiptek USB driver could be used by physical local attackers to crash the kernel (bnc#956708). - CVE-2015-7550: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls (bnc#958951). - CVE-2015-7566: A malicious USB device could cause kernel crashes in the visor device driver (bnc#961512). - CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936). - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product (bnc#955354). - CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c (bnc#958463). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886). - CVE-2015-8550: Optimizations introduced by the compiler could have lead to double fetch vulnerabilities, potentially possibly leading to arbitrary code execution in backend (bsc#957988). (bsc#957988 XSA-155). - CVE-2015-8551: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks (bnc#957990). - CVE-2015-8552: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks (bnc#957990). - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel do not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8575: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959399). - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux kernel did not properly manage the relationship between a lock and a socket, which allowed local users to cause a denial of service (deadlock) via a crafted sctp_accept call (bnc#961509). - CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel allowed local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov (bnc#963765). - CVE-2015-8812: A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario.(bsc#966437). - CVE-2015-8816: A malicious USB device could cause kernel crashes in the in hub_activate() function (bnc#968010). - CVE-2016-0723: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). - CVE-2016-2069: A race in invalidating paging structures that were not in use locally could have lead to disclosoure of information or arbitrary code exectution (bnc#963767). - CVE-2016-2143: On zSeries a fork of a large process could have caused memory corruption due to incorrect page table handling. (bnc#970504, LTC#138810). - CVE-2016-2184: A malicious USB device could cause kernel crashes in the alsa usb-audio device driver (bsc#971125). - CVE-2016-2185: A malicious USB device could cause kernel crashes in the usb_driver_claim_interface function (bnc#971124). - CVE-2016-2186: A malicious USB device could cause kernel crashes in the powermate device driver (bnc#970958). - CVE-2016-2384: A double free on the ALSA umidi object was fixed. (bsc#966693). - CVE-2016-2543: A missing NULL check at remove_events ioctl in the ALSA seq driver was fixed. (bsc#967972). - CVE-2016-2544: Fix race at timer setup and close in the ALSA seq driver was fixed. (bsc#967973). - CVE-2016-2545: A double unlink of active_list in the ALSA timer driver was fixed. (bsc#967974). - CVE-2016-2546: A race among ALSA timer ioctls was fixed (bsc#967975). - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list handling was hardened against hangs and races. (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012). - CVE-2016-2549: A stall in ALSA hrtimer handling was fixed (bsc#968013). - CVE-2016-2782: A malicious USB device could cause kernel crashes in the visor device driver (bnc#968670). - CVE-2016-3137: A malicious USB device could cause kernel crashes in the cypress_m8 device driver (bnc#970970). - CVE-2016-3139: A malicious USB device could cause kernel crashes in the wacom device driver (bnc#970909). - CVE-2016-3140: A malicious USB device could cause kernel crashes in the digi_acceleport device driver (bnc#970892). - CVE-2016-3156: A quadratic algorithm could lead to long kernel ipv4 hangs when removing a device with a large number of addresses. (bsc#971360). - CVE-2016-3955: A remote buffer overflow in the usbip driver could be used by authenticated attackers to crash the kernel. (bsc#975945) - CVE-2016-2847: A local user could exhaust kernel memory by pushing lots of data into pipes. (bsc#970948). - CVE-2016-2188: A malicious USB device could cause kernel crashes in the iowarrior device driver (bnc#970956). - CVE-2016-3138: A malicious USB device could cause kernel crashes in the cdc-acm device driver (bnc#970911). The following non-security bugs were fixed: - af_unix: Guard against other == sk in unix_dgram_sendmsg (bsc#973570). - blktap: also call blkif_disconnect() when frontend switched to closed (bsc#952976). - blktap: refine mm tracking (bsc#952976). - cachefiles: Avoid deadlocks with fs freezing (bsc#935123). - cifs: Schedule on hard mount retry (bsc#941514). - cpuset: Fix potential deadlock w/ set_mems_allowed (bsc#960857, bsc#974646). - dcache: use IS_ROOT to decide where dentry is hashed (bsc#949752). - driver: Vmxnet3: Fix ethtool -S to return correct rx queue stats (bsc#950750). - drm/i915: Change semantics of hw_contexts_disabled (bsc#963276). - drm/i915: Evict CS TLBs between batches (bsc#758040). - drm/i915: Fix SRC_COPY width on 830/845g (bsc#758040). - e1000e: Do not read ICR in Other interrupt (bsc#924919). - e1000e: Do not write lsc to ics in msi-x mode (bsc#924919). - e1000e: Fix msi-x interrupt automask (bsc#924919). - e1000e: Remove unreachable code (bsc#924919). - ext3: fix data=journal fast mount/umount hang (bsc#942082). - ext3: NULL dereference in ext3_evict_inode() (bsc#942082). - firmware: Create directories for external firmware (bsc#959312). - firmware: Simplify directory creation (bsc#959312). - fs: Avoid deadlocks of fsync_bdev() and fs freezing (bsc#935123). - fs: Fix deadlocks between sync and fs freezing (bsc#935123). - ftdi_sio: private backport of TIOCMIWAIT (bnc#956375). - ipr: Fix incorrect trace indexing (bsc#940913). - ipr: Fix invalid array indexing for HRRQ (bsc#940913). - ipv6: make fib6 serial number per namespace (bsc#965319). - ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs (bsc#956852). - ipv6: per netns fib6 walkers (bsc#965319). - ipv6: per netns FIB garbage collection (bsc#965319). - ipv6: replace global gc_args with local variable (bsc#965319). - jbd: Fix unreclaimed pages after truncate in data=journal mode (bsc#961516). - kabi: protect struct netns_ipv6 after FIB6 GC series (bsc#965319). - kbuild: create directory for dir/file.o (bsc#959312). - kexec: Fix race between panic() and crash_kexec() called directly (bnc#937444). - lpfc: Fix null ndlp dereference in target_reset_handler (bsc#951392). - mld, igmp: Fix reserved tailroom calculation (bsc#956852). - mm-memcg-print-statistics-from-live-counters-fix (bnc#969307). - netfilter: xt_recent: fix namespace destroy path (bsc#879378). - nfs4: treat lock owners as opaque values (bnc#968141). - nfs: Fix handling of re-write-before-commit for mmapped NFS pages (bsc#964201). - nfs: use smaller allocations for 'struct id_map' (bsc#965923). - nfsv4: Fix two infinite loops in the mount code (bsc#954628). - nfsv4: Recovery of recalled read delegations is broken (bsc#956514). - panic/x86: Allow cpus to save registers even if they (bnc#940946). - panic/x86: Fix re-entrance problem due to panic on (bnc#937444). - pciback: do not allow MSI-X ops if PCI_COMMAND_MEMORY is not set. - pciback: for XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. - pciback: return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled. - pciback: return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled. - pci: Update VPD size with correct length (bsc#958906). - quota: Fix deadlock with suspend and quotas (bsc#935123). - rdma/ucma: Fix AB-BA deadlock (bsc#963998). - README.BRANCH: Switch to LTSS mode - Refresh patches.xen/xen3-08-x86-ldt-make-modify_ldt-synchronous.patch (bsc#959705). - Restore kabi after lock-owner change (bnc#968141). - s390/pageattr: Do a single TLB flush for change_page_attr (bsc#940413). - scsi_dh_rdac: always retry MODE SELECT on command lock violation (bsc#956949). - scsi: mpt2sas: Rearrange the the code so that the completion queues are initialized prior to sending the request to controller firmware (bsc#967863). - skb: Add inline helper for getting the skb end offset from head (bsc#956852). - sunrcp: restore fair scheduling to priority queues (bsc#955308). - sunrpc: refactor rpcauth_checkverf error returns (bsc#955673). - tcp: avoid order-1 allocations on wifi and tx path (bsc#956852). - tcp: fix skb_availroom() (bsc#956852). - tg3: 5715 does not link up when autoneg off (bsc#904035). - Update patches.fixes/mm-exclude-reserved-pages-from-dirtyable-memory-fix.patch (bnc#940017, bnc#949298, bnc#947128). - usb: ftdi_sio: fix race condition in TIOCMIWAIT, and abort of TIOCMIWAIT when the device is removed (bnc#956375). - usb: ftdi_sio: fix status line change handling for TIOCMIWAIT and TIOCGICOUNT (bnc#956375). - usb: ftdi_sio: fix tiocmget and tiocmset return values (bnc#956375). - usb: ftdi_sio: fix tiocmget indentation (bnc#956375). - usb: ftdi_sio: optimise chars_in_buffer (bnc#956375). - usb: ftdi_sio: refactor modem-control status retrieval (bnc#956375). - usb: ftdi_sio: remove unnecessary memset (bnc#956375). - usb: ftdi_sio: use ftdi_get_modem_status in chars_in_buffer (bnc#956375). - usb: ftdi_sio: use generic chars_in_buffer (bnc#956375). - usb: serial: export usb_serial_generic_chars_in_buffer (bnc#956375). - usb: serial: ftdi_sio: Add missing chars_in_buffer function (bnc#956375). - usbvision fix overflow of interfaces array (bnc#950998). - veth: extend device features (bsc#879381). - vfs: Provide function to get superblock and wait for it to thaw (bsc#935123). - vmxnet3: adjust ring sizes when interface is down (bsc#950750). - vmxnet3: fix building without CONFIG_PCI_MSI (bsc#958912). - vmxnet3: fix ethtool ring buffer size setting (bsc#950750). - vmxnet3: fix netpoll race condition (bsc#958912). - writeback: Skip writeback for frozen filesystem (bsc#935123). - x86/evtchn: make use of PHYSDEVOP_map_pirq. - x86, kvm: fix kvm's usage of kernel_fpu_begin/end() (bsc#961518). - x86, kvm: fix maintenance of guest/host xcr0 state (bsc#961518). - x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() (bsc#961518). - x86/mce: Fix return value of mce_chrdev_read() when erst is disabled (bsc#934787). - xen/panic/x86: Allow cpus to save registers even if they (bnc#940946). - xen/panic/x86: Fix re-entrance problem due to panic on (bnc#937444). - xen: x86: mm: drop TLB flush from ptep_set_access_flags (bsc#948330). - xen: x86: mm: only do a local tlb flush in ptep_set_access_flags() (bsc#948330). - xfrm: do not segment UFO packets (bsc#946122). - xhci: silence TD warning (bnc#939955). Important SUSE bug 758040 SUSE bug 781018 SUSE bug 879378 SUSE bug 879381 SUSE bug 904035 SUSE bug 924919 SUSE bug 934787 SUSE bug 935123 SUSE bug 937444 SUSE bug 939955 SUSE bug 940017 SUSE bug 940413 SUSE bug 940913 SUSE bug 940946 SUSE bug 941514 SUSE bug 942082 SUSE bug 946122 SUSE bug 947128 SUSE bug 948330 SUSE bug 949298 SUSE bug 949752 SUSE bug 949936 SUSE bug 950750 SUSE bug 950998 SUSE bug 951392 SUSE bug 952976 SUSE bug 954628 SUSE bug 955308 SUSE bug 955354 SUSE bug 955654 SUSE bug 955673 SUSE bug 956375 SUSE bug 956514 SUSE bug 956707 SUSE bug 956708 SUSE bug 956709 SUSE bug 956852 SUSE bug 956949 SUSE bug 957988 SUSE bug 957990 SUSE bug 958463 SUSE bug 958886 SUSE bug 958906 SUSE bug 958912 SUSE bug 958951 SUSE bug 959190 SUSE bug 959312 SUSE bug 959399 SUSE bug 959705 SUSE bug 960857 SUSE bug 961500 SUSE bug 961509 SUSE bug 961512 SUSE bug 961516 SUSE bug 961518 SUSE bug 963276 SUSE bug 963765 SUSE bug 963767 SUSE bug 963998 SUSE bug 964201 SUSE bug 965319 SUSE bug 965923 SUSE bug 966437 SUSE bug 966693 SUSE bug 967863 SUSE bug 967972 SUSE bug 967973 SUSE bug 967974 SUSE bug 967975 SUSE bug 968010 SUSE bug 968011 SUSE bug 968012 SUSE bug 968013 SUSE bug 968141 SUSE bug 968670 SUSE bug 969307 SUSE bug 970504 SUSE bug 970892 SUSE bug 970909 SUSE bug 970911 SUSE bug 970948 SUSE bug 970956 SUSE bug 970958 SUSE bug 970970 SUSE bug 971124 SUSE bug 971125 SUSE bug 971360 SUSE bug 973570 SUSE bug 974646 SUSE bug 975945 CVE-2013-7446 CVE-2015-7509 CVE-2015-7515 CVE-2015-7550 CVE-2015-7566 CVE-2015-7799 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8550 CVE-2015-8551 CVE-2015-8552 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2016-0723 CVE-2016-2069 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2782 CVE-2016-2847 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-3955 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to fix one security issue. This security bug was fixed: - CVE-2016-5195: Local privilege escalation using MAP_PRIVATE. It is reportedly exploited in the wild (bsc#1004418). Important SUSE bug 1004418 CVE-2016-5195 SUSE OpenStack Cloud 5 This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc#978395]. - CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040]. - CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041]. - CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108]. - CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109]. - CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral [bsc#981111]. - CVE-2016-1838: Fixed a heap-based buffer overread in xmlParserPrintFileContextInternal [bsc#981112]. - CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115]. - CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548]. - CVE-2016-4448: Fixed some format string warnings with possible format string vulnerability [bsc#981549], - CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550]. - CVE-2016-3705: Fixed missing increment of recursion counter. Important SUSE bug 963963 SUSE bug 965283 SUSE bug 978395 SUSE bug 981040 SUSE bug 981041 SUSE bug 981108 SUSE bug 981109 SUSE bug 981111 SUSE bug 981112 SUSE bug 981114 SUSE bug 981115 SUSE bug 981548 SUSE bug 981549 SUSE bug 981550 CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 CVE-2016-4483 SUSE OpenStack Cloud 5 The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that did not supply a key, related to the lrw_crypt function in crypto/lrw.c (bnc#1008374). - CVE-2017-5551: Clear S_ISGID on tmpfs when setting posix ACLs (bsc#1021258). - CVE-2016-7097: The filesystem implementation in the Linux kernel preserves the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (bnc#995968). - CVE-2016-10088: The sg implementation in the Linux kernel did not properly restrict write operations in situations where the KERNEL_DS option is set, which allowed local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576 (bnc#1017710). - CVE-2004-0230: TCP, when using a large Window Size, made it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP (bnc#969340). - CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831). - CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could have enabled a local malicious application to execute arbitrary code within the context of the kernel bnc#1014746). - CVE-2016-9793: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option (bnc#1013531). - CVE-2012-6704: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option (bnc#1013542). - CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux kernel did not properly initialize Code Segment (CS) in certain error cases, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application (bnc#1013038). - CVE-2016-3841: The IPv6 stack in the Linux kernel mishandled options data, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call (bnc#992566). - CVE-2016-9685: Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations (bnc#1012832). - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939). - CVE-2015-8962: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call (bnc#1010501). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacked chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bnc#1011685). - CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel allowed local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed (bnc#1010716). - CVE-2016-7911: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call (bnc#1010711). - CVE-2015-8964: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a tty data structure (bnc#1010507). - CVE-2016-7916: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete (bnc#1010467). - CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel allowed local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data (bnc#1010150). - CVE-2016-8633: drivers/firewire/net.c in the Linux kernel in certain unusual hardware configurations allowed remote attackers to execute arbitrary code via crafted fragmented packets (bnc#1008833). - CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in the Linux, when the GNU Compiler Collection (gcc) stack protector is enabled, used an incorrect buffer size for certain timeout data, which allowed local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file (bnc#1004517). - CVE-2015-8956: The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel allowed local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket (bnc#1003925). - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077). - CVE-2016-0823: The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel allowed local users to obtain sensitive physical-address information by reading a pagemap file (bnc#994759). - CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did not restrict a certain length field, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932). - CVE-2016-6828: The tcp_check_send_head function in include/net/tcp.h in the Linux kernel did not properly maintain certain SACK state after a failed data copy, which allowed local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option (bnc#994296). The following non-security bugs were fixed: - Always include the git commit in KOTD builds. This allows us not to set it explicitly in builds submitted to the official distribution (bnc#821612, bnc#824171). - KVM: x86: SYSENTER emulation is broken (bsc#994618). - NFS: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261). - NFS: Refresh open-owner id when server says SEQID is bad (bsc#989261). - NFSv4: Ensure that we do not drop a state owner more than once (bsc#979595). - NFSv4: add flock_owner to open context (bnc#998689). - NFSv4: change nfs4_do_setattr to take an open_context instead of a nfs4_state (bnc#998689). - NFSv4: change nfs4_select_rw_stateid to take a lock_context inplace of lock_owner (bnc#998689). - NFSv4: enhance nfs4_copy_lock_stateid to use a flock stateid if there is one (bnc#998689). - NFSv4: fix broken patch relating to v4 read delegations (bsc#956514, bsc#989261, bsc#979595). - SELinux: Fix possible NULL pointer dereference in selinux_inode_permission() (bsc#1012895). - USB: fix typo in wMaxPacketSize validation (bsc#991665). - USB: validate wMaxPacketValue entries in endpoint descriptors (bnc#991665). - Update patches.xen/xen3-auto-arch-x86.diff (bsc#929141, among others). - __ptrace_may_access() should not deny sub-threads (bsc#1012851). - apparmor: fix IRQ stack overflow during free_profile (bsc#1009875). - arch/powerpc: Remove duplicate/redundant Altivec entries (bsc#967716). - cdc-acm: added sanity checking for probe() (bsc#993891). - include/linux/math64.h: add div64_ul() (bsc#996329). - kabi-fix for flock_owner addition (bsc#998689). - kabi: get back scsi_device.current_cmnd (bsc#935436). - kaweth: fix firmware download (bsc#993890). - kaweth: fix oops upon failed memory allocation (bsc#993890). - kexec: add a kexec_crash_loaded() function (bsc#973691). - md linear: fix a race between linear_add() and linear_congested() (bsc#1018446). - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (bsc#1011820). - mpt3sas: Fix panic when aer correct error occurred (bsc#997708, bsc#999943). - mremap: enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma() (VM Functionality, bsc#1008645). - nfs4: reset states to use open_stateid when returning delegation voluntarily (bsc#1007944). - ocfs2: fix BUG_ON() in ocfs2_ci_checkpointed() (bnc#1019783). - posix-timers: Remove remaining uses of tasklist_lock (bnc#997401). - posix-timers: Use sighand lock instead of tasklist_lock for task clock sample (bnc#997401). - posix-timers: Use sighand lock instead of tasklist_lock on timer deletion (bnc#997401). - powerpc: Add ability to build little endian kernels (bsc#967716). - powerpc: Avoid load of static chain register when calling nested functions through a pointer on 64bit (bsc#967716). - powerpc: Do not build assembly files with ABIv2 (bsc#967716). - powerpc: Do not use ELFv2 ABI to build the kernel (bsc#967716). - powerpc: Fix 64 bit builds with binutils 2.24 (bsc#967716). - powerpc: Fix error when cross building TAGS and cscope (bsc#967716). - powerpc: Make the vdso32 also build big-endian (bsc#967716). - powerpc: Remove altivec fix for gcc versions before 4.0 (bsc#967716). - powerpc: Remove buggy 9-year-old test for binutils lower than 2.12.1 (bsc#967716). - powerpc: Require gcc 4.0 on 64-bit (bsc#967716). - powerpc: dtc is required to build dtb files (bsc#967716). - printk/sched: Introduce special printk_sched() for those awkward (bsc#1013042, bsc#996541, bsc#1015878). - qlcnic: Schedule napi directly in netpoll (bsc#966826). - reiserfs: fix race in prealloc discard (bsc#987576). - rpm/config.sh: Set a fitting release string (bsc#997059) - rpm/kernel-binary.spec.in: Export a make-stderr.log file (bsc#1012422) - rpm/mkspec: Read a default release string from rpm/config.sh (bsc997059) - s390/dasd: fix failfast for disconnected devices (bnc#961923, LTC#135138). - sched/core: Fix a race between try_to_wake_up() and a woken up task (bnc#1002165). - sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() (bnc#1001419). - sched: Fix possible divide by zero in avg_atom() calculation (bsc#996329). - scsi: lpfc: Set elsiocb contexts to NULL after freeing it (bsc#996557). - scsi: remove current_cmnd field from struct scsi_device (bsc#935436). - x86/MCE/intel: Cleanup CMCI storm logic (bsc#929141). - xfs: remove the deprecated nodelaylog option (bsc#992906). Important SUSE bug 1001419 SUSE bug 1002165 SUSE bug 1003077 SUSE bug 1003253 SUSE bug 1003925 SUSE bug 1004517 SUSE bug 1007944 SUSE bug 1008374 SUSE bug 1008645 SUSE bug 1008831 SUSE bug 1008833 SUSE bug 1008850 SUSE bug 1009875 SUSE bug 1010150 SUSE bug 1010467 SUSE bug 1010501 SUSE bug 1010507 SUSE bug 1010711 SUSE bug 1010713 SUSE bug 1010716 SUSE bug 1011685 SUSE bug 1011820 SUSE bug 1012183 SUSE bug 1012422 SUSE bug 1012832 SUSE bug 1012851 SUSE bug 1012852 SUSE bug 1012895 SUSE bug 1013038 SUSE bug 1013042 SUSE bug 1013531 SUSE bug 1013542 SUSE bug 1014454 SUSE bug 1014746 SUSE bug 1015878 SUSE bug 1017710 SUSE bug 1018446 SUSE bug 1019079 SUSE bug 1019783 SUSE bug 1021258 SUSE bug 821612 SUSE bug 824171 SUSE bug 914939 SUSE bug 929141 SUSE bug 935436 SUSE bug 956514 SUSE bug 961923 SUSE bug 966826 SUSE bug 967716 SUSE bug 969340 SUSE bug 973691 SUSE bug 979595 SUSE bug 987576 SUSE bug 989152 SUSE bug 989261 SUSE bug 991665 SUSE bug 992566 SUSE bug 992569 SUSE bug 992906 SUSE bug 992991 SUSE bug 993890 SUSE bug 993891 SUSE bug 994296 SUSE bug 994618 SUSE bug 994759 SUSE bug 995968 SUSE bug 996329 SUSE bug 996541 SUSE bug 996557 SUSE bug 997059 SUSE bug 997401 SUSE bug 997708 SUSE bug 998689 SUSE bug 999932 SUSE bug 999943 CVE-2004-0230 CVE-2012-6704 CVE-2015-1350 CVE-2015-8956 CVE-2015-8962 CVE-2015-8964 CVE-2015-8970 CVE-2016-0823 CVE-2016-10088 CVE-2016-3841 CVE-2016-6828 CVE-2016-7042 CVE-2016-7097 CVE-2016-7117 CVE-2016-7425 CVE-2016-7910 CVE-2016-7911 CVE-2016-7916 CVE-2016-8399 CVE-2016-8632 CVE-2016-8633 CVE-2016-8646 CVE-2016-9555 CVE-2016-9685 CVE-2016-9756 CVE-2016-9793 CVE-2017-5551 SUSE OpenStack Cloud 5 This update for MozillaFirefox, mozilla-nss fixes security issues and bugs. The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026 bsc#1012964): - CVE-2016-9079: Use-after-free in SVG Animation (MFSA 2016-92 bsc#1012964) - CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404) - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402) - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410) The following vulnerabilities were fixed in mozilla-nss 3.21.3: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422) - CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517) The following bugs were fixed: - Firefox would fail to go into fullscreen mode with some window managers (bsc#992549) - font warning messages would flood console, now using fontconfig configuration from firefox-fontconfig instead of the system one (bsc#1000751) Important SUSE bug 1000751 SUSE bug 1009026 SUSE bug 1010395 SUSE bug 1010401 SUSE bug 1010402 SUSE bug 1010404 SUSE bug 1010410 SUSE bug 1010422 SUSE bug 1010427 SUSE bug 1010517 SUSE bug 1012964 SUSE bug 992549 CVE-2016-5285 CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9064 CVE-2016-9066 CVE-2016-9074 CVE-2016-9079 SUSE OpenStack Cloud 5 The MongoDB database did validate BSON incorrectly, which could have lead to remote attackers being able to crash the database before authentication. (CVE-2015-1609) Security Issues: * CVE-2015-1609 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1609> SUSE bug 921759 CVE-2015-1609 SUSE OpenStack Cloud 5 This mysql update to verson 5.5.52 fixes the following issues: Security issues fixed: - CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser (bsc#989913). - CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types (bsc#989919). - CVE-2016-3615: Fixed unspecified vulnerability in subcomponent dml (bsc#989922). - CVE-2016-5440: Fixed unspecified vulnerability in subcomponent rbr (bsc#989926). - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql (or even root) user. (bsc#998309) More details can be found on: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html Bugs fixed: - bsc#967374: properly restart mysql multi instances during upgrade - bnc#937258: multi script to restart after crash Important SUSE bug 937258 SUSE bug 967374 SUSE bug 989913 SUSE bug 989919 SUSE bug 989922 SUSE bug 989926 SUSE bug 998309 CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 CVE-2016-6662 SUSE OpenStack Cloud 5 This mysql version update to 5.5.54 fixes the following issues: - CVE-2017-3318: Unspecified vulnerability affecting Error Handling (bsc#1020896) - CVE-2017-3317: Unspecified vulnerability affecting Logging (bsc#1020894) - CVE-2017-3313: Unspecified vulnerability affecting the MyISAM component (bsc#1020890) - CVE-2017-3312: Insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873) - CVE-2017-3291: Unrestricted mysqld_safe's ledir (bsc#1020884) - CVE-2017-3265: Unsafe chmod/chown use in init script (bsc#1020885) - CVE-2017-3258: Unspecified vulnerability in the DDL component (bsc#1020875) - CVE-2017-3244: Unspecified vulnerability affecing the DML component (bsc#1020877) - CVE-2017-3243: Unspecified vulnerability affecting the Charsets component (bsc#1020891) - CVE-2017-3238: Unspecified vulnerability affecting the Optimizer component (bsc#1020882) - Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428) Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html Important SUSE bug 1020868 SUSE bug 1020873 SUSE bug 1020875 SUSE bug 1020877 SUSE bug 1020882 SUSE bug 1020884 SUSE bug 1020885 SUSE bug 1020890 SUSE bug 1020891 SUSE bug 1020894 SUSE bug 1020896 SUSE bug 1022428 CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 SUSE OpenStack Cloud 5 This update provides security fixes and improvements for openstack-neutron and crowbar-barclamp-neutron. crowbar-barclamp-neutron: - Add infoblox support. - Add configurations required to support DHCP relay. - Create "floating" network as "flat" provider network. (bsc#946882) - Fix search for Nova instance. openstack-neutron: - Fix usage_audit to work with ML2. - Fix UDP offloading issue with virtio VMs. (bsc#948704) - Fix ipset can't be destroyed when last rule is deleted. - Add ARP spoofing protection for LinuxBridge agent. - Don't use ARP responder for IPv6 addresses in ovs. - Stop device_owner from being set to 'network:*'. (bsc#943648, CVE-2015-5240) Low SUSE bug 935263 SUSE bug 939691 SUSE bug 943648 SUSE bug 946882 SUSE bug 948704 CVE-2015-3221 CVE-2015-5240 SUSE OpenStack Cloud 5 novnc was updated to fix a session hijacking problem through insecurely set session token cookies (bnc#922233, CVE-2013-7436). Security Issues: * CVE-2013-7436 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7436> SUSE bug 922233 CVE-2013-7436 SUSE OpenStack Cloud 5 This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues: Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) Major functional changes: - The "sntp" commandline tool changed its option handling in a major way. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. - The local clock is being disabled during update. - ntpd is no longer running chrooted. Other functional changes: - ntp-signd is installed. - "enable mode7" can be added to the configuration to allow ntdpc to work as compatibility mode option. - "kod" was removed from the default restrictions. - SHA1 keys are used by default instead of MD5 keys. These security issues were fixed: - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608). - CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608). - CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608). - CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608). - CVE-2015-7850: remote config logfile-keyfile (bsc#951608). - CVE-2015-7849: trusted key use-after-free (bsc#951608). - CVE-2015-7848: mode 7 loop counter underrun (bsc#951608). - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608). - CVE-2015-7703: configuration directives "pidfile" and "driftfile" should only be allowed locally (bsc#951608). - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608). - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq. - bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution. - bsc#905885: Use SHA1 instead of MD5 for symmetric keys. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - Fix legacy action scripts to pass on command line arguments. - bsc#944300: Remove "kod" from the restrict line in ntp.conf. - bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd. - Don't let "keysdir" lines in ntp.conf trigger the "keys" parser. - Disable mode 7 (ntpdc) again, now that we don't use it anymore. - Add "addserver" as a new legacy action. - bsc#910063: Fix the comment regarding addserver in ntp.conf. - bsc#926510: Disable chroot by default. - bsc#920238: Enable ntpdc for backwards compatibility. - bsc#784760: Remove local clock from default configuration. - bsc#942441/fate#319496: Require perl-Socket6. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - bsc#920183: Allow -4 and -6 address qualifiers in "server" directives. - Use upstream ntp-wait, because our version is incompatible with the new ntpq command line syntax. Important SUSE bug 782060 SUSE bug 784760 SUSE bug 905885 SUSE bug 910063 SUSE bug 916617 SUSE bug 920183 SUSE bug 920238 SUSE bug 926510 SUSE bug 936327 SUSE bug 937837 SUSE bug 942441 SUSE bug 942587 SUSE bug 943216 SUSE bug 943218 SUSE bug 944300 SUSE bug 946386 SUSE bug 951351 SUSE bug 951559 SUSE bug 951608 SUSE bug 951629 SUSE bug 954982 SUSE bug 956773 SUSE bug 962318 SUSE bug 962784 SUSE bug 962802 SUSE bug 962960 SUSE bug 962966 SUSE bug 962970 SUSE bug 962988 SUSE bug 962994 SUSE bug 962995 SUSE bug 962997 SUSE bug 963000 SUSE bug 963002 SUSE bug 975496 SUSE bug 975981 CVE-2015-5194 CVE-2015-5219 CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 SUSE OpenStack Cloud 5 This update for ntp fixes the following issues: - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". - Update to 4.2.8p7 (bsc#977446): * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * integrate ntp-fork.patch * Improve the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). Important SUSE bug 957226 SUSE bug 977446 SUSE bug 977450 SUSE bug 977451 SUSE bug 977452 SUSE bug 977455 SUSE bug 977457 SUSE bug 977458 SUSE bug 977459 SUSE bug 977461 SUSE bug 977464 CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 SUSE OpenStack Cloud 5 ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - Keep the parent process alive until the daemon has finished initialisation, to make sure that the PID file exists when the parent returns. - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). Important SUSE bug 979302 SUSE bug 981422 SUSE bug 982056 SUSE bug 982064 SUSE bug 982065 SUSE bug 982066 SUSE bug 982067 SUSE bug 982068 CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 SUSE OpenStack Cloud 5 This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: Null pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-8140: ntpq vulnerable to replay attacks. - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed: - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in "trap" (bsc#981252). - Reduce the number of netlink groups to listen on for changes to the local network setup (bsc#992606). - Fix segfault in "sntp -a" (bsc#1009434). - Silence an OpenSSL version warning (bsc#992038). - Make the resolver task change user and group IDs to the same values as the main task. (bsc#988028) - Simplify ntpd's search for its own executable to prevent AppArmor warnings (bsc#956365). Moderate SUSE bug 1009434 SUSE bug 1011377 SUSE bug 1011390 SUSE bug 1011395 SUSE bug 1011398 SUSE bug 1011404 SUSE bug 1011406 SUSE bug 1011411 SUSE bug 1011417 SUSE bug 943216 SUSE bug 956365 SUSE bug 981252 SUSE bug 988028 SUSE bug 992038 SUSE bug 992606 CVE-2015-5219 CVE-2015-8139 CVE-2015-8140 CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 SUSE OpenStack Cloud 5 This update for OpenSSH fixes the following issues: - Prevent user enumeration through the timing of password processing. (bsc#989363, CVE-2016-6210) - Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. (bsc#948902) - Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115) - Prevent X11 SECURITY circumvention when forwarding X11 connections. (bsc#962313, CVE-2016-1908) - Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902) - Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325) - Limit the accepted password length (prevents a possible denial of service). (bsc#992533, CVE-2016-6515) - Relax version requires for the openssh-askpass sub-package. (bsc#962794) - Avoid complaining about unset DISPLAY variable. (bsc#981654) - Initialize message id to prevent connection breakups in some cases. (bsc#959096) Moderate SUSE bug 932483 SUSE bug 948902 SUSE bug 959096 SUSE bug 962313 SUSE bug 962794 SUSE bug 970632 SUSE bug 975865 SUSE bug 981654 SUSE bug 989363 SUSE bug 992533 CVE-2015-8325 CVE-2016-1908 CVE-2016-3115 CVE-2016-6210 CVE-2016-6515 SUSE OpenStack Cloud 5 This update for openssh fixes the following issues: Security issues fixed: - CVE-2016-8858: prevent resource depletion during key exchange (bsc#1005480) - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation (bsc#1016366) - CVE-2016-10011: Prevent possible leaks of host private keys to low-privilege process handling authentication (bsc#1016369) Non security issues fixed: - Properly verify CIDR masks in the AllowUsers and DenyUsers configuration lists (bsc#1005893) Moderate SUSE bug 1005480 SUSE bug 1005893 SUSE bug 1016366 SUSE bug 1016369 CVE-2016-10009 CVE-2016-10011 CVE-2016-8858 SUSE OpenStack Cloud 5 This update for openssl fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also fixes the following bug: - Avoid running OPENSSL_config twice. This avoids breaking engine loading and also fixes a memory leak in libssl. (bsc#952871 bsc#967787) Important SUSE bug 952871 SUSE bug 963415 SUSE bug 967787 SUSE bug 968046 SUSE bug 968047 SUSE bug 968048 SUSE bug 968051 SUSE bug 968053 SUSE bug 968374 CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0705 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 SUSE OpenStack Cloud 5 This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) Bugs fixed: - fate#320304: build 32bit devel package - bsc#976943: Fix buffer overrun in ASN1_parse - bsc#973223: allow weak DH groups, vulnerable to the logjam attack, when environment variable OPENSSL_ALLOW_LOGJAM_ATTACK is set - bsc#889013: Rename README.SuSE to the new spelling Important SUSE bug 889013 SUSE bug 968050 SUSE bug 976942 SUSE bug 976943 SUSE bug 977614 SUSE bug 977615 SUSE bug 977617 CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 SUSE OpenStack Cloud 5 This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * Update expired S/MIME certs (bsc#979475) * Fix crash in print_notice (bsc#998190) * Resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Important SUSE bug 979475 SUSE bug 982575 SUSE bug 983249 SUSE bug 993819 SUSE bug 994749 SUSE bug 994844 SUSE bug 995075 SUSE bug 995324 SUSE bug 995359 SUSE bug 995377 SUSE bug 998190 SUSE bug 999665 SUSE bug 999666 SUSE bug 999668 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 SUSE OpenStack Cloud 5 This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - don't attempt session resumption if no ticket is present and session ID length is zero (bsc#984663) Moderate SUSE bug 1000677 SUSE bug 1001912 SUSE bug 1004499 SUSE bug 1005878 SUSE bug 1019334 SUSE bug 1021641 SUSE bug 984663 CVE-2016-2108 CVE-2016-7056 CVE-2016-8610 SUSE OpenStack Cloud 5 This update provides the following fixes provided from the upstream OpenStack-project: - openstack-suse: + do not copy upstream python requirements to the package, we rely on Requires; upstream requirements.txt introduce version caps which we do not follow (bnc#920573) - openstack-sahara: + Fix getting heat stack in Sahara + Fixed scaling with new node group with auto sg + Open all ports for private network for auto SG + Fix for getting auth url for hadoop-swift + Fixed auto security group cleanup in case of creation error + Add list of open ports for Cloudera plugin + Add missed files for migrations in MANIFEST.in + Include launch_command.py in MANIFEST.in + Fix requires - openstack-keystone: + Updated hybrid backend to include fix for bsc#935892 + Deal with PEP-0476 certificate chaining checking + Backport fixes for v3 API sample policy file (lp#1381809 and lp#1392155). + Install v3 sample policy into the doc directory + Update hybrid backend to include latest fixes for v3 protocol (bsc#928718) + backend_argument should be marked secret + Work with pymongo 3.0 + Speed up memcache lock + Fix up _ldap_res_to_model for ldap identity backend + Don't try to convert LDAP attributes to boolean + Fix the wrong update logic of catalog kvs driver + Do parameter check before updating endpoint_group + Correct initialization order for logging to use eventlet locks + Fix the syntax issue on creating table `endpoint_group` - openstack-heat: + Add env storing for loaded environments + Fix block_device_mapping property validation when using get_attr + Add default_client_name in Nova::FloatingIPAssoc + Fix cloud-init Python syntax for Python < 2.6 + Allow lists and strings for Json parameters via provider resources + RandomString physical_resource_id as id not the string + Authenticate the domain user with id instead of username + Tell stevedore not to force verify requirements + Use properties.data when testing for "provided by the user" + Ship /usr/lib/heat directory in openstack-heat-engine subpackage, since that's where plugin are loaded from. + Create openstack-heat-plugin-heat_docker subpackage to ship the heat_docker plugin. + Fix update on failed stack + Enable https for keystone while creating stack user + Change the engine-listener topic + Just to delete the stack when adopt rollback + Release stack lock when successfully acquire + Add dependency on Router External Gateway property + Use only FIP dependencies from graph + Add dependency hidden on router_interface + Update heat.conf.sample + Upgrade requirements for kombu and greenlet to Juno versions (bnc#920573) + Stop patching oslo.messaging private bits - openstack-glance: + Eventlet green threads not released back to pool + Replace assert statements with proper control-flow + Fix intermittent unit test failures + Initiate deletion of image files if the import was interrupted to prevent denial of service (bnc#918784, CVE-2014-9684) - openstack-cinder: + Remove nonexistent LIO terminate_connection call + Disallow backing files when uploading volumes to image + LVM: Pass volume size in MiB to copy_volume() during volume migration + Remove iscsi_helper calls from base iscsi driver + Fix exceptions logging in iSCSI targets + Delete the temporary volume if migration fails + Get the 'consumer' in a correct way for retyping with qos-specs + Fix re-export of iscsi volume when using lioadm + Revert "Add support for customized cluster name" + Failed to discovery when iscsi multipath and CHAP both enabled + Add support for customized cluster name + Only use operational LIFs for iscsi target details + Clear migration_status from a destination volume if migration fails + Deal with PEP-0476 certificate chaining checking - openstack-ceilometer: + Ensure unique list of consumers created + Add bandwidth to measurements + Rely on VM UUID to fetch metrics in libvirt + Retry to connect database when DB2 or mongodb is restarted + Use alarm's evaluation periods in sufficient test + [MongoDB] Fix bug with reconnection to new master node + Fix the value of query_spec.maxSample to advoid to be zero + Fix issue when ceilometer-expirer is called from the wrong user via cronjob and the resulting logs end up having wrong ownership. See also bsc#930574 + Metering data ttl sql backend breaks resource metadata + Stop mocking os.path in test_setup_events_default_config + Move the cron job to collector package (bnc#926596) + Catch exception when evaluate single alarm - python-oslo.utils: + Update to version 1.4.0 * Add a stopwatch + split for duration(s) * Allow providing a logger to save_and_reraise_exception * Utility API to generate EUI-64 IPv6 address * Add a eventlet utils helper module * Add microsecond support to iso8601_from_timestamp * Update Oslo imports to remove namespace package * Add TimeFixture * Add microsecond support to timeutils.utcnow_ts() - python-oslo.i18n: + Update to version 1.3.1 * Remove deprecation warning (bnc#931204) * Correct the translation domain for loading messages * Workflow documentation is now in infra-manual * Imported Translations from Transifex * Activate pep8 check that _ is imported * Make clear in docs to use _LE() when using LOG.exception() * Support building wheels (PEP-427) - python-six: + Update to version 1.9.0 * Support the `flush` parameter to `six.print_`. * Add the `python_2_unicode_compatible` decorator. * Ensure `six.wraps` respects the *updated* and *assigned* arguments. * Fix `six.moves` race condition in multi-threaded code. * Add `six.view(keys|values|itmes)`, which provide dictionary views on Python 2.7+. * Fix add_metaclass when the class has __slots__ containing "__weakref__" or "__dict__". * Always accept *updated* and *assigned* arguments for wraps(). * Fix import six on Python 3.4 with a custom loader. Low SUSE bug 918784 SUSE bug 920573 SUSE bug 926596 SUSE bug 928718 SUSE bug 930574 SUSE bug 931204 SUSE bug 935892 CVE-2014-9684 SUSE OpenStack Cloud 5 This update provides fixes and enhancements for openstack-dashboard, crowbar-barclamp-nova_dashboard and python-django_openstack_auth. openstack-dashboard: - Reset flavors for other than "Boot from Image" source type. (bsc#945515) - Add deactivated status for glance image. - Fix TemplateSyntaxError at hypervisors view. - Fix addition of plugin panel to panel group. - Remove admin role name 'admin' hardcode. (bsc#935442) - Escape the description param from heat template. (bsc#933722, CVE-2015-3219) - Enhance policy rules to workflow actions and identity project. - Sanitation of metadata passed from Django to avoid persistent XSS. (bsc#931437, CVE-2015-3988) - Fix Terminate Instance on network topology page. - Show ports from shared nets in floating IP assoc. - Fix incorrect ca arguments for calling ceilometer client. - Fix dynamic select layout when help block is displayed. - Pass correct project ID to get tenant_usages. (bsc#928891) crowbar-barclamp-nova_dashboard: - Allow switching on multidomain support. (bsc#945052) - Fix quoting of supported_provider_types. (bsc#936368) - Enable the POLICY_FILES setting configuration. - Fix attribute being fetched from wrong node. (bsc#936059) python-django_openstack_auth: - Remove admin role name 'admin' hardcode in User.is_superuser(). Moderate SUSE bug 928891 SUSE bug 931437 SUSE bug 933607 SUSE bug 933722 SUSE bug 935442 SUSE bug 936059 SUSE bug 936368 SUSE bug 945052 SUSE bug 945515 CVE-2015-3219 CVE-2015-3988 SUSE OpenStack Cloud 5 This update for openstack-glance provides the following fixes: - Catch NotAuthenticated exception in import task. (bsc#947735, CVE-2015-5286) - Cleanup chunks for deleted image if token expired. (bsc#947735, CVE-2015-5286) - Prevent image status being directly modified via v1. (bsc#945994, CVE-2015-5251) - Fix error when downloading image status is not active. (bsc#945051) - Add ability to deactivate an image. Moderate SUSE bug 945051 SUSE bug 945994 SUSE bug 947735 CVE-2015-5251 CVE-2015-5286 SUSE OpenStack Cloud 5 This update for openstack-keystone, openstack-nova, and openstack-swift fixes the following issues: - Fix hybrid backend from keystone v3 (bsc#967356) - Fix cleanup when block migration fails (bsc#960015) - Avoid host data leak (bsc#960601, CVE-2015-7548) - Fix init script for openstack-swift-object-expirer - Mark backend_argument as secret (bsc#929628, CVE-2015-3646) Moderate SUSE bug 929628 SUSE bug 960015 SUSE bug 960601 SUSE bug 967356 CVE-2015-3646 CVE-2015-7548 SUSE OpenStack Cloud 5 This update for openstack-nova provides various fixes and improvements: - Fix regression where launched instances in tenants not visible for other users. (bsc#927625) - Remove error messages from multipath command output before parsing. (bsc#949529) - Fix live-migration usage of the wrong connector information. - Added requirement for memcached to python-nova. (bsc#942457) - Don't expect meta attributes in object_compat that aren't in the db obj. (bsc#949070, CVE-2015-7713) - Delete orphaned instance files from compute nodes (bsc#944178, CVE-2015-3280) - Kill rsync/scp processes before deleting instance. (bsc#935017, CVE-2015-3241) - Sync process utils from oslo for execute callbacks. (bsc#935017, CVE-2015-3241) - Fix rebuild of an instance with a volume attached. - Fixes _cleanup_rbd code to capture ImageBusy exception. - Don't try to confine a non-NUMA instance. - Include blank volumes in the block device mapping (bsc#945923) Moderate SUSE bug 927625 SUSE bug 935017 SUSE bug 942457 SUSE bug 944178 SUSE bug 945923 SUSE bug 949070 SUSE bug 949529 CVE-2015-3241 CVE-2015-3280 CVE-2015-7713 SUSE OpenStack Cloud 5 openstack-swift was updated to fix three security issues. These security issues were fixed: - CVE-2015-1856: OpenStack Object Storage (Swift), when allow_version is configured, allowed remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container (bsc#927793). - CVE-2014-7960: OpenStack Object Storage (Swift) allowed remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined (bsc#900253). - CVE-2015-5223: Information leak via Swift tempurls (bsc#942641). Important SUSE bug 900253 SUSE bug 927793 SUSE bug 942641 CVE-2014-7960 CVE-2015-1856 CVE-2015-5223 SUSE OpenStack Cloud 5 This update for openstack-trove fixes the following issues: - Fix multiple insecure /tmp file usage issues (bsc#929535, CVE-2015-3156). Low SUSE bug 929535 CVE-2015-3156 SUSE OpenStack Cloud 5 This update for php53 fixes the following issues: - CVE-2016-5093: A get_icu_value_internal out-of-bounds read could crash the php interpreter (bsc#982010) - CVE-2016-5094,CVE-2016-5095: Don't allow creating strings with lengths outside int range, avoids overflows (bsc#982011,bsc#982012) - CVE-2016-5096: A int/size_t confusion in fread could corrupt memory (bsc#982013) - CVE-2016-5114: A fpm_log.c memory leak and buffer overflow could leak information out of the php process or overwrite a buffer by 1 byte (bsc#982162) - CVE-2016-4346: A heap overflow was fixed in ext/standard/string.c (bsc#977994) - CVE-2016-4342: A heap corruption was fixed in tar/zip/phar parser (bsc#977991) - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative scale causing heap buffer overflow corrupting _one_ definition (bsc#978827) - CVE-2016-4539: Malformed input causes segmentation fault in xml_parse_into_struct() function (bsc#978828) - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read in zif_grapheme_stripos when given negative offset (bsc#978829) - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544: Out-of-bounds heap memory read in exif_read_data() caused by malformed input (bsc#978830) - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function (bsc#980366) - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c (bsc#980373) - CVE-2015-8874: Stack consumption vulnerability in GD (bsc#980375) - CVE-2015-8879: odbc_bindcols function in ext/odbc/php_odbc.c mishandles driver behavior for SQL_WVARCHAR (bsc#981050) Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] - CVE-2015-7803: A Stack overflow vulnerability when decompressing tar phar archives could potentially lead to code execution. [bsc#949961] - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) Important SUSE bug 949961 SUSE bug 968284 SUSE bug 969821 SUSE bug 971611 SUSE bug 971612 SUSE bug 971912 SUSE bug 973351 SUSE bug 973792 SUSE bug 976996 SUSE bug 976997 SUSE bug 977003 SUSE bug 977005 SUSE bug 977991 SUSE bug 977994 SUSE bug 978827 SUSE bug 978828 SUSE bug 978829 SUSE bug 978830 SUSE bug 980366 SUSE bug 980373 SUSE bug 980375 SUSE bug 981050 SUSE bug 982010 SUSE bug 982011 SUSE bug 982012 SUSE bug 982013 SUSE bug 982162 CVE-2014-9767 CVE-2015-4116 CVE-2015-7803 CVE-2015-8835 CVE-2015-8838 CVE-2015-8866 CVE-2015-8867 CVE-2015-8873 CVE-2015-8874 CVE-2015-8879 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 CVE-2016-4070 CVE-2016-4073 CVE-2016-4342 CVE-2016-4346 CVE-2016-4537 CVE-2016-4538 CVE-2016-4539 CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 CVE-2016-5114 SUSE OpenStack Cloud 5 This update for php53 fixes the following security issues: * CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization * CVE-2016-7125: PHP Session Data Injection Vulnerability * CVE-2016-7126: select_colors write out-of-bounds * CVE-2016-7127: imagegammacorrect allowed arbitrary write access * CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF * CVE-2016-7129: wddx_deserialize allows illegal memory access * CVE-2016-7130: wddx_deserialize null dereference * CVE-2016-7131: wddx_deserialize null dereference with invalid xml * CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element Important SUSE bug 997206 SUSE bug 997207 SUSE bug 997208 SUSE bug 997210 SUSE bug 997211 SUSE bug 997220 SUSE bug 997225 SUSE bug 997230 SUSE bug 997257 SUSE bug 999679 SUSE bug 999680 SUSE bug 999682 SUSE bug 999684 SUSE bug 999685 SUSE bug 999819 SUSE bug 999820 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 SUSE OpenStack Cloud 5 This update for php53 fixes the following security issues: - CVE-2016-7478: When unserializing untrusted input data, PHP could end up in an infinite loop, causing denial of service (bsc#1019550) - CVE-2016-10158: The exif_convert_any_to_int function in ext/exif/exif.c in PHP allowed remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1. (bsc#1022219) - CVE-2016-10159: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive. (bsc#1022255) - CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch. (bsc#1022257) - CVE-2016-10161: The object_common1 function in ext/standard/var_unserializer.c in PHP allowed remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. (bsc#1022260) - CVE-2016-10166: A potential unsigned underflow in gd interpolation functions could lead to memory corruption in the PHP gd module (bsc#1022263) - CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx() could lead to php out of memory even on small files. (bsc#1022264) - CVE-2016-10168: A signed integer overflow in the gd module could lead to memory corruption (bsc#1022265) Important SUSE bug 1019550 SUSE bug 1022219 SUSE bug 1022255 SUSE bug 1022257 SUSE bug 1022260 SUSE bug 1022263 SUSE bug 1022264 SUSE bug 1022265 CVE-2016-10158 CVE-2016-10159 CVE-2016-10160 CVE-2016-10161 CVE-2016-10166 CVE-2016-10167 CVE-2016-10168 CVE-2016-7478 SUSE OpenStack Cloud 5 python-Django has been updated to fix two vulnerabilities: * URLs starting with control characters could have allowed XSS (cross-site-scripting) attacks via user-supplied redirect URLs (CVE-2015-2317) * An infinite loop possibility could be triggered in the strip_tags() function, which allowed denial of service attacks (CVE-2015-2316) Security Issues: * CVE-2015-2316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2316> * CVE-2015-2317 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2317> SUSE bug 923172 SUSE bug 923176 CVE-2015-2316 CVE-2015-2317 SUSE OpenStack Cloud 5 This update for python-Django fixes the following security issues: - Prevent Denial-of-service possibility by filling session store. (bsc#937522, CVE-2015-5143) - Prevent Header injection possibility. (bsc#937523, CVE-2015-5144) - A remote denial of service (resource exhaustion) attack against the django session store was fixed in Python Django. This might have allowed remote attackers to exhaust existing web sessions. (bsc#941587, CVE-2015-5963) Moderate SUSE bug 937522 SUSE bug 937523 SUSE bug 941587 CVE-2015-5143 CVE-2015-5144 CVE-2015-5963 SUSE OpenStack Cloud 5 This update for python-Django fixes the following issues: - Prevent settings leak in date template filter. (bsc#955412, CVE-2015-8213) Moderate SUSE bug 955412 CVE-2015-8213 SUSE OpenStack Cloud 5 python-pillow has been updated to 2.7.0 to fix three security issues. The following vulnerabilities have been fixed: * CVE-2014-9601: Remote attackers could have caused a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. * CVE-2014-3598: Remote attackers could have caused a denial of service using specially crafted image files via Jpeg2KImagePlugin. * CVE-2014-3589: Remote attackers could have caused a denial of service using specially crafted image files via IcnsImagePlugin. * CVE-2014-1932: A local user could have overwritten arbitrary files and obtain sensitive information via a symlink attack on the temporary file. * CVE-2014-1933: A local user could have gained information helpful for symlink attacks by listing process information which uses the names of temporary files on the command line. Security Issues: * CVE-2014-9601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601> * CVE-2014-3598 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598> * CVE-2014-3589 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589> * CVE-2014-1932 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932> * CVE-2014-1933 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933> SUSE bug 921566 CVE-2014-1932 CVE-2014-1933 CVE-2014-3589 CVE-2014-3598 CVE-2014-9601 SUSE OpenStack Cloud 5 This update for python-Pillow fixes the following security issues: * Fixed an integer overflow in Resample.c causing writes in the Python heap. * Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files. CVE-2016-TBD * Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. CVE-2016-0775 (fixes bsc#965582) * Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. CVE-2016-0740 (fixes bsc#965579) Moderate SUSE bug 965579 SUSE bug 965582 CVE-2016-0740 CVE-2016-0775 SUSE OpenStack Cloud 5 python-PyYAML was updated to fix one security issue which could have allowed an attacker to cause a denial of service by supplying specially crafted strings. (CVE-2014-9130, bsc#921588) Security Issues: * CVE-2014-9130 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9130> SUSE bug 921588 CVE-2014-9130 SUSE OpenStack Cloud 5 This update provides the following fixes for various python-modules: - python-openstackclient: + Fix image create location attribute (bnc#932270) - python-novaclient: + Update novaclient shell to use shared arguments from Session + Support using the Keystone V3 API from the Nova CLI - python-keystoneclient: + Fix s3_token middleware parsing insecure option (bsc#928205, CVE-2015-1852) - python-glanceclient: + remove deprecation warning Low SUSE bug 928205 SUSE bug 932270 SUSE bug 933758 CVE-2015-1852 SUSE OpenStack Cloud 5 python-requests was updated to fix one security issue. This security issue was fixed: - CVE-2015-2296: The resolve_redirects function in sessions.py allowed remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. (bsc#922448) This non-security issue was fixed: - Don't use the hardcoded path for certificates. (bsc#935252) Moderate SUSE bug 922448 SUSE bug 935252 CVE-2015-2296 SUSE OpenStack Cloud 5 This update for rubygem-sprockets-2_11 provides the following security fix: * Arbitrary file existence disclosure (bnc#903658, CVE-2014-7819) Security Issues: * CVE-2014-7819 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819> SUSE bug 903658 SUSE bug 926549 CVE-2014-7819 SUSE OpenStack Cloud 5 This update for rubygem-actionpack-4_1 fixes the following issues: - CVE-2016-0751: Object Leak DoS (bsc#963331) - CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335) - CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332) - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329) Moderate SUSE bug 963329 SUSE bug 963331 SUSE bug 963332 SUSE bug 963335 CVE-2015-7576 CVE-2015-7581 CVE-2016-0751 CVE-2016-0752 SUSE OpenStack Cloud 5 This update for rubygem-actionview-4_1 fixes the following issues: - CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332) Moderate SUSE bug 963332 CVE-2016-0752 SUSE OpenStack Cloud 5 This update for rubygem-actionview-4_1 fixes the following issues: - CVE-2016-2097: rubygem-actionview: Possible Information Leak Vulnerability in Action View. (bsc#968850) - CVE-2016-2098: rubygem-actionpack: Possible remote code execution vulnerability in Action Pack (bsc#968849) Important SUSE bug 968849 SUSE bug 968850 CVE-2016-2097 CVE-2016-2098 SUSE OpenStack Cloud 5 This update for rubygem-activemodel-4_1 fixes the following issues: - CVE-2016-0753: Input Validation Circumvention (bsc#963334) Moderate SUSE bug 963334 CVE-2016-0753 SUSE OpenStack Cloud 5 This update for rubygem-activerecord-4_1 fixes the following issues: - CVE-2016-0753: Input Validation Circumvention (bsc#963334) - CVE-2015-7577: Nested attributes rejection proc bypass (bsc#963330) Moderate SUSE bug 963330 SUSE bug 963334 CVE-2015-7577 CVE-2016-0753 SUSE OpenStack Cloud 5 This update fixes the following security issues: - CVE-2015-3227: Possible Denial of Service attack in Active Support (bnc#934800) - CVE-2015-3226: XSS Vulnerability in ActiveSupport::JSON (bnc#934799) Moderate SUSE bug 934799 SUSE bug 934800 CVE-2015-3226 CVE-2015-3227 SUSE OpenStack Cloud 5 This update for rubygem-activesupport-4_1 fixes the following issues: - CVE-2016-0753: Input Validation Circumvention (bsc#963334) - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329) Moderate SUSE bug 963329 SUSE bug 963334 CVE-2015-7576 CVE-2016-0753 SUSE OpenStack Cloud 5 This update for rubygem-activesupport-4_1 fixes the following issues: The previous security patch for CVE-2015-7576 was adding a new file but this file was not being added in the gemspec, thus the resulting gem didn't have it. This update includes the patch in the gem file too. Moderate SUSE bug 970715 CVE-2015-7576 SUSE OpenStack Cloud 5 This update for rubygem-bson-1_11, rubygem-easy_diff, rubygem-redcarpet, and rubygem-sprockets-2_11 fixes the following issues: - Avoid monodb data injection (bnc#933961, CVE-2015-4410) - Fixes merging of Arrays of Hashes (bsc#982364) - Fix XSS via autolinking of untrusted markdown (bsc#926328) Low SUSE bug 926328 SUSE bug 933961 SUSE bug 982364 CVE-2015-4410 SUSE OpenStack Cloud 5 rubygem-rack was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Crafted requests could have caused a SystemStackError leading to Denial of Service (bsc#934797). Moderate SUSE bug 934797 CVE-2015-3225 SUSE OpenStack Cloud 5 samba was updated to fix seven security issues. These security issues were fixed: - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862). - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031). - CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032). - CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033). - CVE-2016-2113: TLS certificate validation were missing (bsc#973034). - CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036). - CVE-2016-2118: "Badlock" DCERPC impersonation of authenticated account were possible (bsc#971965). These non-security issues were fixed: - bsc#967017: Fix leaking memory in libsmbclient in cli_set_mntpoint function - Getting and setting Windows ACLs on symlinks can change permissions on link Important SUSE bug 936862 SUSE bug 967017 SUSE bug 971965 SUSE bug 973031 SUSE bug 973032 SUSE bug 973033 SUSE bug 973034 SUSE bug 973036 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2115 CVE-2016-2118 SUSE OpenStack Cloud 5 This update for samba provides the following fixes: Security issues fixed: - CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441) - CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442) Non security issues fixed: - Allow SESSION KEY setup without signing. (bsc#1009711) - Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731) - Don't fail when using default domain with user@domain.com format. (bsc#997833) - Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692) Moderate SUSE bug 1003731 SUSE bug 1009711 SUSE bug 1014441 SUSE bug 1014442 SUSE bug 993692 SUSE bug 997833 CVE-2016-2125 CVE-2016-2126 SUSE OpenStack Cloud 5 This update for samba fixes the following issues: Security issue fixed: - CVE-2017-2619: symlink race permits opening files outside share directory (bsc#1027147). For SUSE Linux Enterprise 11 SP4 this is a re-issue of the update, a regression in the fix has been addressed (bsc#1036283, bso#12721). Important SUSE bug 1027147 SUSE bug 1036283 CVE-2017-2619 SUSE OpenStack Cloud 5 This update for wget fixes the following issues: - CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed. (bsc#984060). - CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext and making them accessible to the current user only. (bsc#995964) Bug fixed: - Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor (bsc#958342) Moderate SUSE bug 958342 SUSE bug 984060 SUSE bug 995964 CVE-2016-4971 CVE-2016-7098 SUSE OpenStack Cloud 5 This update for xen fixes several issues. These security issues were fixed: - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-5403: Unbounded memory allocation allowed a guest administrator to cause a denial of service of the host (bsc#990923) - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960) - CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225) - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224) - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264) - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724) - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716) - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue (bsc#978164) - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295) - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038) - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188) - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130) - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138) These non-security issues were fixed: - bsc#985503: vif-route broken - bsc#978413: PV guest upgrade from sles11sp4 to sles12sp2 alpha3 failed on sles11sp4 xen host. - bsc#954872: Script block-dmmd not working as expected - libxl: error: libxl_dm.c (another modification) - bsc#961600: Poor performance when Xen HVM domU configured with max memory > current memory - bsc#963161: Windows VM getting stuck during load while a VF is assigned to it after upgrading to latest maintenance updates - bsc#976470: Xend fails to start - bsc#973631: AWS EC2 kdump issue Important SUSE bug 954872 SUSE bug 961600 SUSE bug 963161 SUSE bug 973188 SUSE bug 973631 SUSE bug 974038 SUSE bug 975130 SUSE bug 975138 SUSE bug 976470 SUSE bug 978164 SUSE bug 978295 SUSE bug 978413 SUSE bug 980716 SUSE bug 980724 SUSE bug 981264 SUSE bug 982224 SUSE bug 982225 SUSE bug 982960 SUSE bug 983984 SUSE bug 985503 SUSE bug 988675 SUSE bug 990843 SUSE bug 990923 SUSE bug 995785 SUSE bug 995792 CVE-2014-3615 CVE-2014-3672 CVE-2016-3158 CVE-2016-3159 CVE-2016-3710 CVE-2016-3712 CVE-2016-3960 CVE-2016-4001 CVE-2016-4002 CVE-2016-4439 CVE-2016-4441 CVE-2016-4453 CVE-2016-4454 CVE-2016-4480 CVE-2016-5238 CVE-2016-5338 CVE-2016-5403 CVE-2016-6258 CVE-2016-6351 CVE-2016-7092 CVE-2016-7094 SUSE OpenStack Cloud 5 This update for xen fixes several issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652) - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103) - CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107) - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109) - CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106) - CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157) - CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160) - CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004) - CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005) - CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030) - CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032) This non-security issue was fixed: - bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit Important SUSE bug 1000106 SUSE bug 1000893 SUSE bug 1003030 SUSE bug 1003032 SUSE bug 1005004 SUSE bug 1005005 SUSE bug 1007157 SUSE bug 1007160 SUSE bug 1009100 SUSE bug 1009103 SUSE bug 1009107 SUSE bug 1009109 SUSE bug 1009111 SUSE bug 1011652 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9386 CVE-2016-9637 SUSE OpenStack Cloud 5 This update for xen fixes several issues. These security issues were fixed: - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-10013: Xen allowed local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation (bsc#1016340). - CVE-2016-9932: CMPXCHG8B emulation on x86 systems allowed local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix (bsc#1012651). - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-10024: Xen allowed local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations (bsc#1014298) This non-security issue was fixed: - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd Important SUSE bug 1002496 SUSE bug 1012651 SUSE bug 1013657 SUSE bug 1013668 SUSE bug 1014298 SUSE bug 1014507 SUSE bug 1015169 SUSE bug 1016340 SUSE bug 1022871 SUSE bug 1023004 SUSE bug 1024183 SUSE bug 1024834 SUSE bug 907805 CVE-2014-8106 CVE-2016-10013 CVE-2016-10024 CVE-2016-10155 CVE-2016-9101 CVE-2016-9776 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2016-9932 CVE-2017-2615 CVE-2017-2620 SUSE OpenStack Cloud 5 This update for xen fixes the following security issues: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). Important SUSE bug 1027570 SUSE bug 1028235 SUSE bug 1030442 CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 SUSE OpenStack Cloud 5 This update for xen fixes several security issues: - A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch (XSA-213, bsc#1034843) - A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks because of a missing check when transfering pages via GNTTABOP_transfer (XSA-214, bsc#1034844). - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034994). - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655) Important SUSE bug 1028655 SUSE bug 1033948 SUSE bug 1034843 SUSE bug 1034844 SUSE bug 1034845 SUSE bug 1034994 SUSE bug 1035483 CVE-2016-9603 CVE-2017-7718 CVE-2017-7980 CVE-2017-7995 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS The following security issue in spacewalk-backend has been fixed: - Non admin or disabled user cannot make changes to a system anymore using spacewalk-channel. (bsc#1026633, CVE-2017-7470) Additionally, the following non-security issues have been fixed: rhnlib: - Support all TLS versions in rpclib. (bsc#1025312) spacecmd: - Improve output on error for listrepo. (bsc#1027426) - Reword spacecmd removal message. (bsc#1024406) spacewalk-backend: - Do not fail with traceback when media.1 does not exist. (bsc#1032256) - Create scap files directory beforehand. (bsc#1029755) - Fix error if SPACEWALK_DEBUG_NO_REPORTS environment variable is not present. - Don't skip 'rhnErrataPackage' cleanup during an errata update. (bsc#1023233) - Add support for running spacewalk-debug without creating reports. (bsc#1024714) - Set scap store directory mod to 775 and group owner to susemanager. - incomplete_package_import: Do import rhnPackageFile as it breaks some package installations. - Added traceback printing to the exception block. - Change postgresql starting commands. spacewalk-client-tools: - Fix reboot message to use correct product name. (bsc#1031667) Moderate SUSE bug 1023233 SUSE bug 1024406 SUSE bug 1024714 SUSE bug 1025312 SUSE bug 1026633 SUSE bug 1027426 SUSE bug 1029755 SUSE bug 1031667 SUSE bug 1032256 CVE-2017-7470 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update fixes the following issues: mgr-cfg: - Ensure bytes type when using hashlib to avoid traceback (bsc#1138822) mgr-daemon: - Fix systemd timer configuration on SLE12 (bsc#1142038) mgr-osad: - Fix obsolete for old osad packages, to allow installing mgr-osad even by using osad at yum/zyppper install (bsc#1139453) - Ensure bytes type when using hashlib to avoid traceback (bsc#1138822) mgr-virtualization: - Fix missing python 3 ugettext (bsc#1138494) - Fix package dependencies to prevent file conflict (bsc#1143856) rhnlib: - Add SNI support for clients - Fix initialize ssl connection (bsc#1144155) - Fix bootstrapping SLE11SP4 trad client with SSL enabled (bsc#1148177) python-gzipstream: - SPEC cleanup - add makefile and pylint configuration - Add Uyuni URL to package - Bump version to 4.0.0 (bsc#1104034) - Fix copyright for the package specfile (bsc#1103696) spacecmd: - Bugfix: referenced variable before assignment. - Bugfix: 'dict' object has no attribute 'iteritems' (bsc#1135881) - Add unit tests for custominfo, snippet, scap, ssm, cryptokey and distribution - Fix missing runtime dependencies that made spacecmd return old versions of packages in some cases, even if newer ones were available (bsc#1148311) spacewalk-backend: - Do not overwrite comps and module data with older versions - Fix issue with "dists" keyword in url hostname - Import packages from all collections of a patch not just first one - Ensure bytes type when using hashlib to avoid traceback on XMLRPC call to "registration.register_osad" (bsc#1138822) - Do not duplicate "http://" protocol when using proxies with "deb" repositories (bsc#1138313) - Fix reposync when dealing with RedHat CDN (bsc#1138358) - Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480) - Prevent FileNotFoundError: repomd.xml.key traceback (bsc#1137940) - Add journalctl output to spacewalk-debug tarballs - Prevent unnecessary triggering of channel-repodata tasks when GPG signing is disabled (bsc#1137715) - Fix spacewalk-repo-sync for Ubuntu repositories in mirror case (bsc#1136029) - Add support for ULN repositories on new Zypper based reposync. - Don't skip Deb package tags on package import (bsc#1130040) - For backend-libs subpackages, exclude files for the server (already part of spacewalk-backend) to avoid conflicts (bsc#1148125) - prevent duplicate key violates on repo-sync with long changelog entries (bsc#1144889) spacewalk-remote-utils: - Add RHEL8 Moderate SUSE bug 1103696 SUSE bug 1104034 SUSE bug 1130040 SUSE bug 1135881 SUSE bug 1136029 SUSE bug 1136480 SUSE bug 1137715 SUSE bug 1137940 SUSE bug 1138313 SUSE bug 1138358 SUSE bug 1138494 SUSE bug 1138822 SUSE bug 1139453 SUSE bug 1142038 SUSE bug 1143856 SUSE bug 1144155 SUSE bug 1144889 SUSE bug 1148125 SUSE bug 1148177 SUSE bug 1148311 CVE-2019-10136 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for cobbler fixes the following issues: - CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. (bsc#1074594) - Fix for calling koan with virt_type kvm. (bsc#1090205) Moderate SUSE bug 1074594 SUSE bug 1090205 CVE-2017-1000469 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for cobbler fixes the following issues: Security issue fixed: - CVE-2018-10931: Forbid exposure of private methods in the API (bsc#1104287, bsc#1104189) Important SUSE bug 1104189 SUSE bug 1104287 CVE-2018-10931 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for python-pycrypto fixes the following issues: - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420). Important SUSE bug 1017420 CVE-2013-7459 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for salt fixes one security issue and bugs. The following security issue has been fixed: - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID (bsc#1053955). Additionally, the following non-security issues have been fixed: - Added support for SUSE Manager scalability features. (bsc#1052264) - Introduced the kubernetes module. (bsc#1051948) - Notify systemd synchronously via NOTIFY_SOCKET. (bsc#1053376) Moderate SUSE bug 1051948 SUSE bug 1052264 SUSE bug 1053376 SUSE bug 1053955 CVE-2017-12791 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for salt fixes one security issue and bugs. The following security issues have been fixed: - CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. (bsc#1062462) - CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication request. (bsc#1062464) Additionally, the following non-security issues have been fixed: - Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993) - Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230) - Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758) - Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112) - Fix for delete_deployment in Kubernetes module. (bsc#1059291) - Catching error when PIDfile cannot be deleted. (bsc#1050003) - Use $HOME to get the user home directory instead using '~' char. (bsc#1042749) Moderate SUSE bug 1041993 SUSE bug 1042749 SUSE bug 1050003 SUSE bug 1059291 SUSE bug 1059758 SUSE bug 1060230 SUSE bug 1062462 SUSE bug 1062464 SUSE bug 985112 CVE-2017-14695 CVE-2017-14696 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for salt fixes the following issues: Salt was updated to version 2016.11.10 and contains the following fixes: Security issues fixed: - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api (bsc#1113698). - CVE-2018-15751: Fixed remote authentication bypass in salt-api(netapi) that allows to execute arbitrary commands (bsc#1113699). Important SUSE bug 1113698 SUSE bug 1113699 CVE-2018-15750 CVE-2018-15751 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for salt provides version 2016.11.4 and brings various fixes and improvements: - Adding a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade. - Fix format error. (bsc#1043111) - Fix ownership for whole master cache directory. (bsc#1035914) - Disable 3rd party runtime packages to be explicitly recommended. (bsc#1040886) - Fix insecure permissions in salt-ssh temporary files. (bsc#1035912, CVE-2017-8109) - Disable custom rosters for Salt SSH via Salt API. (bsc#1011800, CVE-2017-5200) - Orchestrate and batches don't return false failed information anymore. - Speed-up cherrypy by removing sleep call. - Fix os_family grains on SUSE. (bsc#1038855) - Fix setting the language on SUSE systems. (bsc#1038855) - Use SUSE specific salt-api.service. (bsc#1039370) - Fix using hostname for minion ID as '127'. - Fix core grains constants for timezone. (bsc#1032931) - Minor fixes on new pkg.list_downloaded. - Listing all type of advisory patches for Yum module. - Prevents zero length error on Python 2.6. - Fixes zypper test error after backporting. - Raet protocol is no longer supported. (bsc#1020831) - Fix moving SSH data to the new home. (bsc#1027722) - Fix logrotating /var/log/salt/minion. (bsc#1030009) - Fix result of master_tops extension is mutually overwritten. (bsc#1030073) - Allows to set 'timeout' and 'gather_job_timeout' via kwargs. - Allows to set custom timeouts for 'manage.up' and 'manage.status'. - Use salt's ordereddict for comparison. - Fix scripts for salt-proxy. - Add openscap module. - File.get_managed regression fix. - Fix translate variable arguments if they contain hidden keywords. (bsc#1025896) - Added unit test for dockerng.sls_build dryrun. - Added dryrun to dockerng.sls_build. - Update dockerng minimal version requirements. - Fix format error in error parsing. - Keep fix for migrating salt home directory. (bsc#1022562) - Fix salt pkg.latest raises exception if package is not available. (bsc#1012999) - Timezone should always be in UTC. (bsc#1017078) - Fix timezone handling for rpm installtime. (bsc#1017078) - Increasing timeouts for running integrations tests. - Add buildargs option to dockerng.build module. - Fix error when missing ssh-option parameter. - Re-add yum notify plugin. - All kwargs to dockerng.create to provide all features to sls_build as well. - Datetime should be returned always in UTC. - Fix possible crash while deserialising data on infinite recursion in scheduled state. (bsc#1036125) - Documentation refresh to 2016.11.4 - For a detailed description, please refer to: + https://docs.saltstack.com/en/develop/topics/releases/2016.11.4.html + https://docs.saltstack.com/en/develop/topics/releases/2016.11.3.html + https://docs.saltstack.com/en/develop/topics/releases/2016.11.2.html + https://docs.saltstack.com/en/develop/topics/releases/2016.11.1.html Moderate SUSE bug 1011800 SUSE bug 1012999 SUSE bug 1017078 SUSE bug 1020831 SUSE bug 1022562 SUSE bug 1025896 SUSE bug 1027240 SUSE bug 1027722 SUSE bug 1030009 SUSE bug 1030073 SUSE bug 1032931 SUSE bug 1035912 SUSE bug 1035914 SUSE bug 1036125 SUSE bug 1038855 SUSE bug 1039370 SUSE bug 1040584 SUSE bug 1040886 SUSE bug 1043111 CVE-2017-5200 CVE-2017-8109 SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS This update for zeromq fixes the following issues: - CVE-2019-13132: An unauthenticated remote attacker could have exploited a stack overflow vulnerability on a server that is supposed to be protected by encryption and authentication to potentially gain a remote code execution. (bsc#1140255) Important SUSE bug 1140255 CVE-2019-13132 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox was updated to version 24.6.0 to fix six security issues: * Miscellaneous memory safety hazards. (CVE-2014-1533, CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer. (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538) * Use-after-free with SMIL Animation Controller. (CVE-2014-1541) mozilla-nspr was updated to version 4.10.6 to fix one security issue: * Out of bounds write in NSPR. (CVE-2014-1545) Further information can be found at https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues references: * CVE-2014-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533> * CVE-2014-1534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534> * CVE-2014-1536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536> * CVE-2014-1537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537> * CVE-2014-1538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538> * CVE-2014-1541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541> * CVE-2014-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545> SUSE bug 881874 CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA ImageMagick has been updated to fix four security issues: * Crafted jpeg file could have lead to a Denial of Service (CVE-2014-8716). * Out-of-bounds memory access in resize code (CVE-2014-8354) * Out-of-bounds memory access in PCX parser (CVE-2014-8355). * Out-of-bounds memory error in DCM decode (CVE-2014-8562). Security Issues: * CVE-2014-8716 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8716> * CVE-2014-8355 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8355> * CVE-2014-8354 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8354> * CVE-2014-8562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8562> SUSE bug 903204 SUSE bug 903216 SUSE bug 903638 SUSE bug 905260 CVE-2014-8354 CVE-2014-8355 CVE-2014-8562 CVE-2014-8716 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled. They can be re-enabled by exporting the following environment variable MAGICK_CODER_MODULE_PATH=/usr/lib64/ImageMagick-6.4.3/modules-Q16/coders/vulnerable/ (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) Important SUSE bug 978061 CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - bsc#978061: A vulnerability in ImageMagick's "https" module allowed users to execute arbitrary shell commands on the host performing the image conversion. The issue had the potential for remote command injection. This update mitigates the vulnerability by disabling all access to the "https" module in the "delegates.xml" config file. (CVE-2016-3714) Important SUSE bug 978061 CVE-2016-3714 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - CVE-2016-5118: popen() shell vulnerability via filenames (bsc#982178) Important SUSE bug 982178 CVE-2016-5118 SUSE Linux Enterprise Server 11 SP3-TERADATA ImageMagick was updated to fix 55 security issues. These security issues were fixed: - CVE-2014-9810: SEGV in dpx file handler (bsc#983803). - CVE-2014-9811: Crash in xwd file handler (bsc#984032). - CVE-2014-9812: NULL pointer dereference in ps file handling (bsc#984137). - CVE-2014-9813: Crash on corrupted viff file (bsc#984035). - CVE-2014-9814: NULL pointer dereference in wpg file handling (bsc#984193). - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372). - CVE-2014-9816: Out of bound access in viff image (bsc#984398). - CVE-2014-9817: Heap buffer overflow in pdb file handling (bsc#984400). - CVE-2014-9818: Out of bound access on malformed sun file (bsc#984181). - CVE-2014-9819: Heap overflow in palm files (bsc#984142). - CVE-2014-9830: Handling of corrupted sun file (bsc#984135). - CVE-2014-9831: Handling of corrupted wpg file (bsc#984375). - CVE-2014-9836: Crash in xpm file handling (bsc#984023). - CVE-2014-9851: Crash when parsing resource block (bsc#984160). - CVE-2016-5689: NULL ptr dereference in dcm coder (bsc#985460). - CVE-2014-9853: Memory leak in rle file handling (bsc#984408). - CVE-2015-8902: PDB file DoS (CPU consumption) (bsc#983253). - CVE-2015-8903: Denial of service (cpu) in vicar (bsc#983259). - CVE-2015-8901: MIFF file DoS (endless loop) (bsc#983234). - CVE-2014-9834: Heap overflow in pict file (bsc#984436). - CVE-2014-9806: Prevent file descriptr leak due to corrupted file (bsc#983774). - CVE-2014-9838: Out of memory crash in magick/cache.c (bsc#984370). - CVE-2014-9854: Filling memory during identification of TIFF image (bsc#984184). - CVE-2015-8898: Prevent null pointer access in magick/constitute.c (bsc#983746). - CVE-2015-8894: Double free in coders/tga.c:221 (bsc#983523). - CVE-2015-8896: Double free / integer truncation issue in coders/pict.c:2000 (bsc#983533). - CVE-2015-8897: Out of bounds error in SpliceImage (bsc#983739). - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451). - CVE-2016-5691: Checks for pixel.red/green/blue in dcm coder (bsc#985456). - CVE-2014-9805: SEGV due to a corrupted pnm file. (bsc#983752). - CVE-2014-9808: SEGV due to corrupted dpc images. (bsc#983796). - CVE-2014-9820: heap overflow in xpm files (bsc#984150). - CVE-2014-9823: heap overflow in palm file (bsc#984401). - CVE-2014-9822: heap overflow in quantum file (bsc#984187). - CVE-2014-9839: Theoretical out of bound access in magick/colormap-private.h (bsc#984379). - CVE-2014-9824: Heap overflow in psd file (bsc#984185). - CVE-2014-9809: Fix a SEGV due to corrupted xwd images. (bsc#983799). - CVE-2014-9826: Incorrect error handling in sun files (bsc#984186). - CVE-2014-9842: Memory leak in psd handling (bsc#984374). - CVE-2016-5687: Out of bounds read in DDS coder (bsc#985448). - CVE-2014-9840: Out of bound access in palm file (bsc#984433). - CVE-2014-9847: Incorrect handling of "previous" image in the JNG decoder (bsc#984144). - CVE-2014-9846: Added checks to prevent overflow in rle file. (bsc#983521). - CVE-2014-9845: Crash due to corrupted dib file (bsc#984394). - CVE-2014-9844: Out of bound issue in rle file (bsc#984373). - CVE-2014-9849: Crash in png coder (bsc#984018). - CVE-2016-5688: Various invalid memory reads in ImageMagick WPG (bsc#985442). - CVE-2014-9807: Fix a double free in pdb coder. (bsc#983794). - CVE-2014-9829: Out of bound access in sun file (bsc#984409). - CVE-2016-4564: The DrawImage function in MagickCore/draw.c in ImageMagick made an incorrect function call in attempting to locate the next token, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983308). - CVE-2016-4563: The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick mishandled the relationship between the BezierQuantum value and certain strokes data, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983305). - CVE-2016-4562: The DrawDashPolygon function in MagickCore/draw.c in ImageMagick mishandled calculations of certain vertices integer data, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983292). - CVE-2014-9837: Additional PNM sanity checks (bsc#984166). - CVE-2014-9835: Heap overflow in wpf file (bsc#984145). - CVE-2014-9828: Corrupted (too many colors) psd file (bsc#984028). - CVE-2016-5841: Integer overflow could have read to RCE (bnc#986609). - CVE-2016-5842: Out-of-bounds read in MagickCore/property.c:1396 could have lead to memory leak (bnc#986608). Important SUSE bug 983234 SUSE bug 983253 SUSE bug 983259 SUSE bug 983292 SUSE bug 983305 SUSE bug 983308 SUSE bug 983521 SUSE bug 983523 SUSE bug 983533 SUSE bug 983739 SUSE bug 983746 SUSE bug 983752 SUSE bug 983774 SUSE bug 983794 SUSE bug 983796 SUSE bug 983799 SUSE bug 983803 SUSE bug 984018 SUSE bug 984023 SUSE bug 984028 SUSE bug 984032 SUSE bug 984035 SUSE bug 984135 SUSE bug 984137 SUSE bug 984142 SUSE bug 984144 SUSE bug 984145 SUSE bug 984150 SUSE bug 984160 SUSE bug 984166 SUSE bug 984181 SUSE bug 984184 SUSE bug 984185 SUSE bug 984186 SUSE bug 984187 SUSE bug 984193 SUSE bug 984370 SUSE bug 984372 SUSE bug 984373 SUSE bug 984374 SUSE bug 984375 SUSE bug 984379 SUSE bug 984394 SUSE bug 984398 SUSE bug 984400 SUSE bug 984401 SUSE bug 984408 SUSE bug 984409 SUSE bug 984433 SUSE bug 984436 SUSE bug 985442 SUSE bug 985448 SUSE bug 985451 SUSE bug 985456 SUSE bug 985460 SUSE bug 986608 SUSE bug 986609 CVE-2014-9805 CVE-2014-9806 CVE-2014-9807 CVE-2014-9808 CVE-2014-9809 CVE-2014-9810 CVE-2014-9811 CVE-2014-9812 CVE-2014-9813 CVE-2014-9814 CVE-2014-9815 CVE-2014-9816 CVE-2014-9817 CVE-2014-9818 CVE-2014-9819 CVE-2014-9820 CVE-2014-9822 CVE-2014-9823 CVE-2014-9824 CVE-2014-9826 CVE-2014-9828 CVE-2014-9829 CVE-2014-9830 CVE-2014-9831 CVE-2014-9834 CVE-2014-9835 CVE-2014-9836 CVE-2014-9837 CVE-2014-9838 CVE-2014-9839 CVE-2014-9840 CVE-2014-9842 CVE-2014-9844 CVE-2014-9845 CVE-2014-9846 CVE-2014-9847 CVE-2014-9849 CVE-2014-9851 CVE-2014-9853 CVE-2014-9854 CVE-2015-8894 CVE-2015-8896 CVE-2015-8897 CVE-2015-8898 CVE-2015-8901 CVE-2015-8902 CVE-2015-8903 CVE-2016-4562 CVE-2016-4563 CVE-2016-4564 CVE-2016-5687 CVE-2016-5688 CVE-2016-5689 CVE-2016-5690 CVE-2016-5691 CVE-2016-5841 CVE-2016-5842 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - security update: * CVE-2016-6520: buffer overflow [bsc#991872] * CVE-2016-6491: Out-of-bounds read in CopyMagickMemory [bsc#991445] Moderate SUSE bug 991445 SUSE bug 991872 CVE-2016-6491 CVE-2016-6520 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact. - CVE-2016-8862: Memory allocation failure in AcquireMagickMemory (bsc#1007245) - CVE-2014-9907: DOS due to corrupted DDS files (bsc#1000714) - CVE-2015-8959: DOS due to corrupted DDS files (bsc#1000713) - CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711) - CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066) - CVE-2016-7514: Out-of-bounds read in coders/psd.c (bsc#1000688) - CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689) - CVE-2016-7529: out of bound in quantum handling (bsc#1000399) - CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221) - CVE-2016-7527: out of bound access in wpg file coder: (bsc#1000436) - CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629) - CVE-2016-7528: out of bound access in xcf file coder (bsc#1000434) - CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127) - CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125) - CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123) - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209) - CVE-2016-7525: Heap buffer overflow in psd file coder (bsc#1000701) - CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700) - CVE-2016-7530: Out of bound in quantum handling (bsc#1000703) - CVE-2016-7531: Pbd file out of bound access (bsc#1000704) - CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707) - CVE-2016-7535: Out of bound access for corrupted psd file (bsc#1000709) - CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698) - CVE-2016-7517: out-of-bounds read in coders/pict.c (bsc#1000693) - CVE-2016-7516: Out of bounds problem in rle, pict, viff and sun files (bsc#1000692) - CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691) - CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690) - CVE-2016-7519: out-of-bounds read in coders/rle.c (bsc#1000695) - CVE-2016-7518: out-of-bounds read in coders/sun.c (bsc#1000694) - CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422) - CVE-2016-7523: AddressSanitizer:heap-buffer-overflow READ of size 1 meta.c:496 (bsc#1000699) - CVE-2016-7799: mogrify global buffer overflow (bsc#1002421) Important SUSE bug 1000399 SUSE bug 1000434 SUSE bug 1000436 SUSE bug 1000688 SUSE bug 1000689 SUSE bug 1000690 SUSE bug 1000691 SUSE bug 1000692 SUSE bug 1000693 SUSE bug 1000694 SUSE bug 1000695 SUSE bug 1000698 SUSE bug 1000699 SUSE bug 1000700 SUSE bug 1000701 SUSE bug 1000703 SUSE bug 1000704 SUSE bug 1000707 SUSE bug 1000709 SUSE bug 1000711 SUSE bug 1000713 SUSE bug 1000714 SUSE bug 1001066 SUSE bug 1001221 SUSE bug 1002209 SUSE bug 1002421 SUSE bug 1002422 SUSE bug 1003629 SUSE bug 1005123 SUSE bug 1005125 SUSE bug 1005127 SUSE bug 1007245 CVE-2014-9907 CVE-2015-8957 CVE-2015-8958 CVE-2015-8959 CVE-2016-5687 CVE-2016-6823 CVE-2016-7101 CVE-2016-7514 CVE-2016-7515 CVE-2016-7516 CVE-2016-7517 CVE-2016-7518 CVE-2016-7519 CVE-2016-7522 CVE-2016-7523 CVE-2016-7524 CVE-2016-7525 CVE-2016-7526 CVE-2016-7527 CVE-2016-7528 CVE-2016-7529 CVE-2016-7530 CVE-2016-7531 CVE-2016-7533 CVE-2016-7535 CVE-2016-7537 CVE-2016-7799 CVE-2016-7800 CVE-2016-7996 CVE-2016-7997 CVE-2016-8682 CVE-2016-8683 CVE-2016-8684 CVE-2016-8862 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: * CVE-2016-9556: Possible Heap-overflow found by fuzzing [bsc#1011130] * CVE-2016-9559: Possible Null pointer access found by fuzzing [bsc#1011136] * CVE-2016-8707: Possible code execution in the tiff deflate convert code [bsc#1014159] * CVE-2016-9773: Possible Heap overflow in IsPixelGray [bsc#1013376] * CVE-2016-8866: Possible memory allocation failure in AcquireMagickMemory [bsc#1009318] Moderate SUSE bug 1009318 SUSE bug 1011130 SUSE bug 1011136 SUSE bug 1013376 SUSE bug 1014159 CVE-2016-7530 CVE-2016-8707 CVE-2016-8866 CVE-2016-9556 CVE-2016-9559 CVE-2016-9773 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - CVE-2016-10046: Prevent buffer overflow in draw.c caused by an incorrect length calculation (bsc#1017308) - CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310) - CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311) - CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312) - CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313) - CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314). - CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318) - CVE-2016-10060: Improved error handling when writing files to not mask errors (bsc#1017319). - CVE-2016-10063: Check validity of extend during TIFF file reading (bsc#1017320). - CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321) - CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322) - CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324) - CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326) - CVE-2016-10071: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326). - CVE-2016-10144: Added a check after allocating memory when parsing IPL files (bsc#1020433). - CVE-2016-10145: Fixed of-by-one in string copy operation when parsing WPG files (bsc#1020435). - CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443) - CVE-2017-5506: Missing offset check leading to a double-free (bsc#1020436). - CVE-2017-5507: Fixed a memory leak when reading MPC files allowing for DoS (bsc#1020439). - CVE-2017-5508: Increase the amount of memory allocated for TIFF pixels to prevent a heap buffer-overflow (bsc#1020441). - CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448) This update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421). Moderate SUSE bug 1017308 SUSE bug 1017310 SUSE bug 1017311 SUSE bug 1017312 SUSE bug 1017313 SUSE bug 1017314 SUSE bug 1017318 SUSE bug 1017319 SUSE bug 1017320 SUSE bug 1017321 SUSE bug 1017322 SUSE bug 1017324 SUSE bug 1017326 SUSE bug 1017421 SUSE bug 1020433 SUSE bug 1020435 SUSE bug 1020436 SUSE bug 1020439 SUSE bug 1020441 SUSE bug 1020443 SUSE bug 1020448 CVE-2016-10046 CVE-2016-10048 CVE-2016-10049 CVE-2016-10050 CVE-2016-10051 CVE-2016-10052 CVE-2016-10059 CVE-2016-10060 CVE-2016-10063 CVE-2016-10064 CVE-2016-10065 CVE-2016-10068 CVE-2016-10070 CVE-2016-10071 CVE-2016-10144 CVE-2016-10145 CVE-2016-10146 CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5511 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: This security issue was fixed: - CVE-2017-7941: The ReadSGIImage function in sgi.c allowed remote attackers to consume an amount of available memory via a crafted file (bsc#1034876). - CVE-2017-8351: ImageMagick, GraphicsMagick: denial of service (memory leak) via a crafted file (ReadPCDImage func in pcd.c) (bsc#1036986). - CVE-2017-8352: denial of service (memory leak) via a crafted file (ReadXWDImage func in xwd.c) (bsc#1036987) - CVE-2017-8349: denial of service (memory leak) via a crafted file (ReadSFWImage func in sfw.c) (bsc#1036984) - CVE-2017-8350: denial of service (memory leak) via a crafted file (ReadJNGImage function in png.c) (bsc#1036985) - CVE-2017-8345: denial of service (memory leak) via a crafted file (ReadMNGImage func in png.c) (bsc#1036980) - CVE-2017-8346: denial of service (memory leak) via a crafted file (ReadDCMImage func in dcm.c) (bsc#1036981) - CVE-2017-8353: denial of service (memory leak) via a crafted file (ReadPICTImage func in pict.c) (bsc#1036988) - CVE-2017-8830: denial of service (memory leak) via a crafted file (ReadBMPImage func in bmp.c:1379) (bsc#1038000) - CVE-2017-7606: denial of service (application crash) or possibly have unspecified other impact via a crafted image (bsc#1033091) - CVE-2017-8765: memory leak vulnerability via a crafted ICON file (ReadICONImage in coders\icon.c) (bsc#1037527) - CVE-2017-8355: denial of service (memory leak) via a crafted file (ReadMTVImage func in mtv.c) (bsc#1036990) - CVE-2017-8344: denial of service (memory leak) via a crafted file (ReadPCXImage func in pcx.c) (bsc#1036978) - CVE-2017-9098: uninitialized memory usage in the ReadRLEImage RLE decoder function coders/rle.c (bsc#1040025) - CVE-2017-9141: Missing checks in the ReadDDSImage function in coders/dds.c could lead to a denial of service (assertion) (bsc#1040303) - CVE-2017-9142: Missing checks in theReadOneJNGImage function in coders/png.c could lead to denial of service (assertion) (bsc#1040304) - CVE-2017-9143: A possible denial of service attack via crafted .art file in ReadARTImage function in coders/art.c (bsc#1040306) - CVE-2017-9144: A crafted RLE image can trigger a crash in coders/rle.c could lead to a denial of service (crash) (bsc#1040332) Moderate SUSE bug 1033091 SUSE bug 1034870 SUSE bug 1034872 SUSE bug 1034876 SUSE bug 1036976 SUSE bug 1036978 SUSE bug 1036980 SUSE bug 1036981 SUSE bug 1036983 SUSE bug 1036984 SUSE bug 1036985 SUSE bug 1036986 SUSE bug 1036987 SUSE bug 1036988 SUSE bug 1036989 SUSE bug 1036990 SUSE bug 1037527 SUSE bug 1038000 SUSE bug 1040025 SUSE bug 1040303 SUSE bug 1040304 SUSE bug 1040306 SUSE bug 1040332 CVE-2014-9846 CVE-2016-10050 CVE-2017-7606 CVE-2017-7941 CVE-2017-7942 CVE-2017-7943 CVE-2017-8344 CVE-2017-8345 CVE-2017-8346 CVE-2017-8348 CVE-2017-8349 CVE-2017-8350 CVE-2017-8351 CVE-2017-8352 CVE-2017-8353 CVE-2017-8354 CVE-2017-8355 CVE-2017-8357 CVE-2017-8765 CVE-2017-8830 CVE-2017-9098 CVE-2017-9141 CVE-2017-9142 CVE-2017-9143 CVE-2017-9144 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9439: A memory leak was found in the function ReadPDBImage incoders/pdb.c (bsc#1042826) - CVE-2017-9501: An assertion failure could cause a denial of service via a crafted file (bsc#1043289) - CVE-2017-11403: ReadMNGImage function in coders/png.c has an out-of-order CloseBlob call, resulting in a use-after-free via acrafted file (bsc#1049072) Important SUSE bug 1042826 SUSE bug 1043289 SUSE bug 1049072 CVE-2017-11403 CVE-2017-9439 CVE-2017-9501 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-11534: Processing a crafted file in convert could have lead to a Memory Leak in the lite_font_map() function in coders/wmf.c (bsc#1050135). - CVE-2017-13133: The load_level function in coders/xcf.c lacked offset validation, which allowed attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file (bsc#1055219). - CVE-2017-13139: The ReadOneMNGImage function in coders/png.c had an out-of-bounds read with the MNG CLIP chunk (bsc#1055430). - CVE-2017-15033: Fixed a memory leak in ReadYUVImage in coders/yuv.c (bsc#1061873). Moderate SUSE bug 1050135 SUSE bug 1055219 SUSE bug 1055430 SUSE bug 1061873 CVE-2017-11534 CVE-2017-13133 CVE-2017-13139 CVE-2017-15033 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas could possibly disclose potentially sensitive memory [bsc#1059778] * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in coders/tiff.c [bsc#1050632] * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1058485] * CVE-2017-14341: Infinite loop in the ReadWPGImage function [bsc#1058637] * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1067181] * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in validation problems could lead to denial of service [bsc#1067184] * CVE-2017-14175: Lack of End of File check could lead to denial of service [bsc#1057719] * CVE-2017-13769: denial of service issue in function WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432] * CVE-2017-13134: a heap-based buffer over-read was found in thefunction SFWScan in coders/sfw.c, which allows attackers to cause adenial of service via a crafted file. [bsc#1055214] * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick allows remote attackers to cause a DoS [bsc#1049796] * CVE-2017-15930: Null Pointer dereference while transfering JPEG scanlines could lead to denial of service [bsc#1066003] * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c allows remote attackers to cause a denial of service [bsc#1054757] * CVE-2017-14531: memory exhaustion issue in ReadSUNImage incoders/sun.c. [bsc#1059666] * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service [bsc#1052553] * CVE-2017-12587: User controlable large loop in the ReadPWPImage in coders\pwp.c could lead to denial of service [bsc#1052450] * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer overflow that could lead to denial of service [bsc#1057729] * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check. [bnc#1048457] * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows remote attackers to cause DoS [bnc#1050116] * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer over-read in WritePSImage() in coders/ps.c [bnc#1050139] * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows to cause DoS [bnc#1051441] * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a ninteger signedness error leading to excessive memory consumption [bnc#1051847] * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in coders/cals.c [bnc#1052689] * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in WritePDFImage in coders/pdf.c [bnc#1052758] * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in codersdcm.c [bnc#1052764] * CVE-2017-14172: ImageMagick: Lack of end of file check in ReadPSImage() could lead to a denial of service [bnc#1057730] * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in coders/rle.c could lead to denial of service [bnc#1060577] Important SUSE bug 1048457 SUSE bug 1049796 SUSE bug 1050116 SUSE bug 1050139 SUSE bug 1050632 SUSE bug 1051441 SUSE bug 1051847 SUSE bug 1052450 SUSE bug 1052553 SUSE bug 1052689 SUSE bug 1052758 SUSE bug 1052764 SUSE bug 1054757 SUSE bug 1055214 SUSE bug 1056432 SUSE bug 1057719 SUSE bug 1057729 SUSE bug 1057730 SUSE bug 1058485 SUSE bug 1058637 SUSE bug 1059666 SUSE bug 1059778 SUSE bug 1060577 SUSE bug 1066003 SUSE bug 1067181 SUSE bug 1067184 CVE-2017-11188 CVE-2017-11478 CVE-2017-11527 CVE-2017-11535 CVE-2017-11640 CVE-2017-11752 CVE-2017-12140 CVE-2017-12435 CVE-2017-12587 CVE-2017-12644 CVE-2017-12662 CVE-2017-12669 CVE-2017-12983 CVE-2017-13134 CVE-2017-13769 CVE-2017-14172 CVE-2017-14173 CVE-2017-14175 CVE-2017-14341 CVE-2017-14342 CVE-2017-14531 CVE-2017-14607 CVE-2017-14733 CVE-2017-15930 CVE-2017-16545 CVE-2017-16546 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-14343: Fixed a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file (bsc#1058422). - CVE-2017-12691: The ReadOneLayer function in coders/xcf.c allowed remote attackers to cause a denial of service (memory consumption) via a crafted file (bsc#1058422). - CVE-2017-14042: Prevent memory allocation failure in the ReadPNMImage function in coders/pnm.c. The vulnerability caused a big memory allocation, which may have lead to remote denial of service in the MagickRealloc function in magick/memory.c (bsc#1056550). - CVE-2017-15281: ReadPSDImage in coders/psd.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file (bsc#1063049). - CVE-2017-13061: A length-validation vulnerability in the function ReadPSDLayersInternal in coders/psd.c allowed attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file (bsc#1055063). - CVE-2017-12563: A memory exhaustion vulnerability in the function ReadPSDImage in coders/psd.c allowed attackers to cause a denial of service (bsc#1052460). - CVE-2017-14174: coders/psd.c allowed for DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check might have caused huge CPU consumption. When a crafted PSD file, which claims a large "length" field in the header but did not contain sufficient backing data, is provided, the loop over "length" would consume huge CPU resources, since there is no EOF check inside the loop (bsc#1057723). - CVE-2017-13062: A memory leak vulnerability in the function formatIPTC in coders/meta.c allowed attackers to cause a denial of service (WriteMETAImage memory consumption) via a crafted file (bsc#1055053). - CVE-2017-15277: ReadGIFImage in coders/gif.c left the palette uninitialized when processing a GIF file that has neither a global nor local palette. If this functionality was used as a library loaded into a process that operates on interesting data, this data sometimes could have been leaked via the uninitialized palette (bsc#1063050). Moderate SUSE bug 1052460 SUSE bug 1055053 SUSE bug 1055063 SUSE bug 1056550 SUSE bug 1057723 SUSE bug 1058422 SUSE bug 1063049 SUSE bug 1063050 CVE-2017-12563 CVE-2017-12691 CVE-2017-13061 CVE-2017-13062 CVE-2017-14042 CVE-2017-14174 CVE-2017-14343 CVE-2017-15277 CVE-2017-15281 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2017-12672: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (bsc#1052720). - CVE-2017-13060: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted file (bsc#1055065). - CVE-2017-11724: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c involving the quantum_info and clone_info data structures (bsc#1051446). - CVE-2017-12670: Added validation in coders/mat.c to prevent an assertion failure in the function DestroyImage in MagickCore/image.c, which allowed attackers to cause a denial of service (bsc#1052731). - CVE-2017-12667: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1052732). - CVE-2017-13146: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1055323). - CVE-2017-10800: Processing MATLAB images in coders/mat.c could have lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT Object was larger than the actual amount of data (bsc#1047044) - CVE-2017-13648: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1055434). - CVE-2017-11141: Fixed a memory leak vulnerability in the function ReadMATImage in coders\mat.c that could have caused memory exhaustion via a crafted MAT file, related to incorrect ordering of a SetImageExtent call (bsc#1047898). - CVE-2017-11529: The ReadMATImage function in coders/mat.c allowed remote attackers to cause a denial of service (memory leak) via a crafted file (bsc#1050120). - CVE-2017-12564: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (bsc#1052468). - CVE-2017-12434: Added a missing NULL check in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c (bsc#1052550). - CVE-2017-12675: Added a missing check for multidimensional data coders/mat.c, that could have lead to a memory leak in the function ReadImage in MagickCore/constitute.c, which allowed attackers to cause a denial of service (bsc#1052710). - CVE-2017-14326: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted file (bsc#1058640). - CVE-2017-11644: Processesing a crafted file in convert could have lead to a memory leak in the ReadMATImage() function in coders/mat.c (bsc#1050606). - CVE-2017-13658: Added a missing NULL check in the ReadMATImage function in coders/mat.c, which could have lead to a denial of service (assertion failure and application exit) in the DestroyImageInfo function in MagickCore/image.c (bsc#1055855). - CVE-2017-14533: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c (bsc#1059751). - CVE-2017-17881: Fixed a memory leak vulnerability in the function ReadMATImage in coders/mat.c, which allowed attackers to cause a denial of service via a crafted MAT image file (bsc#1074123). - CVE-2017-1000476: Prevent CPU exhaustion in the function ReadDDSInfo in coders/dds.c, which allowed attackers to cause a denial of service (bsc#1074610). - CVE-2017-9409: Fixed a memory leak vulnerability in the function ReadMPCImage in mpc.c, which allowed attackers to cause a denial of service via a crafted file (bsc#1042948). - CVE-2017-11449: coders/mpc did not enable seekable streams and thus could not validate blob sizes, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin (bsc#1049373) - CVE-2017-12430: A memory exhaustion in the function ReadMPCImage in coders/mpc.c allowed attackers to cause DoS (bsc#1052252) - CVE-2017-12642: Prevent a memory leak vulnerability in ReadMPCImage in coders\mpc.c via crafted file allowing for DoS (bsc#1052771) - CVE-2017-14249: A mishandled EOF check in ReadMPCImage in coders/mpc.c that lead to a division by zero in GetPixelCacheTileSize in MagickCore/cache.c allowed remote attackers to cause a denial of service via a crafted file (bsc#1058082) - CVE-2017-1000445: Added a NUL pointer check in the MagickCore component that might have lead to denial of service (bsc#1074425). - CVE-2017-11751: Fixed a memory leak vulnerability in the function WritePICONImage in coders/xpm.c that allowed remote attackers to cause a denial of service via a crafted file (bsc#1051412). - CVE-2017-17680: Fixed a memory leak vulnerability in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted xpm image file (bsc#1072902). - CVE-2017-17882: Fixed a memory leak vulnerability in the function ReadXPMImage in coders/xpm.c, which allowed attackers to cause a denial of service via a crafted XPM image file (bsc#1074122). - CVE-2018-5246: Fixed memory leak vulnerability in ReadPATTERNImage in coders/pattern.c (bsc#1074973). - CVE-2017-18022: Fixed memory leak vulnerability in MontageImageCommand in MagickWand/montage.c (bsc#1074975) - CVE-2018-5247: Fixed memory leak vulnerability in ReadRLAImage in coders/rla.c (bsc#1074969) Moderate SUSE bug 1042948 SUSE bug 1047044 SUSE bug 1047898 SUSE bug 1049373 SUSE bug 1050120 SUSE bug 1050606 SUSE bug 1051412 SUSE bug 1051446 SUSE bug 1052252 SUSE bug 1052468 SUSE bug 1052550 SUSE bug 1052710 SUSE bug 1052720 SUSE bug 1052731 SUSE bug 1052732 SUSE bug 1052771 SUSE bug 1055065 SUSE bug 1055323 SUSE bug 1055434 SUSE bug 1055855 SUSE bug 1058082 SUSE bug 1058640 SUSE bug 1059751 SUSE bug 1072902 SUSE bug 1074122 SUSE bug 1074123 SUSE bug 1074425 SUSE bug 1074610 SUSE bug 1074969 SUSE bug 1074973 SUSE bug 1074975 CVE-2017-1000445 CVE-2017-1000476 CVE-2017-10800 CVE-2017-11141 CVE-2017-11449 CVE-2017-11529 CVE-2017-11644 CVE-2017-11724 CVE-2017-11751 CVE-2017-12430 CVE-2017-12434 CVE-2017-12564 CVE-2017-12642 CVE-2017-12667 CVE-2017-12670 CVE-2017-12672 CVE-2017-12675 CVE-2017-13060 CVE-2017-13146 CVE-2017-13648 CVE-2017-13658 CVE-2017-14249 CVE-2017-14326 CVE-2017-14533 CVE-2017-17680 CVE-2017-17881 CVE-2017-17882 CVE-2017-18022 CVE-2017-9409 CVE-2018-5246 CVE-2018-5247 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2018-5685: Prevent infinite loop and application hang in the ReadBMPImage function. Remote attackers could leverage this vulnerability to cause a denial of service via an image file with a crafted bit-field mask value (bsc#1075939) - CVE-2017-11639: Prevent heap-based buffer over-read in the WriteCIPImage() function, related to the GetPixelLuma function in MagickCore/pixel-accessor.h (bsc#1050635). - CVE-2017-11525: Prevent memory consumption in the ReadCINImage function that allowed remote attackers to cause a denial of service (bsc#1050098). - CVE-2017-9262: The ReadJNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043353) - CVE-2017-9261: The ReadMNGImage function in coders/png.c allowed attackers to cause a denial of service (memory leak) via a crafted file (bsc#1043354) - CVE-2017-10995: The mng_get_long function in coders/png.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted MNG image (bsc#1047908) - CVE-2017-11539: Prevent memory leak in the ReadOnePNGImage() function in coders/png.c (bsc#1050037) - CVE-2017-11505: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file (bsc#1050072) - CVE-2017-11526: The ReadOneMNGImage function in coders/png.c allowed remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted file (bsc#1050100) - CVE-2017-11750: The ReadOneJNGImage function in coders/png.c allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file (bsc#1051442) - CVE-2017-12565: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052470) - CVE-2017-12676: Prevent memory leak in the function ReadOneJNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052708) - CVE-2017-12673: Prevent memory leak in the function ReadOneMNGImage in coders/png.c, which allowed attackers to cause a denial of service (bsc#1052717) - CVE-2017-12671: Added NULL assignment in coders/png.c to prevent an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allowed attackers to cause a denial of service (bsc#1052721) - CVE-2017-12643: Prevent a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052768) - CVE-2017-12641: Prevent a memory leak vulnerability in ReadOneJNGImage in coders\png.c (bsc#1052777) - CVE-2017-12640: Prevent an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c (bsc#1052781) - CVE-2017-12935: The ReadMNGImage function in coders/png.c mishandled large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c (bsc#1054600) - CVE-2017-13147: Prevent allocation failure in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value (bsc#1055374) - CVE-2017-13142: Added additional checks for short files to prevent a crafted PNG file from triggering a crash (bsc#1055455) - CVE-2017-13141: Prevent memory leak in ReadOnePNGImage in coders/png.c (bsc#1055456) - CVE-2017-14103: The ReadJNGImage and ReadOneJNGImage functions in coders/png.c did not properly manage image pointers after certain error conditions, which allowed remote attackers to conduct use-after-free attacks via a crafted file, related to a ReadMNGImage out-of-order CloseBlob call (bsc#1057000) - CVE-2017-14649: ReadOneJNGImage in coders/png.c did not properly validate JNG data, leading to a denial of service (assertion failure in magick/pixel_cache.c, and application crash) (bsc#1060162) - CVE-2017-15218: Prevent memory leak in ReadOneJNGImage in coders/png.c (bsc#1062752) - CVE-2017-17504: Prevent heap-based buffer over-read via a crafted file in Magick_png_read_raw_profile, related to ReadOneMNGImage (bsc#1072362) - CVE-2017-17879: Prevent heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error (bsc#1074125) - CVE-2017-17914: Prevent crafted files to cause a large loop in ReadOneMNGImage (bsc#1074185) - CVE-2017-17884: Prevent memory leak in the function WriteOnePNGImage in coders/png.c, which allowed attackers to cause a denial of service via a crafted PNG image file (bsc#1074120) - Prevent memory leak in svg.c, which allowed attackers to cause a denial of service via a crafted SVG image file (bsc#1074120) - Prevent small memory leak when processing PWP image files (bsc#1074309) - CVE-2017-18029: Prevent memory leak in the function ReadMATImage which allowed remote attackers to cause a denial of service via a crafted file (bsc#1076021) - CVE-2017-18027: Prevent memory leak vulnerability in the function ReadMATImage which allowed remote attackers to cause a denial of service via a crafted file (bsc#1076051) Moderate SUSE bug 1043353 SUSE bug 1043354 SUSE bug 1047908 SUSE bug 1050037 SUSE bug 1050072 SUSE bug 1050098 SUSE bug 1050100 SUSE bug 1050635 SUSE bug 1051442 SUSE bug 1052470 SUSE bug 1052708 SUSE bug 1052717 SUSE bug 1052721 SUSE bug 1052768 SUSE bug 1052777 SUSE bug 1052781 SUSE bug 1054600 SUSE bug 1055374 SUSE bug 1055455 SUSE bug 1055456 SUSE bug 1057000 SUSE bug 1060162 SUSE bug 1062752 SUSE bug 1072362 SUSE bug 1074120 SUSE bug 1074125 SUSE bug 1074185 SUSE bug 1074309 SUSE bug 1075939 SUSE bug 1076021 SUSE bug 1076051 CVE-2017-10995 CVE-2017-11505 CVE-2017-11525 CVE-2017-11526 CVE-2017-11539 CVE-2017-11639 CVE-2017-11750 CVE-2017-12565 CVE-2017-12640 CVE-2017-12641 CVE-2017-12643 CVE-2017-12671 CVE-2017-12673 CVE-2017-12676 CVE-2017-12935 CVE-2017-13141 CVE-2017-13142 CVE-2017-13147 CVE-2017-14103 CVE-2017-14649 CVE-2017-15218 CVE-2017-17504 CVE-2017-17879 CVE-2017-17884 CVE-2017-17914 CVE-2017-18027 CVE-2017-18029 CVE-2017-9261 CVE-2017-9262 CVE-2018-5685 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - CVE-2017-9407: In ImageMagick, the ReadPALMImage function in palm.c allowed attackers to cause a denial of service (memory leak) via a crafted file. (bsc#1042824) - CVE-2017-11448: The ReadJPEGImage function in coders/jpeg.c in ImageMagick allowed remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. (bsc#1049375) - CVE-2017-11450: A remote denial of service in coders/jpeg.c was fixed (bsc#1049374) - CVE-2017-11537: When ImageMagick processed a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an incorrect bits-per-pixel calculation. (bsc#1050048) - CVE-2017-12418: ImageMagick had memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c. (bsc#1052207) - CVE-2017-12432: In ImageMagick, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allowed attackers to cause a denial of service. (bsc#1052254) - CVE-2017-12654: The ReadPICTImage function in coders/pict.c in ImageMagick allowed attackers to cause a denial of service (memory leak) via a crafted file. (bsc#1052761) - CVE-2017-12664: ImageMagick had a memory leak vulnerability in WritePALMImage in coders/palm.c. (bsc#1052750) - CVE-2017-12665: ImageMagick had a memory leak vulnerability in WritePICTImage in coders/pict.c. (bsc#1052747) - CVE-2017-12668: ImageMagick had a memory leak vulnerability in WritePCXImage in coders/pcx.c. (bsc#1052688) - CVE-2017-13058: In ImageMagick, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allowed attackers to cause a denial of service via a crafted file. (bsc#1055069) - CVE-2017-14224: A heap-based buffer overflow in WritePCXImage in coders/pcx.c could lead to denial of service or code execution. (bsc#1058009) - CVE-2017-17885: In ImageMagick, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allowed attackers to cause a denial of service via a crafted PICT image file. (bsc#1074119) - CVE-2017-18028: A memory exhaustion in the function ReadTIFFImage in coders/tiff.c was fixed. (bsc#1076182) - CVE-2018-6405: In the ReadDCMImage function in coders/dcm.c in ImageMagick, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allowed remote attackers to cause a denial of service. (bsc#1078433) - CVE-2017-12427: ProcessMSLScript coders/msl.c allowed remote attackers to cause a DoS (bsc#1052248) - CVE-2017-12566: A memory leak in ReadMVGImage in coders/mvg.c, could have allowed attackers to cause DoS (bsc#1052472) - CVE-2017-11638, CVE-2017-11642: A NULL pointer dereference in theWriteMAPImage() in coders/map.c was fixed which could lead to a crash (bsc#1050617) - CVE-2017-13131: A memory leak vulnerability was found in thefunction ReadMIFFImage in coders/miff.c, which allowed attackers tocause a denial of service (memory consumption in NewL (bsc#1055229) - CVE-2017-11166: In ReadXWDImage in coders\xwd.c a memoryleak could have caused memory exhaustion via a crafted length (bsc#1048110) - CVE-2017-12674: A CPU exhaustion in ReadPDBImage in coders/pdb.c was fixed, which allowed attackers to cause DoS (bsc#1052711) - CVE-2017-12429: A memory exhaustion flaw in ReadMIFFImage in coders/miff.c was fixed, which allowed attackers to cause DoS (bsc#1052251) - CVE-2017-11637: A NULL pointer dereference in WritePCLImage() in coders/pcl.c was fixed which could lead to a crash (bsc#1050669) Moderate SUSE bug 1042824 SUSE bug 1048110 SUSE bug 1049374 SUSE bug 1049375 SUSE bug 1050048 SUSE bug 1050617 SUSE bug 1050669 SUSE bug 1052207 SUSE bug 1052248 SUSE bug 1052251 SUSE bug 1052254 SUSE bug 1052472 SUSE bug 1052688 SUSE bug 1052711 SUSE bug 1052747 SUSE bug 1052750 SUSE bug 1052761 SUSE bug 1055069 SUSE bug 1055229 SUSE bug 1058009 SUSE bug 1074119 SUSE bug 1076182 SUSE bug 1078433 CVE-2017-11166 CVE-2017-11448 CVE-2017-11450 CVE-2017-11537 CVE-2017-11637 CVE-2017-11638 CVE-2017-11642 CVE-2017-12418 CVE-2017-12427 CVE-2017-12429 CVE-2017-12432 CVE-2017-12566 CVE-2017-12654 CVE-2017-12664 CVE-2017-12665 CVE-2017-12668 CVE-2017-12674 CVE-2017-13058 CVE-2017-13131 CVE-2017-14224 CVE-2017-17885 CVE-2017-18028 CVE-2017-9407 CVE-2018-6405 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2017-9405: A memory leak in the ReadICONImage function was fixed that could lead to DoS via memory exhaustion (bsc#1042911) - CVE-2017-11528: ReadDIBImage in coders/dib.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050119) - CVE-2017-11530: ReadEPTImage in coders/ept.c allows remote attackers to cause DoS via memory exhaustion (bsc#1050122) - CVE-2017-11533: A information leak by 1 byte due to heap-based buffer over-read in the WriteUILImage() in coders/uil.c was fixed (bsc#1050132) - CVE-2017-12663: A memory leak in WriteMAPImage in coders/map.c was fixed that could lead to a DoS via memory exhaustion (bsc#1052754) - CVE-2017-17682: A large loop vulnerability was fixed in ExtractPostscript in coders/wpg.c, which allowed attackers to cause a denial of service (CPU exhaustion) (bsc#1072898) Moderate SUSE bug 1042911 SUSE bug 1050119 SUSE bug 1050122 SUSE bug 1050132 SUSE bug 1052754 SUSE bug 1072898 CVE-2017-11528 CVE-2017-11530 CVE-2017-11533 CVE-2017-12663 CVE-2017-17682 CVE-2017-9405 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes several issues. These security issues were fixed: - CVE-2018-8804: The WriteEPTImage function allowed remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file (bsc#1086011) - CVE-2017-11524: The WriteBlob function allowed remote attackers to cause a denial of service (assertion failure and application exit) via a crafted file (bsc#1050087) - CVE-2017-18219: Prevent allocation failure in the function ReadOnePNGImage, which allowed attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation (bsc#1084060). - CVE-2017-9500: Prevent assertion failure in the function ResetImageProfileIterator, which allowed attackers to cause a denial of service via a crafted file (bsc#1043290) - CVE-2017-16353: Prevent memory information disclosure in the DescribeImage function caused by a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments were never checked (bsc#1066170) - CVE-2017-16352: Prevent a heap-based buffer overflow in the "Display visual image directory" feature of the DescribeImage() function. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag (bsc#1066168) - CVE-2017-14314: Prevent off-by-one error in the DrawImage function that allowed remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file (bsc#1058630) - CVE-2017-13768: Prevent NULL pointer dereference in the IdentifyImage function that allowed an attacker to perform denial of service by sending a crafted image file (bsc#1056434) - CVE-2017-14505: Fixed handling of NULL arrays, which allowed attackers to perform Denial of Service (NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c) by providing a crafted Image File as input (bsc#1059735) - CVE-2018-7443: The ReadTIFFImage function did not properly validate the amount of image data in a file, which allowed remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c) (bsc#1082792) - CVE-2017-15016: Prevent NULL pointer dereference vulnerability in ReadEnhMetaFile allowing for denial of service (bsc#1082291) - CVE-2017-15017: Prevent NULL pointer dereference vulnerability in ReadOneMNGImage allowing for denial of service (bsc#1082283) - CVE-2017-12692: The ReadVIFFImage function allowed remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file (bsc#1082362) - CVE-2017-12693: The ReadBMPImage function allowed remote attackers to cause a denial of service (memory consumption) via a crafted BMP file (bsc#1082348) Moderate SUSE bug 1043290 SUSE bug 1050087 SUSE bug 1056434 SUSE bug 1058630 SUSE bug 1059735 SUSE bug 1066168 SUSE bug 1066170 SUSE bug 1082283 SUSE bug 1082291 SUSE bug 1082348 SUSE bug 1082362 SUSE bug 1082792 SUSE bug 1084060 SUSE bug 1086011 CVE-2017-11524 CVE-2017-12691 CVE-2017-12692 CVE-2017-12693 CVE-2017-13768 CVE-2017-14314 CVE-2017-14343 CVE-2017-14505 CVE-2017-15016 CVE-2017-15017 CVE-2017-16352 CVE-2017-16353 CVE-2017-18219 CVE-2017-9500 CVE-2018-7443 CVE-2018-8804 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - security update (png.c) * CVE-2018-9018: divide-by-zero in the ReadMNGImage function of coders/png.c. Attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file. [bsc#1086773] * CVE-2018-10177: there is an infinite loop in the ReadOneMNGImagefunction of the coders/png.c file. Remote attackers could leverage thisvulnerability to cause a denial of service (bsc#1089781) - security update (wand) * CVE-2017-18252: The MogrifyImageList function in MagickWand/mogrify.c could allow attackers to cause a denial of service via a crafted file. [bsc#1087033] - security update (gif.c) * CVE-2017-18254: A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which could lead to denial of service via a crafted file. [bsc#1087027] - security update (core) * CVE-2017-10928: a heap-based buffer over-read in the GetNextToken function in token.c could allow attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the GetUserSpaceCoordinateValue function in coders/svg.c. [bsc#1047356] - security update (pcd.c) * CVE-2017-18251: A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which could lead to a denial of service via a crafted file. [bsc#1087037] - security update (gif.c) * CVE-2017-18254: A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which could lead to denial of service via a crafted file. [bsc#1087027] - security update (tiff.c) * CVE-2018-8960: The ReadTIFFImage function in coders/tiff.c in ImageMagick memory allocation issue could lead to denial of service (bsc#1086782) Moderate SUSE bug 1047356 SUSE bug 1086773 SUSE bug 1086782 SUSE bug 1087027 SUSE bug 1087033 SUSE bug 1087037 SUSE bug 1089781 CVE-2017-1000476 CVE-2017-10928 CVE-2017-18251 CVE-2017-18252 CVE-2017-18254 CVE-2018-10177 CVE-2018-8960 CVE-2018-9018 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2018-11251: Heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service (bsc#1094237) - CVE-2017-18271: Infinite loop in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (bsc#1094204) - CVE-2017-13758: Heap-based buffer overflow in the TracePoint() in MagickCore/draw.c, which allows attackers to cause a denial of service(bsc#1056277) - CVE-2018-10805: Fixed several memory leaks in rgb.c, cmyk.c, gray.c, and ycbcr.c (bsc#1095812) - CVE-2018-12600: The ReadDIBImage and WriteDIBImage functions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098545) - CVE-2018-12599: The ReadBMPImage and WriteBMPImage fucntions allowed attackers to cause an out of bounds write via a crafted file (bsc#1098546) - CVE-2018-14434: Fixed a memory leak for a colormap in WriteMPCImage in coders/mpc.c (bsc#1102003) - CVE-2018-14435: Fixed a memory leak in DecodeImage in coders/pcd.c (bsc#1102007) - CVE-2018-14436: Fixed a memory leak in ReadMIFFImage in coders/miff.c (bsc#1102005) - CVE-2018-14437: Fixed a memory leak in parse8BIM in coders/meta.c (bsc#1102004) Moderate SUSE bug 1056277 SUSE bug 1094204 SUSE bug 1094237 SUSE bug 1095812 SUSE bug 1098545 SUSE bug 1098546 SUSE bug 1102003 SUSE bug 1102004 SUSE bug 1102005 SUSE bug 1102007 CVE-2017-13758 CVE-2017-18271 CVE-2018-10805 CVE-2018-11251 CVE-2018-12599 CVE-2018-12600 CVE-2018-14434 CVE-2018-14435 CVE-2018-14436 CVE-2018-14437 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issue fixed: - Hide PS, XPS and PDF coders into */vulnerable (bsc#1105592) Important SUSE bug 1105592 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following security issue: - CVE-2017-17934: Prevent memory leaks, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls (bsc#1074170). - CVE-2018-16750: Prevent memory leak in the formatIPTCfromBuffer function (bsc#1108283) - CVE-2018-16749: Added missing NULL check in ReadOneJNGImage that allowed an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file (bsc#1108282) - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989). - CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM file that has a negative pixel value. If the affected code was used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data (bsc#1106855) - CVE-2018-16642: The function InsertRow allowed remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write (bsc#1107616) - CVE-2018-16643: The functions ReadDCMImage, ReadPWPImage, ReadCALSImage, and ReadPICTImage did check the return value of the fputc function, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107612) - CVE-2018-16644: Added missing check for length in the functions ReadDCMImage and ReadPICTImage, which allowed remote attackers to cause a denial of service via a crafted image (bsc#1107609) - CVE-2018-16645: Prevent excessive memory allocation issue in the functions ReadBMPImage and ReadDIBImage, which allowed remote attackers to cause a denial of service via a crafted image file (bsc#1107604) - CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file (bsc#1111069) - CVE-2018-18016: Fixed a memory leak in WritePCXImage (bsc#1111072) - CVE-2018-17965: Fixed a memory leak in WriteSGIImage (bsc#1110747) - CVE-2018-17966: Fixed a memory leak in WritePDBImage (bsc#1110746) Moderate SUSE bug 1074170 SUSE bug 1106855 SUSE bug 1106989 SUSE bug 1107604 SUSE bug 1107609 SUSE bug 1107612 SUSE bug 1107616 SUSE bug 1108282 SUSE bug 1108283 SUSE bug 1110746 SUSE bug 1110747 SUSE bug 1111069 SUSE bug 1111072 CVE-2017-17934 CVE-2018-16323 CVE-2018-16413 CVE-2018-16642 CVE-2018-16643 CVE-2018-16644 CVE-2018-16645 CVE-2018-16749 CVE-2018-16750 CVE-2018-17965 CVE-2018-17966 CVE-2018-18016 CVE-2018-18024 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - CVE-2017-14997: ImageMagick allowed remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. (bsc#1112399) - CVE-2018-16644: A regression in the security fix for the pict coder was fixed (bsc#1107609) - CVE-2017-11532: When ImageMagick processed a crafted file in convert, it could lead to a Memory Leak in the WriteMPCImage() function in coders/mpc.c. (bsc#1050129) - CVE-2017-11639: A regression in the security fix in the cip coder was fixed (bsc#1050635) Moderate SUSE bug 1050129 SUSE bug 1050635 SUSE bug 1107609 SUSE bug 1112399 CVE-2017-11532 CVE-2017-11639 CVE-2017-14997 CVE-2018-16644 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function (bsc#1128649). - CVE-2018-18544: Fixed memory leak in the function WriteMSLImage (bsc#1113064). - CVE-2018-20467: Fixed infinite loop in coders/bmp.c (bsc#1120381). - CVE-2019-7397: Fixed a memory leak in the function WritePDFImage (bsc#1124366). - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS (bsc#1106989). - CVE-2018-16412: Prevent heap-based buffer over-read in the ParseImageResourceBlocks function leading to DOS (bsc#1106996). - CVE-2019-7398: Fixed a memory leak in the function WriteDIBImage (bsc#1124365). Moderate SUSE bug 1106989 SUSE bug 1106996 SUSE bug 1113064 SUSE bug 1120381 SUSE bug 1124365 SUSE bug 1124366 SUSE bug 1128649 CVE-2018-16412 CVE-2018-16413 CVE-2018-18544 CVE-2018-20467 CVE-2019-7175 CVE-2019-7397 CVE-2019-7398 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-9956: Fixed a stack-based buffer overflow in PopHexPixel() (bsc#1130330). - CVE-2019-10650: Fixed a heap-based buffer over-read in WriteTIFFImage() (bsc#1131317). - CVE-2019-11007: Fixed a heap-based buffer overflow in ReadMNGImage() (bsc#1132060). - CVE-2019-11009: Fixed a heap-based buffer over-read in ReadXWDImage() (bsc#1132053). - CVE-2019-11472: Fixed a denial-of-service in ReadXWDImage() (bsc#1133204). - CVE-2019-11470: Fixed a denial-of-service in ReadCINImage() (bsc#1133205). - CVE-2019-11506: Fixed a heap-based buffer overflow in the WriteMATLABImage() (bsc#1133498). - CVE-2019-11505: Fixed a heap-based buffer overflow in the WritePDBImage() (bsc#1133501). Moderate SUSE bug 1130330 SUSE bug 1131317 SUSE bug 1132053 SUSE bug 1132060 SUSE bug 1133204 SUSE bug 1133205 SUSE bug 1133498 SUSE bug 1133501 CVE-2019-10650 CVE-2019-11007 CVE-2019-11009 CVE-2019-11470 CVE-2019-11472 CVE-2019-11505 CVE-2019-11506 CVE-2019-9956 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issue fixed: - CVE-2019-10131: Fixed a off-by-one read in formatIPTCfromBuffer function in coders/meta.c (bsc#1134075). - CVE-2017-12805: Fixed a denial of service through memory exhaustion in ReadTIFFImage() (bsc#1135236). - CVE-2019-11598: Fixed a heap-based buffer over-read in WritePNMImage() (bsc#1136732) We also now disable PCL in the -SUSE configuration, as it also uses ghostscript for decoding (bsc#1136183) Low SUSE bug 1134075 SUSE bug 1135232 SUSE bug 1135236 SUSE bug 1136183 SUSE bug 1136732 CVE-2017-12805 CVE-2017-12806 CVE-2019-10131 CVE-2019-11598 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: Security issues fixed: - CVE-2019-11597: Fixed a heap-based buffer over-read in the WriteTIFFImage() (bsc#1138464). - Fixed a file content disclosure via SVG and WMF decoding (bsc#1138425). Moderate SUSE bug 1138425 SUSE bug 1138464 CVE-2019-11597 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ImageMagick fixes the following issues: - CVE-2019-13301: Fixed a memory leak in AcquireMagickMemory() (bsc#1140554). - CVE-2019-13311: Fixed a memory leak at AcquireMagickMemory because of a wand/mogrify.c error (bsc#1140513). - CVE-2019-13454: Fixed a division by zero in RemoveDuplicateLayers in MagickCore/layer.c (bsc#1141171). - CVE-2019-13295: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140664). - CVE-2019-13297: Fixed a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage (bsc#1140666). - CVE-2019-12979: Fixed the use of uninitialized values in SyncImageSettings() (bsc#1139886). - CVE-2019-12975: Fixed a memory leak in the WriteDPXImage() in coders/dpx.c (bsc#1140106). - CVE-2019-13135: Fixed the use of uninitialized values in ReadCUTImage() (bsc#1140103). - CVE-2019-13133: Fixed a memory leak in the ReadBMPImage() (bsc#1140100). - CVE-2019-13134: Fixed a memory leak in the ReadVIFFImage() (bsc#1140102). - CVE-2019-12976: Fixed a memory leak in the ReadPCLImage() in coders/pcl.c(bsc#1140110). Moderate SUSE bug 1139886 SUSE bug 1140100 SUSE bug 1140102 SUSE bug 1140103 SUSE bug 1140106 SUSE bug 1140110 SUSE bug 1140513 SUSE bug 1140554 SUSE bug 1140664 SUSE bug 1140666 SUSE bug 1141171 CVE-2019-12975 CVE-2019-12976 CVE-2019-12979 CVE-2019-13133 CVE-2019-13134 CVE-2019-13135 CVE-2019-13295 CVE-2019-13297 CVE-2019-13301 CVE-2019-13311 CVE-2019-13454 SUSE Linux Enterprise Server 11 SP3-TERADATA LibVNCServer was updated to fix two security issues. These security issues were fixed: - CVE-2016-9941: Heap-based buffer overflow in rfbproto.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area (bsc#1017711) - CVE-2016-9942: Heap-based buffer overflow in ultra.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions (bsc#1017712) Important SUSE bug 1017711 SUSE bug 1017712 CVE-2016-9941 CVE-2016-9942 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for LibVNCServer fixes the following issues: - CVE-2018-7225: Missing input sanitization inside rfbserver.c rfbProcessClientNormalMessage() (bsc#1081493). Moderate SUSE bug 1081493 CVE-2018-7225 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-15126: Fixed use-after-free in file transfer extension (bsc#1120114) - CVE-2018-6307: Fixed use-after-free in file transfer extension server code (bsc#1120115) - CVE-2018-20020: Fixed heap out-of-bound write inside structure in VNC client code (bsc#1120116) - CVE-2018-15127: Fixed heap out-of-bounds write in rfbserver.c (bsc#1120117) - CVE-2018-20019: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1120118) - CVE-2018-20022: Fixed information disclosure through improper initialization in VNC client code (bsc#1120120) - CVE-2018-20024: Fixed NULL pointer dereference in VNC client code (bsc#1120121) - CVE-2018-20021: Fixed infinite loop in VNC client code (bsc#1120122) Important SUSE bug 1120114 SUSE bug 1120115 SUSE bug 1120116 SUSE bug 1120117 SUSE bug 1120118 SUSE bug 1120120 SUSE bug 1120121 SUSE bug 1120122 CVE-2018-15126 CVE-2018-15127 CVE-2018-20019 CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20024 CVE-2018-6307 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for LibVNCServer fixes the following issues: Security issues fixed: - CVE-2018-20749: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123828) - CVE-2018-20750: Fixed a heap out of bounds write vulnerability in rfbserver.c (bsc#1123832) - CVE-2018-20748: Fixed multiple heap out-of-bound writes in VNC client code (bsc#1123823) Critical SUSE bug 1123823 SUSE bug 1123828 SUSE bug 1123832 CVE-2018-20748 CVE-2018-20749 CVE-2018-20750 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA A memory corruption in the Mesa Intel drivers (OOB read/write) has been fixed. (CVE-2013-1872) This could have been potentially exploited by remote attackers who would have been able to inject 3d graphics into the attacked desktop. Security Issue reference: * CVE-2013-1872 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1872> SUSE bug 828007 CVE-2013-1872 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to Firefox 17.0.9esr (bnc#840485) addresses: * MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object o (CVE-2013-1737) * MFSA 2013-90 Memory corruption involving scrolling o use-after-free in mozilla::layout::ScrollbarActivity (CVE-2013-1735) o Memory corruption in nsGfxScrollFrameInner::IsLTR() (CVE-2013-1736) * MFSA 2013-89 Buffer overflow with multi-column, lists, and floats o buffer overflow at nsFloatManager::GetFlowArea() with multicol, list, floats (CVE-2013-1732) * MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes o compartment mismatch in nsXBLBinding::DoInitJSClass (CVE-2013-1730) * MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification o MAR signature bypass in Updater could lead to downgrade (CVE-2013-1726) * MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption o ABORT: bad scope for new JSObjects: ReparentWrapper / document.open (CVE-2013-1725) * MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning o Heap-use-after-free in nsAnimationManager::BuildAnimations (CVE-2013-1722) * MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9) o Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0 (CVE-2013-1718) * MFSA 2013-65 Buffer underflow when generating CRMF requests o ASAN heap-buffer-overflow (read 1) in cryptojs_interpret_key_gen_type (CVE-2013-1705) Security Issue references: * CVE-2013-1737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737> * CVE-2013-1735 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735> * CVE-2013-1736 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1736> * CVE-2013-1732 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732> * CVE-2013-1730 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1730> * CVE-2013-1726 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726> * CVE-2013-1725 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1725> * CVE-2013-1722 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722> * CVE-2013-1718 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718> * CVE-2013-1705 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1705> SUSE bug 840485 CVE-2013-1705 CVE-2013-1718 CVE-2013-1722 CVE-2013-1725 CVE-2013-1726 CVE-2013-1730 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This security update (bsc#940918) fixes the following issues: * MFSA 2015-78 (CVE-2015-4495, bmo#1178058): Same origin violation * Remove PlayPreview registration from PDF Viewer (bmo#1179262) Critical SUSE bug 940918 CVE-2015-4495 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox was updated to version 38.5.0 esr to fix the following issues: Following security issues were fixed: * MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5) * MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC when datachannel is used after being destroyed * MFSA 2015-139/CVE-2015-7212 Integer overflow allocating extremely large textures * MFSA 2015-145/CVE-2015-7205 Underflow through code inspection * MFSA 2015-146/CVE-2015-7213 Integer overflow in MP4 playback in 64-bit versions * MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer overflow processing MP4 metadata in libstagefright * MFSA 2015-149/CVE-2015-7214 Cross-site reading attack through data and view-source URIs Important SUSE bug 959277 CVE-2015-7201 CVE-2015-7202 CVE-2015-7205 CVE-2015-7210 CVE-2015-7212 CVE-2015-7213 CVE-2015-7214 CVE-2015-7222 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox fixes the following issues: - update to Firefox 38.6.1 ESR (bsc#967087) * MFSA 2016-14/CVE-2016-1523 (bmo#1246093) Vulnerabilities in Graphite 2 Important SUSE bug 967087 CVE-2016-1523 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update to MozillaFirefox 38.8.0 ESR fixes the following security issues (bsc#977333): - CVE-2016-2805: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977374) - CVE-2016-2807: Miscellaneous memory safety hazards - MFSA 2016-39 (bsc#977376) - CVE-2016-2808: Write to invalid HashMap entry through JavaScript.watch() - MFSA 2016-47 (bsc#977386) - CVE-2016-2814: Buffer overflow in libstagefright with CENC offsets - MFSA 2016-44 (bsc#977381) Important SUSE bug 977333 SUSE bug 977374 SUSE bug 977376 SUSE bug 977381 SUSE bug 977386 CVE-2016-2805 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss were updated to fix nine security issues. MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed: - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) These non-security issues were fixed: - Fix crashes on aarch64 * Determine page size at runtime (bsc#984006) * Allow aarch64 to work in safe mode (bsc#985659) - Fix crashes on mainframes All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details. Important SUSE bug 983549 SUSE bug 983638 SUSE bug 983639 SUSE bug 983643 SUSE bug 983646 SUSE bug 983651 SUSE bug 983652 SUSE bug 983653 SUSE bug 983655 SUSE bug 984006 SUSE bug 985659 CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2828 CVE-2016-2831 CVE-2016-2834 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809): * MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) * MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed * MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content * MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 * MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering * MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus * MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown * MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events * MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes * MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback * MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation * MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects * MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file * CVE-2016-6354: Fix for possible buffer overrun (bsc#990856) Also a temporary workaround was added: - Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628) Important SUSE bug 989196 SUSE bug 990628 SUSE bug 990856 SUSE bug 991809 CVE-2016-2830 CVE-2016-2835 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-2839 CVE-2016-5252 CVE-2016-5254 CVE-2016-5258 CVE-2016-5259 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-6354 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox was updated to 45.4.0 ESR to fix the following issues (bsc#999701): The following security issue were fixed: * MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString * MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin * MFSA 2016-86/CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList * MFSA 2016-86/CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState * MFSA 2016-86/CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick * MFSA 2016-86/CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame * MFSA 2016-86/CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap * MFSA 2016-86/CVE-2016-5281: use-after-free in DOMSVGLength * MFSA 2016-86/CVE-2016-5284: Add-on update site certificate pin expiration * MFSA 2016-86/CVE-2016-5250: Resource Timing API is storing resources sent by the previous page * MFSA 2016-86/CVE-2016-5261: Integer overflow and memory corruption in WebSocketChannel * MFSA 2016-86/CVE-2016-5257: Various memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 Important SUSE bug 999701 CVE-2016-5250 CVE-2016-5257 CVE-2016-5261 CVE-2016-5270 CVE-2016-5272 CVE-2016-5274 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5280 CVE-2016-5281 CVE-2016-5284 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: * MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES * MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution * MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees * MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements * MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms * MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments * MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag * MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs * MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 * MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information. Also the following bug was fixed: - Fix fontconfig issue (bsc#1000751) on 32bit systems as well. Important SUSE bug 1000751 SUSE bug 1015422 CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox 45 ESR was updated to 45.7 to fix the following issues (bsc#1021991): * MFSA 2017-02/CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bsc#1021818) * MFSA 2017-02/CVE-2017-5396: Use-after-free with Media Decoder (bsc#1021821) * MFSA 2017-02/CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bsc#1021823) * MFSA 2017-02/CVE-2017-5380: Potential use-after-free during DOM manipulations (bsc#1021819) * MFSA 2017-02/CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bsc#1021820) * MFSA 2017-02/CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (bsc#1021824) * MFSA 2017-02/CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bsc#1021814) * MFSA 2017-02/CVE-2017-5376: Use-after-free in XSL (bsc#1021817) * MFSA 2017-02/CVE-2017-5383: Location bar spoofing with unicode characters (bsc#1021822) Please see https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ for more information. Important SUSE bug 1021814 SUSE bug 1021817 SUSE bug 1021818 SUSE bug 1021819 SUSE bug 1021820 SUSE bug 1021821 SUSE bug 1021822 SUSE bug 1021823 SUSE bug 1021824 SUSE bug 1021991 CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5386 CVE-2017-5390 CVE-2017-5396 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox to ESR 45.8 fixes the following issues: Security issues fixed (bsc#1028391): - CVE-2017-5402: Use-after-free working with events in FontFace objects - CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP - CVE-2017-5401: Memory Corruption when handling ErrorResult - CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters - CVE-2017-5404: Use-after-free working with ranges in selections - CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports - CVE-2017-5408: Cross-origin reading of video captions in violation of CORS - CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service - CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8 Bugfixes: - fix crashes on Itanium (bsc#1027527) Important SUSE bug 1027527 SUSE bug 1028391 CVE-2017-5398 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5404 CVE-2017-5405 CVE-2017-5407 CVE-2017-5408 CVE-2017-5409 CVE-2017-5410 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to the Firefox ESR release 45.9. Mozilla NSS was updated to support TLS 1.3 (close to release draft) and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes. Security issues fixed in Firefox (bsc#1035082) - MFSA 2017-11/CVE-2017-5469: Potential Buffer overflow in flex-generated code - MFSA 2017-11/CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - MFSA 2017-11/CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing - MFSA 2017-11/CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing - MFSA 2017-11/CVE-2017-5437: Vulnerabilities in Libevent library - MFSA 2017-11/CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 - MFSA 2017-11/CVE-2017-5435: Use-after-free during transaction processing in the editor - MFSA 2017-11/CVE-2017-5434: Use-after-free during focus handling - MFSA 2017-11/CVE-2017-5433: Use-after-free in SMIL animation functions - MFSA 2017-11/CVE-2017-5432: Use-after-free in text input selection - MFSA 2017-11/CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - MFSA 2017-11/CVE-2017-5465: Out-of-bounds read in ConvolvePixel - MFSA 2017-11/CVE-2017-5460: Use-after-free in frame selection - MFSA 2017-11/CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - MFSA 2017-11/CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - MFSA 2017-11/CVE-2017-5447: Out-of-bounds read during glyph processing - MFSA 2017-11/CVE-2017-5444: Buffer overflow while parsing application/http-index-format content - MFSA 2017-11/CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content - MFSA 2017-11/CVE-2017-5442: Use-after-free during style changes - MFSA 2017-11/CVE-2017-5443: Out-of-bounds write during BinHex decoding - MFSA 2017-11/CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing - MFSA 2017-11/CVE-2017-5441: Use-after-free with selection during scroll events - MFSA 2017-11/CVE-2017-5459: Buffer overflow in WebGL Mozilla NSS was updated to 3.29.5, bringing new features and fixing bugs: - Update to NSS 3.29.5: * MFSA 2017-11/CVE-2017-5461: Rare crashes in the base 64 decoder and encoder were fixed. * MFSA 2017-11/CVE-2017-5462: A carry over bug in the RNG was fixed. * CVE-2016-9574: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA (bsc#1015499). * requires NSPR >= 4.13.1 - Update to NSS 3.29.3 * enables TLS 1.3 by default - Fixed a bug in hash computation (and build with GCC 7 which complains about shifts of boolean values). (bsc#1030071, bmo#1348767) - Update to NSS 3.28.3 This is a patch release to fix binary compatibility issues. - Update to NSS 3.28.1 This is a patch release to update the list of root CA certificates. * The following CA certificates were Removed CN = Buypass Class 2 CA 1 CN = Root CA Generalitat Valenciana OU = RSA Security 2048 V3 * The following CA certificates were Added OU = AC RAIZ FNMT-RCM CN = Amazon Root CA 1 CN = Amazon Root CA 2 CN = Amazon Root CA 3 CN = Amazon Root CA 4 CN = LuxTrust Global Root 2 CN = Symantec Class 1 Public Primary Certification Authority - G4 CN = Symantec Class 1 Public Primary Certification Authority - G6 CN = Symantec Class 2 Public Primary Certification Authority - G4 CN = Symantec Class 2 Public Primary Certification Authority - G6 * The version number of the updated root CA list has been set to 2.11 - Update to NSS 3.28 New functionality: * NSS includes support for TLS 1.3 draft -18. This includes a number of improvements to TLS 1.3: - The signed certificate timestamp, used in certificate transparency, is supported in TLS 1.3. - Key exporters for TLS 1.3 are supported. This includes the early key exporter, which can be used if 0-RTT is enabled. Note that there is a difference between TLS 1.3 and key exporters in older versions of TLS. TLS 1.3 does not distinguish between an empty context and no context. - The TLS 1.3 (draft) protocol can be enabled, by defining NSS_ENABLE_TLS_1_3=1 when building NSS. - NSS includes support for the X25519 key exchange algorithm, which is supported and enabled by default in all versions of TLS. Notable Changes: * NSS can no longer be compiled with support for additional elliptic curves. This was previously possible by replacing certain NSS source files. * NSS will now detect the presence of tokens that support additional elliptic curves and enable those curves for use in TLS. Note that this detection has a one-off performance cost, which can be avoided by using the SSL_NamedGroupConfig function to limit supported groups to those that NSS provides. * PKCS#11 bypass for TLS is no longer supported and has been removed. * Support for "export" grade SSL/TLS cipher suites has been removed. * NSS now uses the signature schemes definition in TLS 1.3. This also affects TLS 1.2. NSS will now only generate signatures with the combinations of hash and signature scheme that are defined in TLS 1.3, even when negotiating TLS 1.2. - This means that SHA-256 will only be used with P-256 ECDSA certificates, SHA-384 with P-384 certificates, and SHA-512 with P-521 certificates. SHA-1 is permitted (in TLS 1.2 only) with any certificate for backward compatibility reasons. - NSS will now no longer assume that default signature schemes are supported by a peer if there was no commonly supported signature scheme. * NSS will now check if RSA-PSS signing is supported by the token that holds the private key prior to using it for TLS. * The certificate validation code contains checks to no longer trust certificates that are issued by old WoSign and StartCom CAs after October 21, 2016. This is equivalent to the behavior that Mozilla will release with Firefox 51. - Update to NSS 3.27.2 * Fixed SSL_SetTrustAnchors leaks (bmo#1318561) - raised the minimum softokn/freebl version to 3.28 as reported in (boo#1021636) - Update to NSS 3.26.2 New Functionality: * the selfserv test utility has been enhanced to support ALPN (HTTP/1.1) and 0-RTT * added support for the System-wide crypto policy available on Fedora Linux see http://fedoraproject.org/wiki/Changes/CryptoPolicy * introduced build flag NSS_DISABLE_LIBPKIX that allows compilation of NSS without the libpkix library Notable Changes: * The following CA certificate was Added CN = ISRG Root X1 * NPN is disabled and ALPN is enabled by default * the NSS test suite now completes with the experimental TLS 1.3 code enabled * several test improvements and additions, including a NIST known answer test Changes in 3.26.2 * MD5 signature algorithms sent by the server in CertificateRequest messages are now properly ignored. Previously, with rare server configurations, an MD5 signature algorithm might have been selected for client authentication and caused the client to abort the connection soon after. - Update to NSS 3.25 New functionality: * Implemented DHE key agreement for TLS 1.3 * Added support for ChaCha with TLS 1.3 * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF * In previous versions, when using client authentication with TLS 1.2, NSS only supported certificate_verify messages that used the same signature hash algorithm as used by the PRF. This limitation has been removed. Notable changes: * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3 * Regression fix: NSS no longer reports a failure if an application attempts to disable the SSLv2 protocol. * The list of trusted CA certificates has been updated to version 2.8 * The following CA certificate was Removed Sonera Class1 CA * The following CA certificates were Added Hellenic Academic and Research Institutions RootCA 2015 Hellenic Academic and Research Institutions ECC RootCA 2015 Certplus Root CA G1 Certplus Root CA G2 OpenTrust Root CA G1 OpenTrust Root CA G2 OpenTrust Root CA G3 - Update to NSS 3.24 New functionality: * NSS softoken has been updated with the latest National Institute of Standards and Technology (NIST) guidance (as of 2015): - Software integrity checks and POST functions are executed on shared library load. These checks have been disabled by default, as they can cause a performance regression. To enable these checks, you must define symbol NSS_FORCE_FIPS when building NSS. - Counter mode and Galois/Counter Mode (GCM) have checks to prevent counter overflow. - Additional CSPs are zeroed in the code. - NSS softoken uses new guidance for how many Rabin-Miller tests are needed to verify a prime based on prime size. * NSS softoken has also been updated to allow NSS to run in FIPS Level 1 (no password). This mode is triggered by setting the database password to the empty string. In FIPS mode, you may move from Level 1 to Level 2 (by setting an appropriate password), but not the reverse. * A SSL_ConfigServerCert function has been added for configuring SSL/TLS server sockets with a certificate and private key. Use this new function in place of SSL_ConfigSecureServer, SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses, and SSL_SetSignedCertTimestamps. SSL_ConfigServerCert automatically determines the certificate type from the certificate and private key. The caller is no longer required to use SSLKEAType explicitly to select a "slot" into which the certificate is configured (which incorrectly identifies a key agreement type rather than a certificate). Separate functions for configuring Online Certificate Status Protocol (OCSP) responses or Signed Certificate Timestamps are not needed, since these can be added to the optional SSLExtraServerCertData struct provided to SSL_ConfigServerCert. Also, partial support for RSA Probabilistic Signature Scheme (RSA-PSS) certificates has been added. Although these certificates can be configured, they will not be used by NSS in this version. * Deprecate the member attribute authAlgorithm of type SSLCipherSuiteInfo. Instead, applications should use the newly added attribute authType. * Add a shared library (libfreeblpriv3) on Linux platforms that define FREEBL_LOWHASH. * Remove most code related to SSL v2, including the ability to actively send a SSLv2-compatible client hello. However, the server-side implementation of the SSL/TLS protocol still supports processing of received v2-compatible client hello messages. * Disable (by default) NSS support in optimized builds for logging SSL/TLS key material to a logfile if the SSLKEYLOGFILE environment variable is set. To enable the functionality in optimized builds, you must define the symbol NSS_ALLOW_SSLKEYLOGFILE when building NSS. * Update NSS to protect it against the Cachebleed attack. * Disable support for DTLS compression. * Improve support for TLS 1.3. This includes support for DTLS 1.3. Note that TLS 1.3 support is experimental and not suitable for production use. - Update to NSS 3.23 New functionality: * ChaCha20/Poly1305 cipher and TLS cipher suites now supported * Experimental-only support TLS 1.3 1-RTT mode (draft-11). This code is not ready for production use. Notable changes: * The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers * The build time environment variable NSS_ENABLE_ZLIB has been renamed to NSS_SSL_ENABLE_ZLIB * The build time environment variable NSS_DISABLE_CHACHAPOLY was added, which can be used to prevent compilation of the ChaCha20/Poly1305 code. * The following CA certificates were Removed - Staat der Nederlanden Root CA - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado - NetLock Kozjegyzoi (Class A) Tanusitvanykiado - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado - VeriSign Class 1 Public PCA - G2 - VeriSign Class 3 Public PCA - VeriSign Class 3 Public PCA - G2 - CA Disig * The following CA certificates were Added + SZAFIR ROOT CA2 + Certum Trusted Network CA 2 * The following CA certificate had the Email trust bit turned on + Actalis Authentication Root CA Security fixes: * CVE-2016-2834: Memory safety bugs (boo#983639) MFSA-2016-61 bmo#1206283 bmo#1221620 bmo#1241034 bmo#1241037 - Update to NSS 3.22.3 * Increase compatibility of TLS extended master secret, don't send an empty TLS extension last in the handshake (bmo#1243641) * Fixed a heap-based buffer overflow related to the parsing of certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause a crash or execution of arbitrary code with the permissions of the user. (CVE-2016-1950, bmo#1245528) - Update to NSS 3.22.2 New functionality: * RSA-PSS signatures are now supported (bmo#1215295) * Pseudorandom functions based on hashes other than SHA-1 are now supported * Enforce an External Policy on NSS from a config file (bmo#1009429) - CVE-2016-8635: Fix for DH small subgroup confinement attack (bsc#1015547) Mozilla NSPR was updated to version 4.13.1: The previously released version 4.13 had changed pipes to be nonblocking by default, and as a consequence, PollEvent was changed to not block on clear. The NSPR development team received reports that these changes caused regressions in some applications that use NSPR, and it has been decided to revert the changes made in NSPR 4.13. NSPR 4.13.1 restores the traditional behavior of pipes and PollEvent. Mozilla NSPR update to version 4.13 had these changes: - PL_strcmp (and others) were fixed to return consistent results when one of the arguments is NULL. - PollEvent was fixed to not block on clear. - Pipes are always nonblocking. - PR_GetNameForIdentity: added thread safety lock and bound checks. - Removed the PLArena freelist. - Avoid some integer overflows. - fixed several comments. Important SUSE bug 1015499 SUSE bug 1015547 SUSE bug 1021636 SUSE bug 1030071 SUSE bug 1035082 SUSE bug 983639 CVE-2016-1950 CVE-2016-2834 CVE-2016-8635 CVE-2016-9574 CVE-2017-5429 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5437 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5469 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox and mozilla-nss fixes the following issues: Security issues fixed: - Fixes in Firefox ESR 52.2 (bsc#1043960,MFSA 2017-16) - CVE-2017-7758: Out-of-bounds read in Opus encoder - CVE-2017-7749: Use-after-free during docshell reloading - CVE-2017-7751: Use-after-free with content viewer listeners - CVE-2017-5472: Use-after-free using destroyed node when regenerating trees - CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 - CVE-2017-7752: Use-after-free with IME input - CVE-2017-7750: Use-after-free with track elements - CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service - CVE-2017-7778: Vulnerabilities in the Graphite 2 library - CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object - CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files - CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors - CVE-2017-7757: Use-after-free in IndexedDB - CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application - CVE-2017-7763: Mac fonts render some unicode characters as spaces - CVE-2017-7765: Mark of the Web bypass when saving executable files - CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks - update to Firefox ESR 52.1 (bsc#1035082,MFSA 2017-12) - CVE-2016-10196: Vulnerabilities in Libevent library - CVE-2017-5443: Out-of-bounds write during BinHex decoding - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - CVE-2017-5465: Out-of-bounds read in ConvolvePixel - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL - CVE-2017-5467: Memory corruption when drawing Skia content - CVE-2017-5460: Use-after-free in frame selection - CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - CVE-2017-5447: Out-of-bounds read during glyph processing - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content - CVE-2017-5445: Uninitialized values used while parsing application/http- index-format content - CVE-2017-5442: Use-after-free during style changes - CVE-2017-5469: Potential Buffer overflow in flex-generated code - CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing - CVE-2017-5441: Use-after-free with selection during scroll events - CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing - CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 - CVE-2017-5435: Use-after-free during transaction processing in the editor - CVE-2017-5434: Use-after-free during focus handling - CVE-2017-5433: Use-after-free in SMIL animation functions - CVE-2017-5432: Use-after-free in text input selection - CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 - CVE-2017-5459: Buffer overflow in WebGL - CVE-2017-5462: DRBG flaw in NSS - CVE-2017-5455: Sandbox escape through internal feed reader APIs - CVE-2017-5454: Sandbox escape allowing file system read access through file picker - CVE-2017-5456: Sandbox escape allowing local file system access - CVE-2017-5451: Addressbar spoofing with onblur event - General - CVE-2015-5276: Fix for C++11 std::random_device short reads (bsc#945842) Bugfixes: - workaround for Firefox hangs (bsc#1031485, bsc#1025108) - Update to gcc-5-branch head. * Includes fixes for (bsc#966220), (bsc#962765), (bsc#964468), (bsc#939460), (bsc#930496), (bsc#930392) and (bsc#955382). - Add fix to revert accidential libffi ABI breakage on AARCH64. (bsc#968771) - Build s390[x] with --with-tune=z9-109 --with-arch=z900 on SLE11 again. (bsc#954002) - Fix libffi include install. (bsc#935510) Important SUSE bug 1025108 SUSE bug 1031485 SUSE bug 1035082 SUSE bug 1043960 SUSE bug 930392 SUSE bug 930496 SUSE bug 935510 SUSE bug 939460 SUSE bug 945842 SUSE bug 953831 SUSE bug 954002 SUSE bug 955382 SUSE bug 962765 SUSE bug 964468 SUSE bug 966220 SUSE bug 968771 CVE-2015-5276 CVE-2016-10196 CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5451 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5469 CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7761 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7768 CVE-2017-7778 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to the ESR 52.3 release (bsc#1052829) Following security issues were fixed: * MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback * MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts * MFSA 2017-19/CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID * MFSA 2017-19/CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections * MFSA 2017-19/CVE-2017-7787: Same-origin policy bypass with iframes through page reloads * MFSA 2017-19/CVE-2017-7786: Buffer overflow while painting non-displayable SVG * MFSA 2017-19/CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM * MFSA 2017-19/CVE-2017-7784: Use-after-free with image observers * MFSA 2017-19/CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements * MFSA 2017-19/CVE-2017-7798: XUL injection in the style editor in devtools * MFSA 2017-19/CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher * MFSA 2017-19/CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 * MFSA 2017-19/CVE-2017-7800: Use-after-free in WebSockets during disconnection * MFSA 2017-19/CVE-2017-7801: Use-after-free with marquee during window resizing * MFSA 2017-19/CVE-2017-7802: Use-after-free resizing image elements * MFSA 2017-19/CVE-2017-7803: CSP containing 'sandbox' improperly applied This update also fixes: - fixed firefox hangs after a while in FUTEX_WAIT_PRIVATE if cgroups enabled and running on cpu >=1 (bsc#1031485) - The Itanium ia64 build was fixed. Important SUSE bug 1031485 SUSE bug 1052829 CVE-2017-7753 CVE-2017-7779 CVE-2017-7782 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7798 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7807 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox ESR 52.5 fixes the following issues: Security issues fixed: - CVE-2017-7826: Memory safety bugs fixed (bsc#1068101). - CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101). - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101). Mozilla Foundation Security Advisory (MFSA 2017-25): - https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/ Important SUSE bug 1068101 CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox to version ESR 52.6 fixes several issues. These security issues were fixed: - CVE-2018-5091: Use-after-free with DTMF timers (bsc#1077291). - CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291). - CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291). - CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291). - CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291). - CVE-2018-5099: Use-after-free with widget listener (bsc#1077291). - CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291). - CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291). - CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291). - CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291). - CVE-2018-5089: Various memory safety bugs (bsc#1077291). Important SUSE bug 1077291 CVE-2018-5089 CVE-2018-5091 CVE-2018-5095 CVE-2018-5096 CVE-2018-5097 CVE-2018-5098 CVE-2018-5099 CVE-2018-5102 CVE-2018-5103 CVE-2018-5104 CVE-2018-5117 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox fixes the following issues: Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130): - CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 - CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList - CVE-2018-5129: Out-of-bounds write with malformed IPC messages - CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption - CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources - CVE-2018-5144: Integer overflow during Unicode conversion - CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7 - CVE-2018-5146: Out of bounds memory write in libvorbis (bsc#1085671) - CVE-2018-5147: Out of bounds memory write in libtremor (bsc#1085671) - CVE-2018-5148: Use-after-free in compositor (MFSA 2018-10) (bsc#1087059) Moderate SUSE bug 1085130 SUSE bug 1085671 SUSE bug 1087059 CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 CVE-2018-5146 CVE-2018-5147 CVE-2018-5148 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox to ESR 52.8 release fixes the following issues: Update to Firefox ESR 52.8 (bsc#1092548) Security issues fixed: - MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia - MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer - MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction - MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 - MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths - MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia - MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files - MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths - MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension Important SUSE bug 1092548 CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5157 CVE-2018-5158 CVE-2018-5159 CVE-2018-5168 CVE-2018-5174 CVE-2018-5178 CVE-2018-5183 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox fixes the following security issue: - CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG with Skia (bsc#1096449). Important SUSE bug 1096449 CVE-2018-6126 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox to version ESR 52.9 fixes the following issues: - CVE-2018-5188: Various memory safety bugs (bsc#1098998) - CVE-2018-12368: No warning when opening executable SettingContent-ms files - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture - CVE-2018-12359: Buffer overflow using computed size of canvas element Important SUSE bug 1098998 CVE-2018-12359 CVE-2018-12360 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365 CVE-2018-12366 CVE-2018-12368 CVE-2018-5156 CVE-2018-5188 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox to version ESR 60.8 fixes the following issues: Security issues fixed: - CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868). - CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868). - CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868). - CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868). - CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868). - CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868). - CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868). - CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868). - CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868). - CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868). - CVE-2019-11708: Fix sandbox escape using Prompt:Open (bsc#1138872). - CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614) Non-security issues fixed: - Fix broken language plugins (bsc#1137792) Important SUSE bug 1137792 SUSE bug 1138614 SUSE bug 1138872 SUSE bug 1140868 CVE-2019-11707 CVE-2019-11708 CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11719 CVE-2019-11729 CVE-2019-11730 CVE-2019-9811 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to 3.16: * required for Firefox 29 * CVE-2014-1492: In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Security Issue references: * CVE-2014-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1532> * CVE-2014-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1531> * CVE-2014-1530 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1530> * CVE-2014-1529 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1529> * CVE-2014-1524 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524> * CVE-2014-1523 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1523> * CVE-2014-1520 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1520> * CVE-2014-1518 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1518> SUSE bug 865539 SUSE bug 869827 SUSE bug 875378 SUSE bug 875803 CVE-2014-1518 CVE-2014-1520 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to 31.6.0 ESR to fix five security issues. The following vulnerabilities have been fixed: * Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815) * Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813) * resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816) * CORS requests should not follow 30x redirections after preflight (MFSA 2015-37/CVE-2015-0807) * Same-origin bypass through anchor navigation (MFSA 2015-40/CVE-2015-0801) Security Issues: * CVE-2015-0801 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0801> * CVE-2015-0807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0807> * CVE-2015-0813 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0813> * CVE-2015-0814 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0814> * CVE-2015-0816 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0816> SUSE bug 925368 CVE-2015-0801 CVE-2015-0807 CVE-2015-0813 CVE-2015-0814 CVE-2015-0816 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). This non-security issue was fixed: - bsc#908275: Firefox did not print in landscape orientation. Important SUSE bug 908275 SUSE bug 935033 SUSE bug 935979 CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894) * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7) * MFSA 2016-17/CVE-2016-1954 Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 A memory leak in libstagefright when deleting an array during MP4 processing was fixed. * MFSA 2016-21/CVE-2016-1958 The displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960 A use-after-free in HTML5 string parser was fixed. * MFSA 2016-24/CVE-2016-1961 A use-after-free in SetBody was fixed. * MFSA 2016-25/CVE-2016-1962 A use-after-free when using multiple WebRTC data channels was fixed. * MFSA 2016-27/CVE-2016-1964 A use-after-free during XML transformations was fixed. * MFSA 2016-28/CVE-2016-1965 Addressbar spoofing though history navigation and Location protocol property was fixed. * MFSA 2016-31/CVE-2016-1966 Memory corruption with malicious NPAPI plugin was fixed. * MFSA 2016-34/CVE-2016-1974 A out-of-bounds read in the HTML parser following a failed allocation was fixed. * MFSA 2016-35/CVE-2016-1950 A buffer overflow during ASN.1 decoding in NSS was fixed. * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Various font vulnerabilities were fixed in the embedded Graphite 2 library Mozilla NSS was updated to fix: * MFSA 2016-15/CVE-2016-1978 Use-after-free in NSS during SSL connections in low memory * MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1 decoding in NSS * MFSA 2016-36/CVE-2016-1979 Use-after-free during processing of DER encoded keys in NSS Mozilla NSPR was updated to version 4.12 (bsc#969894) * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes * Enable atomic instructions on mips (bmo#1129878) * Fix mips assertion failure when creating thread with custom stack size (bmo#1129968) Important SUSE bug 969894 CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-1978 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 SUSE Linux Enterprise Server 11 SP3-TERADATA This NetworkManager-kde4 update fixes the following security and non security issues: - Fixed a long standing security issue. This makes knetworkmanager probe the RADIUS server for a CA certificate subject and hash if no CA certificate is specified. knetworkmanager then stores this data and send it to NetworkManager for it to do a network validation in the absence of a real certificate (bsc#726349) - Disabled the loading by default of the NetworkManager plasma applet since it doesn't work. - Fixed a crash due to the use of an uninitialized variable in the plasma applet in case someone runs it manually (bsc#663413) Moderate SUSE bug 663413 SUSE bug 726349 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenEXR fixes the following issues: * CVE-2017-9110: In OpenEXR, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash. (bsc#1040107) * CVE-2017-9114: In OpenEXR, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash. (bsc#1040114) * CVE-2017-12596: In OpenEXR, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it could have resulted in denial of service or possibly unspecified other impact. (bsc#1052522) Moderate SUSE bug 1040107 SUSE bug 1040114 SUSE bug 1052522 CVE-2017-12596 CVE-2017-9110 CVE-2017-9114 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenEXR fixes the following issues: Security issues fixed: - CVE-2017-9111: Fixed an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h (bsc#1040109). - CVE-2017-9113: Fixed an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp (bsc#1040113). - CVE-2017-9115: Fixed an invalid write of size 2 in the = operator function inhalf.h (bsc#1040115). - CVE-2017-9112: Fixed invalid read of size 1 in the getBits function in ImfHuf.cpp. (This was already fixed by the previous update bug not referenced.) (bsc#1040112) Moderate SUSE bug 1040109 SUSE bug 1040112 SUSE bug 1040113 SUSE bug 1040115 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113 CVE-2017-9115 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenEXR fixes the following issues: - CVE-2017-14988: Fixed a denial of service in Header::readfrom() (bsc#1061305). Moderate SUSE bug 1061305 CVE-2017-9110 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for SDL fixes the following issues: Security issues fixed: - CVE-2019-7572: Fixed a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.(bsc#1124806). - CVE-2019-7578: Fixed a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c (bsc#1125099). - CVE-2019-7576: Fixed heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124799). - CVE-2019-7573: Fixed a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (bsc#1124805). - CVE-2019-7635: Fixed a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. (bsc#1124827). - CVE-2019-7636: Fixed a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c (bsc#1124826). - CVE-2019-7638: Fixed a heap-based buffer over-read in Map1toN in video/SDL_pixels.c (bsc#1124824). - CVE-2019-7574: Fixed a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c (bsc#1124803). - CVE-2019-7575: Fixed a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c (bsc#1124802). - CVE-2019-7637: Fixed a heap-based buffer overflow in SDL_FillRect function in SDL_surface.c (bsc#1124825). - CVE-2019-7577: Fixed a buffer over read in SDL_LoadWAV_RW in audio/SDL_wave.c (bsc#1124800). Moderate SUSE bug 1124799 SUSE bug 1124800 SUSE bug 1124802 SUSE bug 1124803 SUSE bug 1124805 SUSE bug 1124806 SUSE bug 1124824 SUSE bug 1124825 SUSE bug 1124826 SUSE bug 1124827 SUSE bug 1125099 CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575 CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635 CVE-2019-7636 CVE-2019-7637 CVE-2019-7638 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for SuSEfirewall2 fixes the following issues: - CVE-2017-15638: Fixed a security issue with too open implicit portmapper rules (bsc#1064127): A source net restriction for _rpc_ services was not taken into account for the implicitly added rules for port 111, making the portmap service accessible to everyone in the affected zone. Moderate SUSE bug 1064127 CVE-2017-15638 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The text to postscript converter a2ps received a security update. The fixps script did not call ghostscript with the -DSAFER option, allowing command execution by attacker supplied postscript files. Security Issue reference: * CVE-2014-0466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0466> SUSE bug 871097 CVE-2014-0466 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for amanda fixes the following issues: Security issue fixed: - CVE-2016-10729: Fixed a local privilege escalation from amanda to root via unsafe tar command options (bsc#1112916). Moderate SUSE bug 1112916 CVE-2016-10729 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ansible to version 2.2.0.0 fixes the following issues: - CVE-2016-8628: Command injection by compromised server via fact variables (bsc#1008037). - CVE-2016-8614: Improper verification of key fingerprints in apt_key module (bsc#1008038). - CVE-2016-8647: in some circumstances the mysql_user module may fail to correctly change a password (bsc#1010940). - CVE-2016-9587: Prevent compromised host to execute commands on the controller (bsc#1019021). For more information about the upstream bugs fixed please see /usr/share/doc/packages/ansible/CHANGELOG.md Moderate SUSE bug 1008037 SUSE bug 1008038 SUSE bug 1010940 SUSE bug 1019021 CVE-2016-8614 CVE-2016-8628 CVE-2016-8647 CVE-2016-9587 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ansible fixes the following issues: - CVE-2017-7481: Data for lookup plugins used as variables was not being marked as "unsafe" and could lead to unintentional disclosure of information. (bsc#1038785) Moderate SUSE bug 1038785 CVE-2017-7481 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ansible fixes the following issues: Ansible was updated to 2.3.2.0. A full list of changes can be found in /usr/share/doc/packages/ansible/CHANGELOG.md Security issues fixed: - CVE-2017-7550: Passing passwords in the params field in the Jenkins plugin was disallowed as it can be leaked into log files because contents of params are not protected. Instead, the password now must be configured separately as url_password. (bsc#1065872) Important SUSE bug 1059235 SUSE bug 1065872 CVE-2017-7550 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ant fixes the following issues: Security issue fixed: - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution (bsc#1100053) Other changes made: - Removed support for javadoc - Default value for stripAbsolutePathSpec changed to 'true' Moderate SUSE bug 1100053 CVE-2018-10886 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for the Apache Web Server provides the following fixes: * Fixed a heap-based buffer overflow on apache module mod_status. (bnc#887765, CVE-2014-0226) * Properly remove whitespace characters from CDATA sections to avoid remote denial of service by crashing the Apache Server process. (bnc#869105, CVE-2013-6438) * Correction to parsing of cookie content; this can lead to a crash with a specially designed cookie sent to the server. (bnc#869106, CVE-2014-0098) * ECC support should not be missing. (bnc#859916) This update also introduces a new configuration parameter CGIDScriptTimeout, which defaults to the value of parameter Timeout. CGIDScriptTimeout is set to 60s if mod_cgid is loaded/active, via /etc/apache2/conf.d/cgid-timeout.conf. The new directive and its effect prevent request workers to be eaten until starvation if cgi programs do not send output back to the server within the timeout set by CGIDScriptTimeout. (bnc#887768, CVE-2014-0231) Security Issues references: * CVE-2014-0226 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226> * CVE-2013-6438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438> * CVE-2014-0098 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098> * CVE-2014-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231> SUSE bug 859916 SUSE bug 869105 SUSE bug 869106 SUSE bug 887765 SUSE bug 887768 CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Apache was updated to fix one security vulnerability and two bugs. Following security issue was fixed. - Fix the chunked transfer coding implementation in the Apache (bsc#938728, CVE-2015-3183) Bugs fixed: - add SSLSessionTickets directive (bsc#941676) - hardcode modules %files (bsc#444878) - only enable the port 443 for TCP protocol, not UDP. (bsc#931002) Moderate SUSE bug 444878 SUSE bug 931002 SUSE bug 938728 SUSE bug 941676 CVE-2015-3183 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: * It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-5387). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988488) Moderate SUSE bug 988488 CVE-2016-5387 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash, resulting in DoS (bsc#1016714). - CVE-2016-8743: Added new directive "HttpProtocolOptions Strict" to avoid proxy chain misinterpretation (bsc#1016715). Moderate SUSE bug 1016714 SUSE bug 1016715 CVE-2016-2161 CVE-2016-8743 SUSE Linux Enterprise Server 11 SP3-TERADATA This update provides apache2 2.2.34, which brings many fixes and enhancements: Security issues fixed: - CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest. (bsc#1048576) Bug fixes: - Remove /usr/bin/http2 link only during package uninstall, not upgrade. (bsc#1041830) - Don't put the backend in error state (by default) when 500/503 error code is overridden. (bsc#951692) - Allow single-char field names inadvertently disallowed in 2.2.32. Moderate SUSE bug 1041830 SUSE bug 1048576 SUSE bug 951692 CVE-2017-9788 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: - Allow disabling SNI on proxy connections using "SetEnv proxy-disable-sni 1" in the configuration files. (bsc#1052830) - Allow ECDH again in mod_ssl, it had been incorrectly disabled with the 2.2.34 update. (bsc#1064561) Following security issue has been fixed: - CVE-2017-9798: A use-after-free in the OPTIONS command could be used by attackers to disclose memory of the apache server process, when htaccess uses incorrect Limit statement. (bsc#1058058) Additionally, references to the following security issues, fixed by the previous version-update of apache2 to Apache HTTPD 2.2.34 have been added: - CVE-2017-7668: The HTTP strict parsing introduced a bug in token list parsing, which allowed ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may have be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. (bsc#1045061) - CVE-2017-3169: mod_ssl may have de-referenced a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port allowing for DoS. (bsc#1045062) - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may have lead to authentication requirements being bypassed. (bsc#1045065) - CVE-2017-7679: mod_mime could have read one byte past the end of a buffer when sending a malicious Content-Type response header. (bsc#1045060) Moderate SUSE bug 1045060 SUSE bug 1045061 SUSE bug 1045062 SUSE bug 1045065 SUSE bug 1052830 SUSE bug 1058058 SUSE bug 1064561 CVE-2009-2699 CVE-2010-0425 CVE-2012-0021 CVE-2014-0118 CVE-2017-3167 CVE-2017-3169 CVE-2017-7668 CVE-2017-7679 CVE-2017-9798 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: - security update: * CVE-2018-1301: Specially crafted requests, in debug mode, could lead to denial of service. [bsc#1086817] * CVE-2017-15710: failure in the language fallback handling could lead to denial of service. [bsc#1086776] * CVE-2018-1312: Seed wrongly generated could lead to replay attack in cluster environments. [bsc#1086775] Moderate SUSE bug 1086775 SUSE bug 1086776 SUSE bug 1086817 CVE-2017-15710 CVE-2018-1301 CVE-2018-1312 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: * CVE-2019-0220: The Apache HTTP server did not use a consistent strategy for URL normalization throughout all of its components. In particular, consecutive slashes were not always collapsed. Attackers could potentially abuse these inconsistencies to by-pass access control mechanisms and thus gain unauthorized access to protected parts of the service. [bsc#1131241] * CVE-2019-0217: A race condition in Apache's "mod_auth_digest" when running in a threaded server could have allowed users with valid credentials to authenticate using another username, bypassing configured access control restrictions. [bsc#1131239] Important SUSE bug 1131239 SUSE bug 1131241 CVE-2019-0217 CVE-2019-0220 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2 fixes the following issues: Security issues fixed: - CVE-2019-10092: Fixed limited cross-site scripting in mod_proxy (bsc#1145740). - CVE-2019-10098: Fixed mod_rewrite configuration vulnerablility to open redirect (bsc#1145738). Moderate SUSE bug 1145738 SUSE bug 1145740 CVE-2019-10092 CVE-2019-10098 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apache2-mod_jk fixes the following issues: Security issues fixed: - CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd (bsc#1114612). - CVE-2014-8111: Apache Tomcat Connectors (mod_jk) ignored JkUnmount rules for subtrees of previous JkMount rules, which allowed remote attackers to access otherwise restricted artifacts via unspecified vectors (bsc#927845). Moderate SUSE bug 1114612 SUSE bug 927845 CVE-2014-8111 CVE-2018-11759 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues with apache2-mod_nss: * bnc#853039: client certificate verification problematic (CVE-2013-4566) Security Issue reference: * CVE-2013-4566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4566> SUSE bug 853039 CVE-2013-4566 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements: - SHA256 cipher names change spelling from *_sha256 to *_sha_256. - Drop mod_nss_migrate.pl and use upstream migrate script instead. - Check for Apache user owner/group read permissions of NSS database at startup. - Update default ciphers to something more modern and secure. - Check for host and netstat commands in gencert before trying to use them. - Don't ignore NSSProtocol when NSSFIPS is enabled. - Use proper shell syntax to avoid creating /0 in gencert. - Add server support for DHE ciphers. - Extract SAN from server/client certificates into env. - Fix memory leaks and other coding issues caught by clang analyzer. - Add support for Server Name Indication (SNI) - Add support for SNI for reverse proxy connections. - Add RenegBufferSize? option. - Add support for TLS Session Tickets (RFC 5077). - Implement a slew more OpenSSL cipher macros. - Fix a number of illegal memory accesses and memory leaks. - Support for SHA384 ciphers if they are available in the version of NSS mod_nss is built against. - Add the SECURE_RENEG environment variable. - Add some hints when NSS database cannot be initialized. - Code cleanup including trailing whitespace and compiler warnings. - Modernize autotools configuration slightly, add config.h. - Add small test suite for SNI. - Add compatibility for mod_ssl-style cipher definitions. - Add Camelia ciphers. - Remove Fortezza ciphers. - Add TLSv1.2-specific ciphers. - Initialize cipher list when re-negotiating handshake. - Completely remove support for SSLv2. - Add support for sqlite NSS databases. - Compare subject CN and VS hostname during server start up. - Add support for enabling TLS v1.2. - Don't enable SSL 3 by default. (CVE-2014-3566) - Improve protocol testing. - Add nss_pcache man page. - Fix argument handling in nss_pcache. - Support httpd 2.4+. - Allow users to configure a helper to ask for certificate passphrases via NSSPassPhraseDialog. (bsc#975394) Moderate SUSE bug 975394 SUSE bug 979688 CVE-2013-4566 CVE-2014-3566 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following vulnerabilities in php: * Heap corruption issue in exif_thumbnail(). (CVE-2014-3670) * Integer overflow in unserialize(). (CVE-2014-3669) * Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime(). (CVE-2014-3668) Security Issues: * CVE-2014-3669 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669> * CVE-2014-3670 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670> * CVE-2014-3668 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668> SUSE bug 902357 SUSE bug 902360 SUSE bug 902368 CVE-2014-3668 CVE-2014-3669 CVE-2014-3670 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This apache2-mod_security2 update fixes the following security issue: * bnc#871309: bypass of intended rules via chunked requests (CVE-2013-5705) Security Issues: * CVE-2013-5705 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5705> SUSE bug 871309 CVE-2013-5705 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for apport fixes the following issues: Security issue fixed: - CVE-2015-1338: Insecurely created crash dumps could lead to a DoS or privilege escalation through malicious symlinks. (bsc#947731) Moderate SUSE bug 947731 CVE-2015-1338 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for atftp fixes the following issues: Security issues fixed: - CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because thread_list_mutex was not locked (bsc#1133145). - CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused by an insecure use of strncpy() (bsc#1133114). Important SUSE bug 1133114 SUSE bug 1133145 CVE-2019-11365 CVE-2019-11366 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for audiofile fixes the following issues: Security issues fixed: - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp) (bsc#1026979) - CVE-2017-6828: heap-based buffer overflow in readValue (FileHandle.cpp) (bsc#1026980) - CVE-2017-6829: global buffer overflow in decodeSample (IMA.cpp) (bsc#1026981) - CVE-2017-6830: heap-based buffer overflow in alaw2linear_buf (G711.cpp) (bsc#1026982) - CVE-2017-6831: heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) (bsc#1026983) - CVE-2017-6832: heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) (bsc#1026984) - CVE-2017-6833: divide-by-zero in BlockCodec::runPull (BlockCodec.cpp) (bsc#1026985) - CVE-2017-6834: heap-based buffer overflow in ulaw2linear_buf (G711.cpp) (bsc#1026986) - CVE-2017-6835: divide-by-zero in BlockCodec::reset1 (BlockCodec.cpp) (bsc#1026988) - CVE-2017-6836: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) (bsc#1026987) - CVE-2017-6837, CVE-2017-6838, CVE-2017-6839: multiple ubsan crashes (bsc#1026978) Moderate SUSE bug 1026978 SUSE bug 1026979 SUSE bug 1026980 SUSE bug 1026981 SUSE bug 1026982 SUSE bug 1026983 SUSE bug 1026984 SUSE bug 1026985 SUSE bug 1026986 SUSE bug 1026987 SUSE bug 1026988 CVE-2017-6827 CVE-2017-6828 CVE-2017-6829 CVE-2017-6830 CVE-2017-6831 CVE-2017-6832 CVE-2017-6833 CVE-2017-6834 CVE-2017-6835 CVE-2017-6836 CVE-2017-6837 CVE-2017-6838 CVE-2017-6839 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Augeas has been updated to fix a symlink overwrite problem (CVE-2012-0786, CVE-2013-6412). Also a bug has been fixed where "augtool -s set was failing" (bnc#876044) Additionally parsing the multipath configuration has been fixed. bnc#871323 Security Issues: * CVE-2012-0786 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0786> * CVE-2013-6412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6412> SUSE bug 853044 SUSE bug 871323 SUSE bug 876044 SUSE bug 885003 CVE-2012-0786 CVE-2013-6412 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes an untrusted argument escaping problem (CVE-2014-8119): * new API - aug_escape_name() - which can be used to escape untrusted inputs before using them as part of path expressions * aug_match() is changed to return properly escaped output Moderate SUSE bug 925225 CVE-2014-8119 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for augeas fixes the following issues: Security issues fixed: - CVE-2017-7555: Fix a memory corruption bug could have lead to arbitrary code execution by passing crafted strings that would be mis-handled by parse_name() (bsc#1054171). - CVE-2014-8119: Fix improper handling of escaped strings leading to memory corruption (bsc#925225). Moderate SUSE bug 1054171 SUSE bug 925225 CVE-2014-8119 CVE-2017-7555 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of automake fixes a race condition in "distcheck". (CVE-2012-3386) Also a bug where world writeable tarballs were generated during "make dist" has been fixed (CVE-2009-4029). Security Issue references: * CVE-2012-3386 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3386> * CVE-2009-4029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4029> SUSE bug 559815 SUSE bug 770618 CVE-2012-3386 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for avahi fixes the following issues: Security issue fixed: - CVE-2018-1000845: Fixed DNS amplification and reflection to spoofed addresses (DOS) (bsc#1120281) Moderate SUSE bug 1120281 CVE-2018-1000845 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for axis fixes the following security issue: - CVE-2018-8032: Prevent cross-site scripting (XSS) attack in the default servlet/services (bsc#1103658). Moderate SUSE bug 1103658 CVE-2018-8032 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for axis fixes the following issues: Security issue fixed: - CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598). Moderate SUSE bug 1134598 CVE-2012-5784 CVE-2014-3596 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> SUSE bug 898346 SUSE bug 898603 SUSE bug 898604 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bash fixes the following issues: - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables (bsc#1001299) - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the prompt (bsc#1000396) - CVE-2014-6278: code execution vulnerability via fd redirection (bsc#898884) - CVE-2014-6277: Remote attackers could have executed arbitrary code or caused a denial of service due to improper parsing of function definitions in the values of environment variables (bsc#898812) The following bugs were fixed: - bsc#971410: bash script would teminated unexpectedly due to mishandled recursive traps - bsc#913701: bash hangs if DEBUG trap is enabled The following documentation updates are included: - bsc#959755: Make clear that the files /etc/profile as well as /etc/bash.bashrc may source other files as well even if the bash does not. Important SUSE bug 1000396 SUSE bug 1001299 SUSE bug 898812 SUSE bug 898884 SUSE bug 913701 SUSE bug 959755 SUSE bug 971410 CVE-2014-6277 CVE-2014-6278 CVE-2016-0634 CVE-2016-7543 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bash fixed several issues This security issue was fixed: - CVE-2016-9401: popd in bash might allowed local users to bypass the restricted shell and cause a use-after-free via a crafted address (bsc#1010845). This non-security issue was fixed: - Fix when HISTSIZE=0 and chattr +a .bash_history (bsc#1031729) Low SUSE bug 1010845 SUSE bug 1031729 SUSE bug 976776 CVE-2016-9401 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a DoS vulnerability in bind when handling malformed NSEC3-signed zones. CVE-2014-0591 has been assigned to this issue. Security Issue references: * CVE-2014-0591 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591> SUSE bug 858639 CVE-2014-0591 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries (bsc#939567) Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet handling. Important SUSE bug 939567 CVE-2015-5477 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The nameserver bind was updated to fix a remote denial of service (crash) attack against bind nameservers doing validation on DNSSEC signed records. (CVE-2015-5722, bsc#944066). Important SUSE bug 944066 CVE-2015-5722 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue: - CVE-2015-8000: Fix remote denial of service by misparsing incoming responses (bsc#958861). It also fixes a bug: - Fix a regression in caching entries with a TTL of 0 (bsc#923281). Important SUSE bug 923281 SUSE bug 958861 CVE-2015-8000 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - CVE-2015-8704: Specific APL data allowed remote attacker to trigger a crash in certain configurations (bsc#962189) Important SUSE bug 962189 CVE-2015-8704 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: Fix two assertion failures that can lead to a remote denial of service attack: * CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) * CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) Important SUSE bug 970072 SUSE bug 970073 CVE-2016-1285 CVE-2016-1286 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. (CVE-2016-2776, bsc#1000362) Critical SUSE bug 1000362 CVE-2016-2776 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). - Fix BIND to return a valid hostname in response to ldapdump queries. (bsc#965748) Important SUSE bug 1007829 SUSE bug 965748 CVE-2016-8864 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - Fix a potential assertion failure that could have been triggered by a malformed response to an ANY query, thereby facilitating a denial-of-service attack. [CVE-2016-9131, bsc#1018700, bsc#1018699] - Fix a potential assertion failure that could have been triggered by responding to a query with inconsistent DNSSEC information, thereby facilitating a denial-of-service attack. [CVE-2016-9147, bsc#1018701, bsc#1018699] - Fix potential assertion failure that could have been triggered by DNS responses that contain unusually-formed DS resource records, facilitating a denial-of-service attack. [CVE-2016-9444, bsc#1018702, bsc#1018699] Important SUSE bug 1018699 SUSE bug 1018700 SUSE bug 1018701 SUSE bug 1018702 CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - Fixed a possible denial of service vulnerability (affected only configurations using both DNS64 and RPZ, CVE-2017-3135, bsc#1024130) Moderate SUSE bug 1024130 CVE-2017-3135 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following security issues: CVE-2017-3137 (bsc#1033467): Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could have been exploited to cause a denial of service of a bind server performing recursion. CVE-2017-3136 (bsc#1033466): An attacker could have constructed a query that would cause a denial of service of servers configured to use DNS64. CVE-2017-3138 (bsc#1033468): An attacker with access to the BIND control channel could have caused the server to stop by triggering an assertion failure. CVE-2016-6170 (bsc#987866): Primary DNS servers could have caused a denial of service of secondary DNS servers via a large AXFR response. IXFR servers could have caused a denial of service of IXFR clients via a large IXFR response. Remote authenticated users could have caused a denial of service of primary DNS servers via a large UPDATE message. CVE-2016-2775 (bsc#989528): When lwresd or the named lwres option were enabled, bind allowed remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol. Important SUSE bug 1033466 SUSE bug 1033467 SUSE bug 1033468 SUSE bug 987866 SUSE bug 989528 CVE-2016-2775 CVE-2016-6170 CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - A regression in the fix for CVE-2017-3137 caused an assert in name.c (bsc#1034162) Important SUSE bug 1034162 CVE-2017-3137 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] Important SUSE bug 1046554 SUSE bug 1046555 CVE-2017-3142 CVE-2017-3143 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes several issues. This security issue was fixed: - CVE-2017-3145: Improper sequencing during cleanup could have lead to a use-after-free error that triggered an assertion failure and crash in named (bsc#1076118). These non-security issues were fixed: - Updated named.root file (bsc#1040039) - Update bind.keys for DNSSEC root KSK rollover (bsc#1047184) Important SUSE bug 1040039 SUSE bug 1047184 SUSE bug 1076118 CVE-2017-3145 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bind fixes the following issues: Security issues fixed: - CVE-2018-5740: Fixed a denial of service vulnerability in the "deny-answer-aliases" feature (bsc#1104129). - CVE-2018-5743: Limiting simultaneous TCP clients is ineffective. (bsc#1133185) - CVE-2018-5745: An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys. (bsc#1126068) - CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069). Important SUSE bug 1104129 SUSE bug 1126068 SUSE bug 1126069 SUSE bug 1133185 CVE-2018-5740 CVE-2018-5743 CVE-2018-5745 CVE-2019-6465 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA binutils has been updated to fix eight security issues: * Lack of range checking leading to controlled write in _bfd_elf_setup_sections() (CVE-2014-8485). * Invalid read flaw in libbfd (CVE-2014-8484). * Write to uninitialized memory in the PE parser (CVE-2014-8501). * Crash in the PE parser (CVE-2014-8502). * Segfault in the ihex parser when it encounters a malformed ihex file (CVE-2014-8503). * Stack buffer overflow in srec_scan (CVE-2014-8504). * Out-of-bounds memory write while processing a crafted "ar" archive (CVE-2014-8738). * Directory traversal vulnerability allowing random file deletion/creation (CVE-2014-8737). Security Issues: * CVE-2014-8501 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8501> * CVE-2014-8502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8502> * CVE-2014-8503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8503> * CVE-2014-8504 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8504> * CVE-2014-8485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8485> * CVE-2014-8738 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8738> * CVE-2014-8484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8484> * CVE-2014-8737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8737> SUSE bug 902676 SUSE bug 902677 SUSE bug 903655 SUSE bug 905735 SUSE bug 905736 CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bluez fixes the following issues: Security issue fixed: - CVE-2017-1000250: Fixed Out-of-bounds heap read in service_search_attr_req check if there is enough data to continue otherwise return an error (bsc#1057342). Moderate SUSE bug 1057342 CVE-2017-1000250 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA bsdtar was updated to fix seven security issues. These security issues were fixed: - CVE-2015-8929: Memory leak in tar parser (bsc#985669). - CVE-2016-4809: Memory allocate error with symbolic links in cpio archives (bsc#984990). - CVE-2015-8920: Stack out of bounds read in ar parser (bsc#985675). - CVE-2015-8921: Global out of bounds read in mtree parser (bsc#985682). - CVE-2015-8924: Heap buffer read overflow in tar (bsc#985609). - CVE-2015-8918: Overlapping memcpy in CAB parser (bsc#985698). - CVE-2015-2304: Reject absolute paths in input mode of bsdcpio exactly when '..' is rejected (bsc#920870). Important SUSE bug 920870 SUSE bug 984990 SUSE bug 985609 SUSE bug 985669 SUSE bug 985675 SUSE bug 985682 SUSE bug 985698 CVE-2015-2304 CVE-2015-8918 CVE-2015-8920 CVE-2015-8921 CVE-2015-8924 CVE-2015-8929 CVE-2016-4809 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Multiple SSL vulnerabilities were fixed in the Mono TLS implementation. * CVE-2015-2318: SKIP-TLS problem could be used to client impersonification. * CVE-2015-2319: A FREAK style SSL protocol downgrade problem was fixed. * CVE-2015-2320: The SSLv2 support was disabled. SUSE bug 921312 CVE-2015-2318 CVE-2015-2319 CVE-2015-2320 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bzip2 fixes the following issues: Security issue fixed: - CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083). - CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657). Important SUSE bug 1139083 SUSE bug 985657 CVE-2016-3189 CVE-2019-12900 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for bzip2 fixes the following issues: - Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities with files that used many selectors (bsc#1139083). Important SUSE bug 1139083 CVE-2019-12900 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cairo fixes the following issues: - CVE-2016-9082: Fixed a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255). - CVE-2017-9814: Replace malloc with _cairo_malloc and check cmap size before allocating to prevent DoS (bsc#1049092). - CVE-2017-7475: Fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789). Moderate SUSE bug 1007255 SUSE bug 1036789 SUSE bug 1049092 CVE-2016-9082 CVE-2017-7475 CVE-2017-9814 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Samba has been updated to fix two security issues and one non-security issue. These security issues have been fixed: * Fix segmentation fault in smbd_marshal_dir_entry()'s SMB_FIND_FILE_UNIXhandler (CVE-2014-3493) * Fix nmbd denial of service (CVE-2014-0244) * Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response (CVE-2014-0178) These non-security issues have been fixed: * Fix printer job purging; (bso#10612); (bnc#879390). Security Issue references: * CVE-2014-3493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3493> * CVE-2014-0244 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0244> * CVE-2014-0178 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0178> SUSE bug 872396 SUSE bug 879390 SUSE bug 880962 SUSE bug 883758 CVE-2014-0178 CVE-2014-0244 CVE-2014-3493 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cifs-utils fixes the following issues: Security issue fixed: - CVE-2014-2830: Fixed pam module pam_cifscreds stack overflow (bsc#870168). Important SUSE bug 870168 CVE-2014-2830 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The antivirus scanner ClamAV has been updated to version 0.98.1, which includes the following fixes: * Code quality fixes in libclamav, clamd, sigtool, clamav-milter, clamconf, and clamdtop. * Code quality fixes in libclamav, libclamunrar and freshclam. * bb #8385: a PDF ASCII85Decode zero-length fix. * bb #7436: elf64 header early exit. * libclamav: SCAN_ALL mode fixes. * iso9660: iso_scan_file rewrite. Version 0.98.1 also implements support for new file types, and quality improvements, including Extraction, decompression, and scanning of files within the Extensible Archive (XAR)/Apple Disk Image (DMG) format, support for decompression and scanning of files in the "Xz" compression format. Additionally, improvements and fixes were done to extraction and scanning of OLE formats. An option to force all scanned data to disk was added. Various improvements to ClamAV configuration, support of third party libraries, and unit tests were done. SUSE bug 841815 SUSE bug 865883 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav fixes the following issues: Security issue fixed: - CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490) Non security issue fixed: - Fix permissions of /var/spool/amavis. (bsc#815106) Important SUSE bug 1045490 SUSE bug 815106 CVE-2012-6706 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav fixes the following issues: - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. Important SUSE bug 1049423 SUSE bug 1052448 SUSE bug 1052449 SUSE bug 1052466 SUSE bug 1077732 CVE-2017-11423 CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 CVE-2017-6418 CVE-2017-6419 CVE-2017-6420 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav fixes the following issues: Security issues fixed: - CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315). - CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449). - CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423). - CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858). - CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915). Important SUSE bug 1045315 SUSE bug 1049423 SUSE bug 1052449 SUSE bug 1082858 SUSE bug 1083915 CVE-2012-6706 CVE-2017-11423 CVE-2017-6419 CVE-2018-0202 CVE-2018-1000085 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410) - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412) - Buffer over-read in unRAR code due to missing max value checks in table initialization - Libmspack heap buffer over-read in CHM parser (bsc#1103040) - PDF parser bugs The following other changes were made: - Disable YARA support for licensing reasons (bsc#1101654). - Add HTTPS support for clamsubmit - Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only Moderate SUSE bug 1101410 SUSE bug 1101412 SUSE bug 1101654 SUSE bug 1103040 CVE-2018-0360 CVE-2018-0361 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav fixes the following issues: Clamav was updated to version 0.100.2: - CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. (bsc#1110723) - CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more fixes for embedded libmspack. (bsc#1103040) * Make freshclam more robust against lagging signature mirrors. * On-Access "Extra Scanning", an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, see: https://bugzilla.clamav.net/show_bug.cgi?id=12048 - Restore exit code compatibility of freshclam with versions before 0.100.0 when the virus database is already up to date (bsc#1104457). Moderate SUSE bug 1103040 SUSE bug 1104457 SUSE bug 1110723 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 CVE-2018-15378 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for clamav to version 0.100.3 fixes the following issues: Security issues fixed (bsc#1130721): - CVE-2019-1787: Fixed an out-of-bounds heap read condition which may occur when scanning PDF documents. - CVE-2019-1789: Fixed an out-of-bounds heap read condition which may occur when scanning PE files (i.e. Windows EXE and DLL files). - CVE-2019-1788: Fixed an out-of-bounds heap write condition which may occur when scanning OLE2 files such as Microsoft Office 97-2003 documents. Important SUSE bug 1130721 CVE-2019-1787 CVE-2019-1788 CVE-2019-1789 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for SUSE Manager Client Tools provides the following fixes and enhancements: rhnlib: - Use TLSv1_METHOD in SSL Context (bsc#970989) suseRegisterInfo: - Fix file permissions (bsc#970550) Low SUSE bug 970550 SUSE bug 970989 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This coreutils update fixes three minor security issues: * VUL-1: CVE-2013-0221: segmentation fault in "sort -d" and "sort -M" with long line input (bnc#798538) * VUL-1: CVE-2013-0222: segmentation fault in "uniq" with long line input (bnc#796243) * VUL-1: CVE-2013-0223: segmentation fault in "join -i" with long line input (bnc#798541) Security Issue references: * CVE-2013-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0221> * CVE-2013-0222 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0222> * CVE-2013-0223 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0223> SUSE bug 796243 SUSE bug 798538 SUSE bug 798541 CVE-2013-0221 CVE-2013-0222 CVE-2013-0223 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for coreutils fixes one issue. This security issue was fixed: - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041) Important SUSE bug 1023041 CVE-2017-2616 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for coreutils fixes the following issues: Security issues fixed: - CVE-2015-4041, CVE-2015-4042: Fixed a buffer overflow related to case conversion (bsc#928749). Moderate SUSE bug 928749 CVE-2015-4041 CVE-2015-4042 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This cpio update fixes the following security issue: * bnc#907456: heap-based buffer overflow flaw in list_file() (CVE-2014-9112) Security Issues: * CVE-2014-9112 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9112> SUSE bug 907456 CVE-2014-9112 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cracklib fixes a security issue and a bug: Security issue fixed: - Add patch to fix a stack buffer overflow in GECOS parser (bsc#992966 CVE-2016-6318) The following non security issue was fixed: - Call textdomain in cracklib-check main function so that program output is translated accordingly. (bsc#928923) Moderate SUSE bug 928923 SUSE bug 992966 CVE-2016-6318 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes various issues in CUPS. * CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031: Various insufficient symbolic link checking could have lead to privilege escalation from the lp user to root. Security Issues: * CVE-2014-3537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3537> * CVE-2014-5029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5029> * CVE-2014-5030 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5030> * CVE-2014-5031 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5031> SUSE bug 887240 CVE-2014-3537 CVE-2014-5029 CVE-2014-5030 CVE-2014-5031 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cups fixes the following issues: Security issues fixed: - CVE-2018-4180: Fix local privilege escalation to root in dnssd backend (bsc#1096405). - CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406). - CVE-2018-4182: Fix cups-exec sandbox bypass due to insecure error handling (bsc#1096407). - CVE-2018-4183: Fix cups-exec sandbox bypass due to profile misconfiguration (bsc#1096408). Moderate SUSE bug 1096405 SUSE bug 1096406 SUSE bug 1096407 SUSE bug 1096408 CVE-2018-4180 CVE-2018-4181 CVE-2018-4182 CVE-2018-4183 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This curl update fixes the following security issues: * bnc#868627: wrong re-use of connections (CVE-2014-0138). * bnc#868629: IP address wildcard certificate validation (CVE-2014-0139). * bnc#870444: --insecure option inappropriately enforcing security safeguard. Security Issue references: * CVE-2014-0138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138> * CVE-2014-0139 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139> SUSE bug 868627 SUSE bug 868629 SUSE bug 870444 CVE-2014-0138 CVE-2014-0139 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2016-0755: libcurl would reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer (bsc#962983) The following non-security bugs were fixed: - bsc#926511: Check for errors on the control connection during FTP transfers The following tracked bugs only affect the test suite: - bsc#962996: Expired cookie in test 46 caused test failures Moderate SUSE bug 926511 SUSE bug 962983 SUSE bug 962996 CVE-2016-0755 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2016-5419: TLS session resumption client cert bypass (bsc#991389) - CVE-2016-5420: Re-using connections with wrong client cert (bsc#991390) - CVE-2016-7141: Fixed incorrect reuse of client certificates (bsc#997420). Moderate SUSE bug 991389 SUSE bug 991390 SUSE bug 997420 CVE-2016-5419 CVE-2016-5420 CVE-2016-7141 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following security issues: - CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646) - CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645) - CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642) - CVE-2016-8619: double-free in krb5 code (bsc#1005638) - CVE-2016-8618: double-free in curl_maprintf (bsc#1005637) - CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635) - CVE-2016-8616: case insensitive password comparison (bsc#1005634) - CVE-2016-8615: cookie injection for other servers (bsc#1005633) - CVE-2016-7167: escape and unescape integer overflows (bsc#998760) Important SUSE bug 1005633 SUSE bug 1005634 SUSE bug 1005635 SUSE bug 1005637 SUSE bug 1005638 SUSE bug 1005642 SUSE bug 1005645 SUSE bug 1005646 SUSE bug 998760 CVE-2016-7167 CVE-2016-8615 CVE-2016-8616 CVE-2016-8617 CVE-2016-8618 CVE-2016-8619 CVE-2016-8620 CVE-2016-8621 CVE-2016-8622 CVE-2016-8623 CVE-2016-8624 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: These security issues were fixed: - CVE-2016-9586: libcurl printf floating point buffer overflow (bsc#1015332) - CVE-2017-7407: The ourWriteOut function in tool_writeout.c in curl might have allowed physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which lead to a heap-based buffer over-read (bsc#1032309). Moderate SUSE bug 1015332 SUSE bug 1032309 CVE-2016-9586 CVE-2017-7407 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2017-1000100: TFP sends more than buffer size and it could lead to a denial of service (bsc#1051644) - CVE-2017-7407: ourWriteOut function problem could lead to a heap buffer over-read (bsc#1032309) - CVE-2016-9586: libcurl printf issue could lead to buffer overflow (bsc#1015332) Moderate SUSE bug 1015332 SUSE bug 1032309 SUSE bug 1051644 CVE-2016-9586 CVE-2017-1000100 CVE-2017-7407 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following security issues: - CVE-2017-1000254: FTP PWD response parser out of bounds read (bsc#1061876) Moderate SUSE bug 1061876 CVE-2017-1000254 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl several issues. This security issue was fixed: - CVE-2018-1000007: Prevent leaking authentication data to third parties when following redirects (bsc#1077001) This non-security issue was fixed: - Set DEFAULT_SUSE as the default cipher list (bsc#1027712] Moderate SUSE bug 1027712 SUSE bug 1077001 CVE-2016-7141 CVE-2018-1000007 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: curl was updated to version 7.37.0 (fate#325339 bsc#1084137) This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third party software like "R" to be able to be used on the SUSE Linux Enterprise 11 codebase. Following security issues were fixed: - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution (bsc#1084521). - CVE-2018-1000121: A NULL pointer dereference exists in the LDAP code that allowed an attacker to cause a denial of service (bsc#1084524). - CVE-2018-1000122: A buffer over-read exists in the RTSP+RTP handling code that allowed an attacker to cause a denial of service or information leakage (bsc#1084532). The package also requires a libopenssl that implements the DEFAULT_SUSE cipher list (bsc#1081056, bsc#1083463,bsc#1086825) Moderate SUSE bug 1081056 SUSE bug 1083463 SUSE bug 1084137 SUSE bug 1084521 SUSE bug 1084524 SUSE bug 1084532 SUSE bug 1085124 SUSE bug 1086825 SUSE bug 1087922 SUSE bug 1090194 CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2018-1000301: Fixed a buffer over-read caused by bad RTSP headers (bsc#1092098) Moderate SUSE bug 1092098 CVE-2018-1000301 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2018-14618: Prevent integer overflow in the NTLM authentication code (bsc#1106019). Moderate SUSE bug 1106019 CVE-2018-14618 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: - CVE-2018-16840: A use-after-free in SASL handle close was fixed (bsc#1112758) - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was fixed which could lead to crashes (bsc#1113660) Moderate SUSE bug 1112758 SUSE bug 1113660 CVE-2018-16840 CVE-2018-16842 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170). Important SUSE bug 1135170 CVE-2019-5436 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for curl fixes the following issues: Security issue fixed: - CVE-2019-5482: Fixed a TFTP small blocksize heap buffer overflow (bsc#1149496). Important SUSE bug 1149496 CVE-2019-5482 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues: * CVE-2014-8150: URL request injection (bnc#911363) When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. * CVE-2014-3707: duphandle read out of bounds (bnc#901924) * CVE-2014-3613: libcurl cookie leaks (bnc#894575) Additional bug fixed: * curl_multi_remove_handle: don't crash on multiple removes (bnc#897816) Security Issues: * CVE-2014-8150 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150> * CVE-2014-3613 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613> * CVE-2014-3707 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3707> SUSE bug 870444 SUSE bug 884698 SUSE bug 885302 SUSE bug 894575 SUSE bug 897816 SUSE bug 901924 SUSE bug 911363 CVE-2014-3613 CVE-2014-3707 CVE-2014-8150 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cvs fixes the following issues: - CVE-2017-12836: A leading dash in the argument of the "-d" option could lead to argument injection (bsc#1053364) Moderate SUSE bug 1053364 CVE-2017-12836 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for cyrus-imapd fixes the following issues: - Previous versions of cyrus-imapd would not allow its users to disable old SSL variants that are vulnerable to attacks like BEAST and POODLE. This patch adds the configuration option 'tls_versions' to remedy that issue. Note that users who upgrade an existing installation will *not* have their imapd.conf file overwritten, i.e. their IMAP server will continue to support SSLv2 and SSLv3 like before. To disable support for those protocols, edit imapd.conf manually to include "tls_versions: tls1_0 tls1_1 tls1_2". New installations, however, will have an imapd.conf file that contains these settings already, i.e. newly installed IMAP servers do *not* support unsafe versions of SSL unless that support is explicitly enabled by the user. (bsc#901748) - An integer overflow vulnerability in cyrus-imapd's urlfetch range checking code was fixed. (CVE-2015-8076, CVE-2015-8077, CVE-2015-8078, bsc#981670, bsc#954200, bsc#954201) - Support for Elliptic Curve Diffie–Hellman (ECDH) has been added to cyrus-imapd. (bsc#860611) Important SUSE bug 860611 SUSE bug 901748 SUSE bug 954200 SUSE bug 954201 SUSE bug 981670 CVE-2014-3566 CVE-2015-8076 CVE-2015-8077 CVE-2015-8078 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Various denial of service issues were fixed in the DBUS service. * CVE-2014-3638: dbus-daemon tracks whether method call messages expect a reply, so that unsolicited replies can be dropped. As currently implemented, if there are n parallel method calls in progress, each method reply takes O(n) CPU time. A malicious user could exploit this by opening the maximum allowed number of parallel connections and sending the maximum number of parallel method calls on each one, causing subsequent method calls to be unreasonably slow, a denial of service. * CVE-2014-3639: dbus-daemon allows a small number of "incomplete" connections (64 by default) whose identity has not yet been confirmed. When this limit has been reached, subsequent connections are dropped. Alban's testing indicates that one malicious process that makes repeated connection attempts, but never completes the authentication handshake and instead waits for dbus-daemon to time out and disconnect it, can cause the majority of legitimate connection attempts to fail. Security Issues: * CVE-2014-3638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638> * CVE-2014-3638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638> SUSE bug 896453 CVE-2014-3638 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dbus-1 fixes the following issues: Security issue fixed: - CVE-2019-12749: Fixed an implementation flaw in DBUS_COOKIE_SHA1 which could have allowed local attackers to bypass authentication (bsc#1137832). Important SUSE bug 1137832 CVE-2019-12749 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally (bsc#961305) The following bugs were fixed: - bsc#936923: Improper lease duration checking - bsc#880984: Integer overflows in the date and time handling code - bsc#947780: DHCP server could abort with "Unable to set up timer: out of range" on very long or infinite timer intervals / lease lifetimes - bsc#926159: DHCP preferrend and valid lifetime would be logged incorrectly - bsc#928390: dhclient dit not expose next-server DHCPv4 option to script - bsc#926159: DHCP preferrend and valid lifetime would be logged incorrectly Moderate SUSE bug 880984 SUSE bug 919959 SUSE bug 926159 SUSE bug 928390 SUSE bug 936923 SUSE bug 947780 SUSE bug 961305 CVE-2015-8605 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dhcp fixes the following issues: - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional (bsc#969820). Moderate SUSE bug 969820 CVE-2016-2774 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dhcp fixes several issues. This security issue was fixed: - CVE-2017-3144: OMAPI code didn't free socket descriptors when empty message is received allowing DoS (bsc#1076119) This non-security issue was fixed: - Enhance dhclient-script to handle static route updates. (bsc#1023415) Moderate SUSE bug 1023415 SUSE bug 1076119 CVE-2017-3144 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dhcp fixes the following issues: Security issues fixed: - CVE-2018-5733: reference count overflow in dhcpd (bsc#1083303). - CVE-2018-5732: buffer overflow in dhclient (bsc#1083302). Moderate SUSE bug 1083302 SUSE bug 1083303 CVE-2018-5732 CVE-2018-5733 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA dhcpcd was updated to fix three security issues. These security issues were fixed: - CVE-2012-6698: A potential out of bounds write was fixed, which could lead to memory corruption, triggerable by network local attackers. - CVE-2012-6699: A loop error was fixed that could lead out of bound reads, triggerable by network local attackers. - CVE-2012-6700: An incorrect free could lead to crashes, triggerable by network local attackers. Important SUSE bug 955762 CVE-2012-6698 CVE-2012-6699 CVE-2012-6700 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for djvulibre fixes the following issues: Security issues fixed: - CVE-2019-15142: Fixed heap-based buffer over-read (bsc#1146702). - CVE-2019-15143: Fixed resource exhaustion caused by corrupted image files (bsc#1146569). - CVE-2019-15144: Fixed denial-of-service caused by crafted PBM image files (bsc#1146571). - CVE-2019-15145: Fixed out-of-bounds read caused by corrupted JB2 image files (bsc#1146572). - Fixed segfault when libtiff encounters corrupted TIFF (upstream issue #295). Moderate SUSE bug 1146569 SUSE bug 1146571 SUSE bug 1146572 SUSE bug 1146702 CVE-2019-15142 CVE-2019-15143 CVE-2019-15144 CVE-2019-15145 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The DNS server dnsmasq was updated to fix one security issue and one non-security bug: * CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read memory from the heap, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867) * bsc#923144: When answer to an upstream query is a CNAME pointing to an A/AAAA record which is present locally (/etc/hosts), allow caching when the upstream and local A/AAAA records have the same value. Security Issues: * CVE-2015-3294 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294> SUSE bug 923144 SUSE bug 928867 CVE-2015-3294 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dnsmasq fixes the following issues: - CVE-2015-8899: Denial of service between local and remote dns entries (bsc#983273) Important SUSE bug 983273 CVE-2015-8899 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dnsmasq fixes the following security issues: - CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354] - CVE-2017-14492: heap based overflow. [bsc#1060355] - CVE-2017-14493: stack based overflow. [bsc#1060360] - CVE-2017-14494: DHCP - info leak. [bsc#1060361] - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362] - CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364] This update brings a (small) potential incompatibility in the handling of "basename" in --pxe-service. Please read the CHANGELOG and the documentation if you are using this option. Important SUSE bug 1060354 SUSE bug 1060355 SUSE bug 1060360 SUSE bug 1060361 SUSE bug 1060362 SUSE bug 1060364 CVE-2015-3294 CVE-2015-8899 CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for dnsmasq fixes the following issues: Security issue fixed: - CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance. (bsc#1076958) Moderate SUSE bug 1076958 CVE-2017-15107 SUSE Linux Enterprise Server 11 SP3-TERADATA dosfstools was updated to fix two security issues. These security issues were fixed: - CVE-2015-8872: The set_fat function in fat.c in dosfstools might have allowed attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two error (bsc#980364). - CVE-2016-4804: The read_boot function in boot.c in dosfstools allowed attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function (bsc#980377). Moderate SUSE bug 980364 SUSE bug 980377 CVE-2015-8872 CVE-2016-4804 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Two security issues were fixed in e2fsprogs: * CVE-2015-0247: Various heap overflows were fixed in e2fsprogs (fsck, dumpe2fs, e2image). * CVE-2015-1572: Fixed a potential buffer overflow in closefs(). (bsc#918346) Additionally, badblocks was enhanced to work with very large partitions. (bsc#932539) Security Issues: * CVE-2015-0247 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247> * CVE-2015-1572 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572> SUSE bug 915402 SUSE bug 918346 SUSE bug 932539 CVE-2015-0247 CVE-2015-1572 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ecryptfs-utils fixes the following issues: - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks (bsc#920160) Moderate SUSE bug 920160 SUSE bug 962052 CVE-2014-9687 CVE-2016-1572 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ed fixes the following security issues: - CVE-2017-5357: An invalid free in the regular expression handling of the "ed" command processing could allow local users to crash ed. (bsc#1019807) Low SUSE bug 1019807 CVE-2017-5357 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA elfutils has been updated to fix one security issue: * CVE-2014-9447: Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allowed remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program (bnc#911662). Security Issues: * CVE-2014-9447 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9447> SUSE bug 911662 CVE-2014-9447 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for elfutils fixes the following issues: Security issues fixed: - CVE-2018-16403: Fixed a heap-based buffer over-read in in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c which could have lead to denial of service (bsc#1107067). - CVE-2016-10254: Fixed a memory allocation failure in alloxate_elf (bsc#1030472). - CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (bsc#1125007). - CVE-2016-10255: Fixed a memory allocation failure in libelf_set_rawdata_wrlock (bsc#1030476). - CVE-2019-7150: Added a missing check in dwfl_segment_report_module which could have allowed truncated files to be read (bsc#1123685). - CVE-2018-16062: Fixed a heap-buffer-overflow (bsc#1106390). - CVE-2017-7611: Fixed a heap-based buffer over-read that could have led to Denial of Service (bsc#1033088). - CVE-2017-7613: Fixed denial of service caused by the missing validation of the number of sections and the number of segments in a crafted ELF file (bsc#1033090). - CVE-2017-7607: Fixed a heap-based buffer overflow in handle_gnu_hash (bsc#1033084). - CVE-2017-7608: Fixed a heap-based buffer overflow in ebl_object_note_type_name() (bsc#1033085). - CVE-2017-7610: Fixed a heap-based buffer overflow in check_group (bsc#1033087). - CVE-2018-18521: Fixed multiple divide-by-zero vulnerabilities in function arlib_add_symbols() (bsc#1112723). - CVE-2017-7612: Fixed a denial of service in check_sysv_hash() via a crafted ELF file (bsc#1033089). - CVE-2018-18310: Fixed an invalid address read in dwfl_segment_report_module.c (bsc#1111973). - CVE-2018-18520: Fixed bad handling of ar files inside are files (bsc#1112726). - CVE-2017-7613: Missing validation of the number of sections and the number of segments allowed remote attackers to cause a denial of service (memory consumption) via a crafted ELF file (bsc#1033090). - CVE-2017-7612: The check_sysv_hash function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file (bsc#1033089). Low SUSE bug 1030472 SUSE bug 1030476 SUSE bug 1033084 SUSE bug 1033085 SUSE bug 1033087 SUSE bug 1033088 SUSE bug 1033089 SUSE bug 1033090 SUSE bug 1106390 SUSE bug 1107067 SUSE bug 1111973 SUSE bug 1112723 SUSE bug 1112726 SUSE bug 1123685 SUSE bug 1125007 CVE-2016-10254 CVE-2016-10255 CVE-2017-7607 CVE-2017-7608 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7150 CVE-2019-7665 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Emacs has been updated to fix the following issues: * Several cases of insecure usage of temporary files. (CVE-2014-3421, CVE-2014-3422, CVE-2014-3423, CVE-2014-3424) * Use of vc-annotate for renamed files when using Git. (bnc#854683) Security Issues: * CVE-2014-3421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3421> * CVE-2014-3422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3422> * CVE-2014-3423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3423> * CVE-2014-3424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3424> SUSE bug 854683 SUSE bug 876847 CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for emacs fixes one issues. This security issue was fixed: - CVE-2017-14482: Remote code execution via mails with "Content-Type: text/enriched" (bsc#1058425) Important SUSE bug 1058425 CVE-2017-14482 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for evince provides the following fix: - CVE-2017-1000159: Prevent command line injections via filenames when printing to a file. (bsc#1070046) Moderate SUSE bug 1070046 CVE-2017-1000159 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for evince fixes the following issues: Security issues fixed: - CVE-2019-11459: Fixed an improper error handling in which could have led to use of uninitialized use of memory (bsc#1133037). - CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619). Important SUSE bug 1133037 SUSE bug 1141619 CVE-2019-1010006 CVE-2019-11459 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA evolution-data-server has been updated to disable support for SSLv3. This security issues has been fixed: * SSLv3 POODLE attack (CVE-2014-3566) Security Issues: * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> SUSE bug 901553 CVE-2014-3566 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for exempi fixes the following issues: Security issue fixed: - CVE-2018-7730: Fix heap-based buffer overflow in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp (bsc#1085295). - CVE-2017-18234: Fix use-after-free issue that allows remote attackers to cause a denial of service via a .pdf file (bsc#1085585). Moderate SUSE bug 1085295 SUSE bug 1085585 CVE-2017-18234 CVE-2018-7730 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for expat fixes the following issues: Security issue fixed: - CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441) - CVE-2015-1283: Fix multiple integer overflows. (bnc#980391) Important SUSE bug 979441 SUSE bug 980391 CVE-2015-1283 CVE-2016-0718 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for expat fixes the following security issues: - CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, made it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. (bsc#983215) - CVE-2016-5300: The XML parser in Expat did not use sufficient entropy for hash initialization, which allowed context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. (bsc#983216) Moderate SUSE bug 1022037 SUSE bug 983215 SUSE bug 983216 CVE-2012-6702 CVE-2016-5300 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for expat fixes the following issues: - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse leading to unexpected behaviour (bsc#1047240) - CVE-2017-9233: External Entity Vulnerability could lead to denial of service (bsc#1047236) Moderate SUSE bug 1047236 SUSE bug 1047240 CVE-2016-9063 CVE-2017-9233 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for expat fixes the following issues: Security issue fixed: - CVE-2018-20843: Fixed a denial of service triggered by high resource consumption in the XML parser when XML names contain a large amount of colons (bsc#1139937). Moderate SUSE bug 1139937 CVE-2018-20843 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for expat fixes the following issues: Security issue fixed: - CVE-2019-15903: Fixed a heap-based buffer over-read caused by crafted XML documents. (bsc#1149429) Moderate SUSE bug 1149429 CVE-2019-15903 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This fastjar update fixes a directory traversal issue (bnc#607043). Security Issue reference: * CVE-2010-0831 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0831> SUSE bug 607043 CVE-2010-0831 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for fetchmail fixes the following issues: - CVE-2012-3482: A denial of service vulnerability in the base64 decoder during processing server NTLM protocol exchange was fixed (bsc#775988). Moderate SUSE bug 775988 CVE-2012-3482 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA file was updated to fix one security issue. * An out-of-bounds read flaw file's donote() function. This could possibly lead to file executable crash (CVE-2014-3710). Security Issues: * CVE-2014-3710 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3710> SUSE bug 902367 CVE-2014-3710 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox has been updated to the 17.0.7 ESR version, which fixes bugs and security fixes. * MFSA 2013-49: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Gary Kwong, Jesse Ruderman, and Andrew McCreight reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 21. (CVE-2013-1682) * MFSA 2013-50: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free problems rated critical as security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting additional use-after-free and buffer overflow flaws in code introduced during Firefox development. These were fixed before general release. o Heap-use-after-free in mozilla::dom::HTMLMediaElement::LookupMediaElementURITable (CVE-2013-1684) o Heap-use-after-free in nsIDocument::GetRootElement (CVE-2013-1685) o Heap-use-after-free in mozilla::ResetDir (CVE-2013-1686) * MFSA 2013-51 / CVE-2013-1687: Security researcher Mariusz Mlynski reported that it is possible to compile a user-defined function in the XBL scope of a specific element and then trigger an event within this scope to run code. In some circumstances, when this code is run, it can access content protected by System Only Wrappers (SOW) and chrome-privileged pages. This could potentially lead to arbitrary code execution. Additionally, Chrome Object Wrappers (COW) can be bypassed by web content to access privileged methods, leading to a cross-site scripting (XSS) attack from privileged pages. * MFSA 2013-53 / CVE-2013-1690: Security researcher Nils reported that specially crafted web content using the onreadystatechange event and reloading of pages could sometimes cause a crash when unmapped memory is executed. This crash is potentially exploitable. * MFSA 2013-54 / CVE-2013-1692: Security researcher Johnathan Kuskos reported that Firefox is sending data in the body of XMLHttpRequest (XHR) HEAD requests, which goes agains the XHR specification. This can potentially be used for Cross-Site Request Forgery (CSRF) attacks against sites which do not distinguish between HEAD and POST requests. * MFSA 2013-55 / CVE-2013-1693: Security researcher Paul Stone of Context Information Security discovered that timing differences in the processing of SVG format images with filters could allow for pixel values to be read. This could potentially allow for text values to be read across domains, leading to information disclosure. * MFSA 2013-59 / CVE-2013-1697: Mozilla security researcher moz_bug_r_a4 reported that XrayWrappers can be bypassed to call content-defined toString and valueOf methods through DefaultValue. This can lead to unexpected behavior when privileged code acts on the incorrect values. * MFSA 2013-30: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan Sreckovic, and Joe Drew reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 19. (CVE-2013-0788) * MFSA 2013-31 / CVE-2013-0800: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an out-of-bounds write in Cairo graphics library. When certain values are passed to it during rendering, Cairo attempts to use negative boundaries or sizes for boxes, leading to a potentially exploitable crash in some instances. * MFSA 2013-32 / CVE-2013-0799: Security researcher Frederic Hoguin discovered that the Mozilla Maintenance Service on Windows was vulnerable to a buffer overflow. This system is used to update software without invoking the User Account Control (UAC) prompt. The Mozilla Maintenance Service is configured to allow unprivileged users to start it with arbitrary arguments. By manipulating the data passed in these arguments, an attacker can execute arbitrary code with the system privileges used by the service. This issue requires local file system access to be exploitable. * MFSA 2013-34 / CVE-2013-0797: Security researcher Ash reported an issue with the Mozilla Updater. The Mozilla Updater can be made to load a malicious local DLL file in a privileged context through either the Mozilla Maintenance Service or independently on systems that do not use the service. This occurs when the DLL file is placed in a specific location on the local system before the Mozilla Updater is run. Local file system access is necessary in order for this issue to be exploitable. * MFSA 2013-35 / CVE-2013-0796: Security researcher miaubiz used the Address Sanitizer tool to discover a crash in WebGL rendering when memory is freed that has not previously been allocated. This issue only affects Linux users who have Intel Mesa graphics drivers. The resulting crash could be potentially exploitable. * MFSA 2013-36 / CVE-2013-0795: Security researcher Cody Crews reported a mechanism to use the cloneNode method to bypass System Only Wrappers (SOW) and clone a protected node. This allows violation of the browser's same origin policy and could also lead to privilege escalation and the execution of arbitrary code. * MFSA 2013-37 / CVE-2013-0794: Security researcher shutdown reported a method for removing the origin indication on tab-modal dialog boxes in combination with browser navigation. This could allow an attacker's dialog to overlay a page and show another site's content. This can be used for phishing by allowing users to enter data into a modal prompt dialog on an attacking, site while appearing to be from the displayed site. * MFSA 2013-38 / CVE-2013-0793: Security researcher Mariusz Mlynski reported a method to use browser navigations through history to load an arbitrary website with that page's baseURI property pointing to another site instead of the seemingly loaded one. The user will continue to see the incorrect site in the addressbar of the browser. This allows for a cross-site scripting (XSS) attack or the theft of data through a phishing attack. * MFSA 2013-39 / CVE-2013-0792: Mozilla community member Tobias Schula reported that if gfx.color_management.enablev4 preference is enabled manually in about:config, some grayscale PNG images will be rendered incorrectly and cause memory corruption during PNG decoding when certain color profiles are in use. A crafted PNG image could use this flaw to leak data through rendered images drawing from random memory. By default, this preference is not enabled. * MFSA 2013-40 / CVE-2013-0791: Mozilla community member Ambroz Bizjak reported an out-of-bounds array read in the CERT_DecodeCertPackage function of the Network Security Services (NSS) libary when decoding a certificate. When this occurs, it will lead to memory corruption and a non-exploitable crash. * MFSA 2013-41: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. References o Christoph Diehl, Christian Holler, Jesse Ruderman, Timothy Nikkel, and Jeff Walden reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 20. o Bob Clary, Ben Turner, Benoit Jacob, Bobby Holley, Christoph Diehl, Christian Holler, Andrew McCreight, Gary Kwong, Jason Orendorff, Jesse Ruderman, Matt Wobensmith, and Mats Palmgren reported memory safety problems and crashes that affect Firefox 20. * MFSA 2013-42 / CVE-2013-1670: Security researcher Cody Crews reported a method to call a content level constructor that allows for this constructor to have chrome privileged accesss. This affects chrome object wrappers (COW) and allows for write actions on objects when only read actions should be allowed. This can lead to cross-site scripting (XSS) attacks. * MFSA 2013-43 / CVE-2013-1671: Mozilla security researcher moz_bug_r_a4 reported a mechanism to exploit the control when set to the file type in order to get the full path. This can lead to information leakage and could be combined with other exploits to target attacks on the local file system. * MFSA 2013-44 / CVE-2013-1672: Security researcher Seb Patane reported an issue with the Mozilla Maintenance Service on Windows. This issue allows unprivileged users to local privilege escalation through the system privileges used by the service when interacting with local malicious software. This allows the user to bypass integrity checks leading to local privilege escalation. Local file system access is necessary in order for this issue to be exploitable and it cannot be triggered through web content. * MFSA 2013-45: Security researcher Robert Kugler discovered that in some instances the Mozilla Maintenance Service on Windows will be vulnerable to some previously fixed privilege escalation attacks that allowed for local privilege escalation. This was caused by the Mozilla Updater not updating Windows Registry entries for the Mozilla Maintenance Service, which fixed the earlier issues present if Firefox 12 had been installed. New installations of Firefox after version 12 are not affected by this issue. Local file system access is necessary in order for this issue to be exploitable and it cannot be triggered through web content. References: - old MozillaMaintenance Service registry entry not updated leading to Trusted Path Privilege Escalation (CVE-2013-1673) - Possible Arbitrary Code Execution by Update Service (CVE-2012-1942) * MFSA 2013-46 / CVE-2013-1674: Security researcher Nils reported a use-after-free when resizing video while playing. This could allow for arbitrary code execution. * MFSA 2013-47 / CVE-2013-1675: Mozilla community member Ms2ger discovered that some DOMSVGZoomEvent functions are used without being properly initialized, causing uninitialized memory to be used when they are called by web content. This could lead to a information leakage to sites depending on the contents of this uninitialized memory. * MFSA 2013-48: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free, out of bounds read, and invalid write problems rated as moderate to critical as security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting additional use-after-free flaws in dir=auto code introduced during Firefox development. These were fixed before general release. References o Out of Bounds Read in SelectionIterator::GetNextSegment (CVE-2013-1676) o Out-of-bound read in gfxSkipCharsIterator::SetOffsets (CVE-2013-1677)) o Invalid write in _cairo_xlib_surface_add_glyph (CVE-2013-1678) o Heap-use-after-free in mozilla::plugins::child::_geturlnotify (CVE-2013-1679) o Heap-use-after-free in nsFrameList::FirstChild (CVE-2013-1680) o Heap-use-after-free in nsContentUtils::RemoveScriptBlocker (CVE-2013-1681) * CVE-2012-1942 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1942> * CVE-2013-0788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0788> * CVE-2013-0791 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0791> * CVE-2013-0792 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0792> * CVE-2013-0793 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0793> * CVE-2013-0794 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0794> * CVE-2013-0795 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0795> * CVE-2013-0796 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0796> * CVE-2013-0797 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0797> * CVE-2013-0798 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0798> * CVE-2013-0799 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0799> * CVE-2013-0800 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0800> * CVE-2013-0801 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0801> * CVE-2013-1669 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1669> * CVE-2013-1670 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1670> * CVE-2013-1671 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1671> * CVE-2013-1672 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1672> * CVE-2013-1673 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1673> * CVE-2013-1674 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1674> * CVE-2013-1675 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1675> * CVE-2013-1676 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1676> * CVE-2013-1677 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1677> * CVE-2013-1678 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1678> * CVE-2013-1679 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1679> * CVE-2013-1680 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1680> * CVE-2013-1681 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1681> * CVE-2013-1682 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1682> * CVE-2013-1684 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1684> * CVE-2013-1685 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1685> * CVE-2013-1686 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1686> * CVE-2013-1687 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1687> * CVE-2013-1690 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1690> * CVE-2013-1692 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1692> * CVE-2013-1693 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1693> * CVE-2013-1697 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1697> SUSE bug 792432 SUSE bug 813026 SUSE bug 819204 SUSE bug 825935 CVE-2013-1682 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1697 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox has been updated to the 17.0.10ESR release, which fixes various bugs and security issues: * MFSA 2013-93: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesse Ruderman and Christoph Diehl reported memory safety problems and crashes that affect Firefox ESR 17, Firefox ESR 24, and Firefox 24. (CVE-2013-5590) Carsten Book reported a crash fixed in the NSS library used by Mozilla-based products fixed in Firefox 25, Firefox ESR 24.1, and Firefox ESR 17.0.10.(CVE-2013-1739) * MFSA 2013-95 / CVE-2013-5604: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an access violation due to uninitialized data during Extensible Stylesheet Language Transformation (XSLT) processing. This leads to a potentially exploitable crash. * MFSA 2013-96 / CVE-2013-5595: Compiler Engineer Dan Gohman of Google discovered a flaw in the JavaScript engine where memory was being incorrectly allocated for some functions and the calls for allocations were not always properly checked for overflow, leading to potential buffer overflows. When combined with other vulnerabilities, these flaws could be potentially exploitable. * MFSA 2013-98 / CVE-2013-5597: Security researcher Byoungyoung Lee of Georgia Tech Information Security Center (GTISC) used the Address Sanitizer tool to discover a use-after-free during state change events while updating the offline cache. This leads to a potentially exploitable crash. * MFSA 2013-100: Security researcher Nils used the Address Sanitizer tool while fuzzing to discover missing strong references in browsing engine leading to use-after-frees. This can lead to a potentially exploitable crash. o ASAN heap-use-after-free in nsIPresShell::GetPresContext() with canvas, onresize and mozTextStyle (CVE-2013-5599) o ASAN use-after-free in nsIOService::NewChannelFromURIWithProxyFlags with Blob URL (CVE-2013-5600) o ASAN use-after free in GC allocation in nsEventListenerManager::SetEventHandler (CVE-2013-5601) * MFSA 2013-101 / CVE-2013-5602: Security researcher Nils used the Address Sanitizer tool while fuzzing to discover a memory corruption issue with the JavaScript engine when using workers with direct proxies. This results in a potentially exploitable crash. Security Issue reference: * CVE-2013-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739> SUSE bug 847708 CVE-2013-1739 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This updates the Mozilla Firefox browser to the 24.3.0ESR security release. The Mozilla NSS libraries are now on version 3.15.4. The following security issues have been fixed: * MFSA 2014-01: Memory safety bugs fixed in Firefox ESR 24.3 and Firefox 27.0 (CVE-2014-1477)(bnc#862345) * MFSA 2014-02: Using XBL scopes its possible to steal(clone) native anonymous content (CVE-2014-1479)(bnc#862348) * MFSA 2014-03: Download "open file" dialog delay is too quick, doesn't prevent clickjacking (CVE-2014-1480) * MFSA 2014-04: Image decoding causing FireFox to crash with Goo Create (CVE-2014-1482)(bnc#862356) * MFSA 2014-05: caretPositionFromPoint and elementFromPoint leak information about iframe contents via timing information (CVE-2014-1483)(bnc#862360) * MFSA 2014-06: Fennec leaks profile path to logcat (CVE-2014-1484) * MFSA 2014-07: CSP should block XSLT as script, not as style (CVE-2014-1485) * MFSA 2014-08: imgRequestProxy Use-After-Free Remote Code Execution Vulnerability (CVE-2014-1486) * MFSA 2014-09: Cross-origin information disclosure with error message of Web Workers (CVE-2014-1487) * MFSA 2014-10: settings & history ID bug (CVE-2014-1489) * MFSA 2014-11: Firefox reproducibly crashes when using asm.js code in workers and transferable objects (CVE-2014-1488) * MFSA 2014-12: TOCTOU, potential use-after-free in libssl's session ticket processing (CVE-2014-1490)(bnc#862300) Do not allow p-1 as a public DH value (CVE-2014-1491)(bnc#862289) * MFSA 2014-13: Inconsistent this value when invoking getters on window (CVE-2014-1481)(bnc#862309) Security Issue references: * CVE-2014-1477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1477> * CVE-2014-1479 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1479> * CVE-2014-1480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1480> * CVE-2014-1481 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1481> * CVE-2014-1482 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1482> * CVE-2014-1483 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1483> * CVE-2014-1484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1484> * CVE-2014-1485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1485> * CVE-2014-1486 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1486> * CVE-2014-1487 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1487> * CVE-2014-1488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1488> * CVE-2014-1489 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1489> * CVE-2014-1490 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1490> * CVE-2014-1491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1491> SUSE bug 859055 SUSE bug 861847 CVE-2014-1477 CVE-2014-1479 CVE-2014-1480 CVE-2014-1481 CVE-2014-1482 CVE-2014-1483 CVE-2014-1484 CVE-2014-1485 CVE-2014-1486 CVE-2014-1487 CVE-2014-1488 CVE-2014-1489 CVE-2014-1490 CVE-2014-1491 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to 24.4.0ESR release, fixing various security issues and bugs: * MFSA 2014-15: Mozilla developers and community identified identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, and Christoph Diehl reported memory safety problems and crashes that affect Firefox ESR 24.3 and Firefox 27. (CVE-2014-1493) * Gregor Wagner, Olli Pettay, Gary Kwong, Jesse Ruderman, Luke Wagner, Rob Fletcher, and Makoto Kato reported memory safety problems and crashes that affect Firefox 27. (CVE-2014-1494) * MFSA 2014-16 / CVE-2014-1496: Security researcher Ash reported an issue where the extracted files for updates to existing files are not read only during the update process. This allows for the potential replacement or modification of these files during the update process if a malicious application is present on the local system. * MFSA 2014-17 / CVE-2014-1497: Security researcher Atte Kettunen from OUSPG reported an out of bounds read during the decoding of WAV format audio files for playback. This could allow web content access to heap data as well as causing a crash. * MFSA 2014-18 / CVE-2014-1498: Mozilla developer David Keeler reported that the crypto.generateCRFMRequest method did not correctly validate the key type of the KeyParams argument when generating ec-dual-use requests. This could lead to a crash and a denial of service (DOS) attack. * MFSA 2014-19 / CVE-2014-1499: Mozilla developer Ehsan Akhgari reported a spoofing attack where the permission prompt for a WebRTC session can appear to be from a different site than its actual originating site if a timed navigation occurs during the prompt generation. This allows an attacker to potentially gain access to the webcam or microphone by masquerading as another site and gaining user permission through spoofing. * MFSA 2014-20 / CVE-2014-1500: Security researchers Tim Philipp Schaefers and Sebastian Neef, the team of Internetwache.org, reported a mechanism using JavaScript onbeforeunload events with page navigation to prevent users from closing a malicious page's tab and causing the browser to become unresponsive. This allows for a denial of service (DOS) attack due to resource consumption and blocks the ability of users to exit the application. * MFSA 2014-21 / CVE-2014-1501: Security researcher Alex Infuehr reported that on Firefox for Android it is possible to open links to local files from web content by selecting "Open Link in New Tab" from the context menu using the file: protocol. The web content would have to know the precise location of a malicious local file in order to exploit this issue. This issue does not affect Firefox on non-Android systems. * MFSA 2014-22 / CVE-2014-1502: Mozilla developer Jeff Gilbert discovered a mechanism where a malicious site with WebGL content could inject content from its context to that of another site's WebGL context, causing the second site to replace textures and similar content. This cannot be used to steal data but could be used to render arbitrary content in these limited circumstances. * MFSA 2014-23 / CVE-2014-1504: Security researcher Nicolas Golubovic reported that the Content Security Policy (CSP) of data: documents was not saved as part of session restore. If an attacker convinced a victim to open a document from a data: URL injected onto a page, this can lead to a Cross-Site Scripting (XSS) attack. The target page may have a strict CSP that protects against this XSS attack, but if the attacker induces a browser crash with another bug, an XSS attack would occur during session restoration, bypassing the CSP on the site. * MFSA 2014-26 / CVE-2014-1508: Security researcher Tyson Smith and Jesse Schwartzentruber of the BlackBerry Security Automated Analysis Team used the Address Sanitizer tool while fuzzing to discover an out-of-bounds read during polygon rendering in MathML. This can allow web content to potentially read protected memory addresses. In combination with previous techniques used for SVG timing attacks, this could allow for text values to be read across domains, leading to information disclosure. * MFSA 2014-27 / CVE-2014-1509: Security researcher John Thomson discovered a memory corruption in the Cairo graphics library during font rendering of a PDF file for display. This memory corruption leads to a potentially exploitable crash and to a denial of service (DOS). This issues is not able to be triggered in a default configuration and would require a malicious extension to be installed. * MFSA 2014-28 / CVE-2014-1505: Mozilla developer Robert O'Callahan reported a mechanism for timing attacks involving SVG filters and displacements input to feDisplacementMap. This allows displacements to potentially be correlated with values derived from content. This is similar to the previously reported techniques used for SVG timing attacks and could allow for text values to be read across domains, leading to information disclosure. * MFSA 2014-29 / CVE-2014-1510 / CVE-2014-1511: Security researcher Mariusz Mlynski, via TippingPoint's Pwn2Own contest, reported that it is possible for untrusted web content to load a chrome-privileged page by getting JavaScript-implemented WebIDL to call window.open(). A second bug allowed the bypassing of the popup-blocker without user interaction. Combined these two bugs allow an attacker to load a JavaScript URL that is executed with the full privileges of the browser, which allows arbitrary code execution. * MFSA 2014-30 / CVE-2014-1512: Security research firm VUPEN, via TippingPoint's Pwn2Own contest, reported that memory pressure during Garbage Collection could lead to memory corruption of TypeObjects in the JS engine, resulting in an exploitable use-after-free condition. * MFSA 2014-31 / CVE-2014-1513: Security researcher Jueri Aedla, via TippingPoint's Pwn2Own contest, reported that TypedArrayObject does not handle the case where ArrayBuffer objects are neutered, setting their length to zero while still in use. This leads to out-of-bounds reads and writes into the JavaScript heap, allowing for arbitrary code execution. * MFSA 2014-32 / CVE-2014-1514: Security researcher George Hotz, via TippingPoint's Pwn2Own contest, discovered an issue where values are copied from an array into a second, neutered array. This allows for an out-of-bounds write into memory, causing an exploitable crash leading to arbitrary code execution. SUSE bug 868603 CVE-2014-1493 CVE-2014-1494 CVE-2014-1496 CVE-2014-1497 CVE-2014-1498 CVE-2014-1499 CVE-2014-1500 CVE-2014-1501 CVE-2014-1502 CVE-2014-1504 CVE-2014-1505 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513 CVE-2014-1514 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox has been updated to the 24.7ESR security release. Security issues fixed in this release: * CVE-2014-1544 - https://www.mozilla.org/security/announce/2014/mfsa2014-63.html <https://www.mozilla.org/security/announce/2014/mfsa2014-63.html> * CVE-2014-1548 - https://www.mozilla.org/security/announce/2014/mfsa2014-56.html <https://www.mozilla.org/security/announce/2014/mfsa2014-56.html> * CVE-2014-1549 - https://www.mozilla.org/security/announce/2014/mfsa2014-57.html <https://www.mozilla.org/security/announce/2014/mfsa2014-57.html> * CVE-2014-1550 - https://www.mozilla.org/security/announce/2014/mfsa2014-58.html <https://www.mozilla.org/security/announce/2014/mfsa2014-58.html> * CVE-2014-1551 - https://www.mozilla.org/security/announce/2014/mfsa2014-59.html <https://www.mozilla.org/security/announce/2014/mfsa2014-59.html> * CVE-2014-1552 - https://www.mozilla.org/security/announce/2014/mfsa2014-66.html <https://www.mozilla.org/security/announce/2014/mfsa2014-66.html> * CVE-2014-1555 - https://www.mozilla.org/security/announce/2014/mfsa2014-61.html <https://www.mozilla.org/security/announce/2014/mfsa2014-61.html> * CVE-2014-1556 - https://www.mozilla.org/security/announce/2014/mfsa2014-62.html <https://www.mozilla.org/security/announce/2014/mfsa2014-62.html> * CVE-2014-1557 - https://www.mozilla.org/security/announce/2014/mfsa2014-64.html <https://www.mozilla.org/security/announce/2014/mfsa2014-64.html> * CVE-2014-1558,CVE-2014-1559,CVE-2014-1560 - https://www.mozilla.org/security/announce/2014/mfsa2014-65.html <https://www.mozilla.org/security/announce/2014/mfsa2014-65.html> * CVE-2014-1561 - https://www.mozilla.org/security/announce/2014/mfsa2014-60.html <https://www.mozilla.org/security/announce/2014/mfsa2014-60.html> Security Issues: * CVE-2014-1557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1557> * CVE-2014-1547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1547> * CVE-2014-1548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1548> * CVE-2014-1556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1556> * CVE-2014-1544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1544> * CVE-2014-1555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1555> SUSE bug 887746 CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> SUSE bug 894370 CVE-2014-1562 CVE-2014-1567 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues. * MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * MFSA 2014-85 / CVE-2014-1590: Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. * MFSA 2014-87 / CVE-2014-1592: Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. * MFSA 2014-88 / CVE-2014-1593: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. * MFSA 2014-89 / CVE-2014-1594: Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. * MFSA 2014-90 / CVE-2014-1595: Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events. On vulnerable systems, this issue can result in private data such as usernames, passwords, and other inputed data being saved to a log file on the local system. Security Issues: * CVE-2014-1587 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1587> * CVE-2014-1588 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1588> * CVE-2014-1589 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1589> * CVE-2014-1590 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1590> * CVE-2014-1591 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1591> * CVE-2014-1592 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1592> * CVE-2014-1593 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1593> * CVE-2014-1594 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1594> * CVE-2014-1595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1595> SUSE bug 908009 CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-1595 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ <https://www.mozilla.org/en-US/security/advisories/> Security Issues: * CVE-2014-1569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569> * CVE-2014-8634 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8634> * CVE-2014-8639 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8639> * CVE-2014-8641 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8641> * CVE-2014-8638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8638> * CVE-2014-8636 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8636> * CVE-2014-8637 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8637> * CVE-2014-8640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8640> SUSE bug 910647 SUSE bug 910669 SUSE bug 913064 SUSE bug 913066 SUSE bug 913067 SUSE bug 913068 SUSE bug 913102 SUSE bug 913103 SUSE bug 913104 CVE-2014-1569 CVE-2014-8634 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox was updated to the 31.5.3ESR release to fix two security vulnerabilities: * MFSA 2015-29 / CVE-2015-0817: Security researcher ilxu1a reported, through HP Zero Day Initiative's Pwn2Own contest, a flaw in Mozilla's implementation of typed array bounds checking in JavaScript just-in-time compilation (JIT) and its management of bounds checking for heap access. This flaw can be leveraged into the reading and writing of memory allowing for arbitary code execution on the local system. * MFSA 2015-28 / CVE-2015-0818: Security researcher Mariusz Mlynski reported, through HP Zero Day Initiative's Pwn2Own contest, a method to run arbitrary scripts in a privileged context. This bypassed the same-origin policy protections by using a flaw in the processing of SVG format content navigation. Security Issues: * CVE-2015-0817 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817> * CVE-2015-0818 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818> SUSE bug 923534 CVE-2015-0817 CVE-2015-0818 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to Firefox 31.7.0 ESR fixes the following issues: * MFSA 2015-46 (CVE-2015-2708, CVE-2015-2709): Miscellaneous memory safety hazards (rv:38.0 / rv:31.7). Upstream references: bmo#1120655, bmo#1143299, bmo#1151139, bmo#1152177, bmo#1111251, bmo#1117977, bmo#1128064, bmo#1135066, bmo#1143194, bmo#1146101, bmo#1149526, bmo#1153688, bmo#1155474. * MFSA 2015-47 (CVE-2015-0797): Buffer overflow parsing H.264 video with Linux Gstreamer. Upstream references: bmo#1080995. * MFSA 2015-48 (CVE-2015-2710): Buffer overflow with SVG content and CSS. Upstream references: bmo#1149542. * MFSA 2015-51 (CVE-2015-2713): Use-after-free during text processing with vertical text enabled. Upstream references: bmo#1153478. * MFSA 2015-54 (CVE-2015-2716): Buffer overflow when parsing compressed XML. Upstream references: bmo#1140537. Security Issues: * CVE-2015-0797 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0797> * CVE-2015-2708 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708> * CVE-2015-2709 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709> * CVE-2015-2710 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710> * CVE-2015-2713 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713> * CVE-2015-2716 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716> SUSE bug 930622 CVE-2015-0797 CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to version 38.3.0 ESR (bsc#947003), fixing bugs and security issues. * MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3) * MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video * MFSA 2015-105/CVE-2015-4511 Buffer overflow while decoding WebM video * MFSA 2015-106/CVE-2015-4509 Use-after-free while manipulating HTML media content * MFSA 2015-110/CVE-2015-4519 Dragging and dropping images exposes final URL after redirects * MFSA 2015-111/CVE-2015-4520 Errors in the handling of CORS preflight request headers * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 Vulnerabilities found through code inspection More details can be found on https://www.mozilla.org/en-US/security/advisories/ The Mozilla NSPR library was updated to version 4.10.9, fixing various bugs. Important SUSE bug 947003 CVE-2015-4500 CVE-2015-4501 CVE-2015-4506 CVE-2015-4509 CVE-2015-4511 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7180 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox was updated to version 38.3.0 ESR (bsc#947003), fixing bugs and security issues. * MFSA 2015-96/CVE-2015-4500/CVE-2015-4501 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3) * MFSA 2015-101/CVE-2015-4506 Buffer overflow in libvpx while parsing vp9 format video * MFSA 2015-105/CVE-2015-4511 Buffer overflow while decoding WebM video * MFSA 2015-106/CVE-2015-4509 Use-after-free while manipulating HTML media content * MFSA 2015-110/CVE-2015-4519 Dragging and dropping images exposes final URL after redirects * MFSA 2015-111/CVE-2015-4520 Errors in the handling of CORS preflight request headers * MFSA 2015-112/CVE-2015-4517/CVE-2015-4521/CVE-2015-4522 CVE-2015-7174/CVE-2015-7175/CVE-2015-7176/CVE-2015-7177 CVE-2015-7180 Vulnerabilities found through code inspection More details can be found on https://www.mozilla.org/en-US/security/advisories/ Important SUSE bug 947003 CVE-2015-4500 CVE-2015-4501 CVE-2015-4506 CVE-2015-4509 CVE-2015-4511 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7180 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This Mozilla Firefox, NSS and NSPR update fixes the following security and non security issues. - mozilla-nspr was updated to version 4.10.10 (bsc#952810) * MFSA 2015-133/CVE-2015-7183 (bmo#1205157) NSPR memory corruption issues - mozilla-nss was updated to 3.19.2.1 (bsc#952810) * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868) NSS and NSPR memory corruption issues - MozillaFirefox was updated to 38.4.0 ESR (bsc#952810) * MFSA 2015-116/CVE-2015-4513 (bmo#1107011, bmo#1191942, bmo#1193038, bmo#1204580, bmo#1204669, bmo#1204700, bmo#1205707, bmo#1206564, bmo#1208665, bmo#1209471, bmo#1213979) Miscellaneous memory safety hazards (rv:42.0 / rv:38.4) * MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing whitespace in IP address hostnames can bypass same-origin policy * MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer overflow during image interactions in canvas * MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight is bypassed when non-standard Content-Type headers are received * MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory corruption in libjar through zip files * MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript garbage collection crash with Java applet * MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 (bmo#1204061, bmo#1188010, bmo#1204155) Vulnerabilities found through code inspection * MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content WebSocket policy bypass through workers * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 (bmo#1202868, bmo#1192028, bmo#1205157) NSS and NSPR memory corruption issues - fix printing on landscape media (bsc#908275) Important SUSE bug 908275 SUSE bug 952810 CVE-2015-4513 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 CVE-2015-7188 CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox and mozilla-nss fixes the following issues: Mozilla Firefox was updated to ESR 52.4 (bsc#1060445) * MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes * MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode * MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation * MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API * MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE * MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4 * MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin * MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings Mozilla Network Security Services (Mozilla NSS) received a security fix: * MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445) Important SUSE bug 1060445 SUSE bug 1061005 CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 CVE-2017-7825 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox, firefox-glib2, firefox-gtk3 fixes the following issues: Mozilla Firefox was updated to the 60.9.0esr release: Security Advisory MFSA 2019-27: * Use-after-free while manipulating video CVE-2019-11746 (bmo#1564449, bsc#1149297) * XSS by breaking out of title and textarea elements using innerHTML CVE-2019-11744 (bmo#1562033, bsc#1149297) * Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 (bmo#1559715, bsc#1149303) * Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location CVE-2019-11753 (bmo#1574980, bsc#1149295) * Use-after-free while extracting a key value in IndexedDB CVE-2019-11752 (bmo#1501152, bsc#1149296) * Sandbox escape through Firefox Sync CVE-2019-9812 (bmo#1538008, bmo#1538015, bsc#1149294) * Cross-origin access to unload event attributes CVE-2019-11743 (bmo#1560495, bsc#1149298) Navigation-Timing Level 2 specification * Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 (bmo#1563133, bmo#1573160, bsc#1149299) - Rebuild glib2 schemas on SLE-11 (bsc#1145550) Changes in firefox-glib2: - Fix the rpm macros %glib2_gsettings_schema_* which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550) Changes in firefox-gtk3: - Rebuild so %glib2_gsettings_schema_post gets called with fixed rpm macros %glib2_gsettings_schema_* in firefox-glib2 package which were replaced with %nil in Factory because they're no longer needed, but we still need them in SLE11 (bsc#1145550) Important SUSE bug 1145550 SUSE bug 1149294 SUSE bug 1149295 SUSE bug 1149296 SUSE bug 1149297 SUSE bug 1149298 SUSE bug 1149299 SUSE bug 1149303 CVE-2019-11740 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744 CVE-2019-11746 CVE-2019-11752 CVE-2019-11753 CVE-2019-9812 SUSE Linux Enterprise Server 11 SP3-TERADATA This update contains Mozilla Firefox 60.7ESR. It brings lots of security fixes and other improvements. It also includes new additional helper libraries to allow Firefox to run on SUSE Linux Enterprise 11. Moderate SUSE bug 1137338 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MozillaFirefox has been updated to the 24.2.0 ESR security release. This is a major upgrade from the 17 ESR release branch. Security issues fixed: * CVE-2013-5611 Application Installation doorhanger persists on navigation (MFSA 2013-105) * CVE-2013-5609 Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104) * CVE-2013-5610 Miscellaneous memory safety hazards (rv:26.0) (MFSA 2013-104) * CVE-2013-5612 Character encoding cross-origin XSS attack (MFSA 2013-106) * CVE-2013-5614 Sandbox restrictions not applied to nested object elements (MFSA 2013-107) * CVE-2013-5616 Use-after-free in event listeners (MFSA 2013-108) * CVE-2013-5619 Potential overflow in JavaScript binary search algorithms (MFSA 2013-110) * CVE-2013-6671 Segmentation violation when replacing ordered list elements (MFSA 2013-111) * CVE-2013-6673 Trust settings for built-in roots ignored during EV certificate validation (MFSA 2013-113) * CVE-2013-5613 Use-after-free in synthetic mouse movement (MFSA 2013-114) * CVE-2013-5615 GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115) * CVE-2013-6672 Linux clipboard information disclosure though selection paste (MFSA 2013-112) * CVE-2013-5618 Use-after-free during Table Editing (MFSA 2013-109) Security Issue references: * CVE-2013-5609 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5609> * CVE-2013-5610 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5610> * CVE-2013-5611 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5611> * CVE-2013-5612 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5612> * CVE-2013-5613 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5613> * CVE-2013-5614 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5614> * CVE-2013-5615 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5615> * CVE-2013-5616 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5616> * CVE-2013-5618 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5618> * CVE-2013-5619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5619> * CVE-2013-6671 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6671> * CVE-2013-6672 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6672> * CVE-2013-6673 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6673> SUSE bug 854367 SUSE bug 854370 CVE-2013-5609 CVE-2013-5610 CVE-2013-5611 CVE-2013-5612 CVE-2013-5613 CVE-2013-5614 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-5619 CVE-2013-6671 CVE-2013-6672 CVE-2013-6673 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This version update of Mozilla Firefox to 31.2.0ESR brings improvements, stability fixes and also security fixes for the following CVEs: CVE-2014-1574, CVE-2014-1575, CVE-2014-1576 ,CVE-2014-1577, CVE-2014-1578, CVE-2014-1581, CVE-2014-1583, CVE-2014-1585, CVE-2014-1586 It also disables SSLv3 by default to mitigate the protocol downgrade attack known as POODLE. This update fixes some regressions introduced by the previously released update. Security Issues: * CVE-2014-1574 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1574> * CVE-2014-1575 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1575> * CVE-2014-1576 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1576> * CVE-2014-1577 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1577> * CVE-2014-1578 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1578> * CVE-2014-1581 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581> * CVE-2014-1583 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1583> * CVE-2014-1585 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1585> * CVE-2014-1586 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1586> SUSE bug 900941 SUSE bug 905056 SUSE bug 905528 CVE-2014-1574 CVE-2014-1575 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla Firefox is being updated to the current Firefox 38ESR branch (specifically the 38.2.0ESR release). Security issues fixed: - MFSA 2015-78 / CVE-2015-4495: Same origin violation and local file stealing via PDF reader - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474: Miscellaneous memory safety hazards (rv:40.0 / rv:38.2) - MFSA 2015-80 / CVE-2015-4475: Out-of-bounds read with malformed MP3 file - MFSA 2015-82 / CVE-2015-4478: Redefinition of non-configurable JavaScript object properties - MFSA 2015-83 / CVE-2015-4479: Overflow issues in libstagefright - MFSA 2015-87 / CVE-2015-4484: Crash when using shared memory in JavaScript - MFSA 2015-88 / CVE-2015-4491: Heap overflow in gdk-pixbuf when scaling bitmap images - MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486: Buffer overflows on Libvpx when decoding WebM video - MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489: Vulnerabilities found through code inspection - MFSA 2015-92 / CVE-2015-4492: Use-after-free in XMLHttpRequest with shared workers This update also contains a lot of feature improvements and bug fixes from 31ESR to 38ESR. Also the Mozilla NSS library switched its CKBI API from 1.98 to 2.4, which is what Firefox 38ESR uses. Important SUSE bug 940806 CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4495 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA flac was updated to fix two security issues: * Stack overflow may result in arbitrary code execution (CVE-2014-8962). * Heap overflow via specially crafted .flac files (CVE-2014-9028). Security Issues: * CVE-2014-8962 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8962> * CVE-2014-9028 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9028> SUSE bug 906831 SUSE bug 907016 CVE-2014-8962 CVE-2014-9028 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for fontconfig fixes the following issues: - security update: * CVE-2016-5384: Possible double free due to insufficiently validated cache files [bsc#992534] Low SUSE bug 992534 CVE-2016-5384 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues: CVE-2015-8327: adds backtick and semicolon to the list of illegal shell escape characters (bsc#957531). CVE-2015-8560: fixed code execution via improper escaping of ; (bsc#957531). Moderate SUSE bug 957531 CVE-2015-8327 CVE-2015-8560 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a denial of service (crash) security issue rlm_pap hash processing in FreeRadius, which could have been caused by special passwords fed into the RLM-PAP password checking method via LDAP by remote attackers. Security Issue reference: * CVE-2014-2015 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2015> SUSE bug 864576 CVE-2014-2015 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for freeradius-server fixes the following issues: - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. (bnc#1041445) - CVE-2015-4680: Add a configuration option to allow checking of all intermediate certificates for revocations. (bnc#935573) The following non security issue was fixed: - Cannot create table radpostauth because of deprecated TIMESTAMP(14) syntax. (bsc#912873) Moderate SUSE bug 1041445 SUSE bug 912873 SUSE bug 935573 CVE-2015-4680 CVE-2017-9148 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for freeradius-server fixes the following issues: Security issues fixed: - CVE-2017-10981: DHCP - Fix memory leak in fr_dhcp_decode(). (bnc#1049086) - CVE-2017-10982: Fix buffer over-read in fr_dhcp_decode_options(). (bsc#1049086) - CVE-2017-10983: Fix read overflow when decoding option 63. (bnc#1049086) - CVE-2017-10978: Fix read / write overflow in make_secret(). (bnc#1049086) - CVE-2017-10979: Fix write overflow in rad_coalesce(). (bsc#1049086) Moderate SUSE bug 1049086 CVE-2017-10978 CVE-2017-10979 CVE-2017-10981 CVE-2017-10982 CVE-2017-10983 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of the freetype2 library fixes two security issues: - An infinite loop in parse_encoding in t1load.c (CVE-2014-9745, bsc#945849) - Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix (CVE-2014-9747, bsc#947966) Moderate SUSE bug 945849 SUSE bug 947966 CVE-2014-9745 CVE-2014-9747 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for freetype2 fixes the following issues: Security issue fixed: - CVE-2016-10244: The parse_charstrings function in type1/t1load.c did not ensure that a font contains a glyph name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file (bsc#1028103). - CVE-2017-8105: Fixed an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.ca (bsc#1035807) - CVE-2017-8287: an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c (bsc#1036457) Moderate SUSE bug 1028103 SUSE bug 1035807 SUSE bug 1036457 CVE-2016-10244 CVE-2017-8105 CVE-2017-8287 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for freetype2 fixes the following issues: Security issue fixed: - CVE-2016-10328: Fixed heap-based buffer overflow in cff_parser_run function in cff/cffparse.c (bsc#1034191). Moderate SUSE bug 1034191 CVE-2016-10328 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The font rendering library freetype2 has been updated to fix various security issues. Security Issues: * CVE-2014-9656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9656> * CVE-2014-9657 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9657> * CVE-2014-9658 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9658> * CVE-2014-9660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9660> * CVE-2014-9661 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9661> * CVE-2014-9662 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9662> * CVE-2014-9667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9667> * CVE-2014-9666 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9666> * CVE-2014-9665 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9665> * CVE-2014-9664 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9664> * CVE-2014-9663 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9663> * CVE-2014-9659 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9659> * CVE-2014-9668 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9668> * CVE-2014-9669 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9669> * CVE-2014-9670 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9670> * CVE-2014-9671 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9671> * CVE-2014-9672 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9672> * CVE-2014-9673 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9673> * CVE-2014-9674 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9674> * CVE-2014-9675 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9675> SUSE bug 916856 SUSE bug 916857 SUSE bug 916858 SUSE bug 916859 SUSE bug 916861 SUSE bug 916863 SUSE bug 916864 SUSE bug 916865 SUSE bug 916870 SUSE bug 916871 SUSE bug 916872 SUSE bug 916873 SUSE bug 916874 SUSE bug 916879 SUSE bug 916881 CVE-2014-9656 CVE-2014-9657 CVE-2014-9658 CVE-2014-9659 CVE-2014-9660 CVE-2014-9661 CVE-2014-9662 CVE-2014-9663 CVE-2014-9664 CVE-2014-9665 CVE-2014-9666 CVE-2014-9667 CVE-2014-9668 CVE-2014-9669 CVE-2014-9670 CVE-2014-9671 CVE-2014-9672 CVE-2014-9673 CVE-2014-9674 CVE-2014-9675 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for FUSE fixes the following security issue: * CVE-2015-3202: FUSE did not clear the environment upon execution of external programs. Security Issues: * CVE-2015-3202 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202> SUSE bug 931452 CVE-2015-3202 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for fuse fixes the following issues: Security issue fixed: - CVE-2018-10906: Fix a bypass of the user_allow_other restriction (bsc#1101797) Moderate SUSE bug 1101797 CVE-2018-10906 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gcc43 fixes the following issues: Security issue fixed: - CVE-2017-1000376: Don't request excutable stack from libffi. [bnc#1045091] New features: - Add support for retpolines to mitigate the Spectre Variant 2 attack. [bnc#1074621] - Add support for zero-sized VLAs and allocas with -fstack-clash-protection. [bnc#1059075] - Add support for -fstack-clash-protection to mitigate the Stack Clash attack. [bnc#1039513] Non security bugs fixed: - Fixed build of 32bit libgcov.a with LFS support. [bsc#1044016] - Fixed issue with libstdc++ functional when an exception is thrown during construction. [bsc#999596] - Fixed issue with using gcov and #pragma pack. [bsc#977654] - Fixed ICE compiling AFS modules for the s390x kernel. [bsc#938159] - Backport large file support from GCC 4.6. Moderate SUSE bug 1039513 SUSE bug 1044016 SUSE bug 1045091 SUSE bug 1059075 SUSE bug 1074621 SUSE bug 938159 SUSE bug 977654 SUSE bug 999596 CVE-2017-1000376 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gcc43 fixes the following issues: This update adds support for "expolines" on s390x, allowing fixing CVE-2017-5715 in a more lightweight fashion. (bsc#1086069) The option flags are the same as for the x86 retpolines. A compiler crash when building userland packages with x86 retpolines was fixed. (bsc#1092807) Moderate SUSE bug 1086069 SUSE bug 1092807 CVE-2017-5715 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gcc48 fixes the following issues: Security issues fixed: - A new option -fstack-clash-protection is now offered, which mitigates the stack clash type of attacks. [bnc#1039513] - CVE-2017-11671: Fixed rdrand/rdseed code generation issue [bsc#1050947] Bugs fixed: - Enable LFS support in 32bit libgcov.a. [bsc#1044016] - Bump libffi version in libffi.pc to 3.0.11. - Properly diagnose missing -fsanitize=address support on ppc64le. [bsc#1028744] - Backport patch for PR65612. [bsc#1022062] - Re-spin to provide missing libasan0-32bit and other multilibs via the updated product description. [bsc#951644] - Fixed for DR#1288. [bsc#1011348] - Fix libffi issue for armv7l. [bsc#988274] - Fixed a kernel miscompile on aarch64. [bnc #981311] - Fixed a ppc64le internal compiler error. [bnc #976627] - Fixed issue with using gcov and #pragma pack. [bsc#977654] - Fixed samba build on AARCH64. [bsc#970009] - Build without GRAPHITE where cloog-isl is not available. - Fixed HTM builtins on powerpc. [bsc#955382] - Fixed build of SLOF. [bsc#949000] - Fixed C++11 std::random_device short reads, CVE-2015-5276. [bsc#945842] - Fixed libffi issues on aarch64. [bsc#948168] - Fixed no_instrument_function attribute handling on PPC64 with -mprofile-kernel. [bsc#947791] - Enable 32bit code generation for ppc64le but do not build 32bit target libraries. Fixes ppc64le kernel compile. - Update to GCC 4.8.5 release. * Fixes bogus integer overflow in constant expression. [bsc#934689] * Fixes ICE with atomics on aarch64. [bsc#930176] - Fixed reload issue on S390. - Add patch to keep functions leaf when they are instrumented for profiling on s390[x]. [bsc#899871] - Avoid accessing invalid memory when passing aggregates by value. [bsc#922534] - Build s390[x] with --with-tune=z9-109 --with-arch=z900 on SLE11 again. [bsc#927993] - Update to gcc-4_8-branch head (r221715). * Includes GCC 4.8.4 release. * Includes fix for -imacros bug. [bsc#917169] * Includes fix for incorrect -Warray-bounds warnings. [bsc#919274] * Includes updated -mhotpatch for s390x. [bsc#924525] * Includes fix for ppc64le issue with doubleword vector extract. [bsc#924687] - Backport rework of the memory allocator for C++ exceptions used in OOM situations. [bsc#889990] - Remove invalid use of glibc internals in TSAN. - Update to gcc-4_8-branch head (r218481). * Includes patches to allow building against ISL 0.14. - Disable all languages but C, C++, Fortran and Ada. [fate#316860] Moderate SUSE bug 1011348 SUSE bug 1022062 SUSE bug 1028744 SUSE bug 1039513 SUSE bug 1044016 SUSE bug 1050947 SUSE bug 878067 SUSE bug 889990 SUSE bug 899871 SUSE bug 917169 SUSE bug 919274 SUSE bug 922534 SUSE bug 924525 SUSE bug 924687 SUSE bug 927993 SUSE bug 930176 SUSE bug 934689 SUSE bug 945842 SUSE bug 947772 SUSE bug 947791 SUSE bug 948168 SUSE bug 949000 SUSE bug 951644 SUSE bug 955382 SUSE bug 970009 SUSE bug 976627 SUSE bug 977654 SUSE bug 981311 SUSE bug 988274 CVE-2014-5044 CVE-2015-5276 CVE-2017-11671 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The graphics drawing library gd has been updated to fix one security issue: * possible buffer read overflow (CVE-2014-9709) Security Issues: * CVE-2014-9709 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9709> SUSE bug 923945 CVE-2014-9709 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gd fixes the following issues: - security update: * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] Moderate SUSE bug 988032 CVE-2016-6161 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gd fixes the following issues: - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) Moderate SUSE bug 1004924 SUSE bug 1005274 CVE-2016-6911 CVE-2016-8670 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gd fixes the following issues: * CVE-2016-9933 possible stackoverflow on malicious truecolor images [bsc#1015187] Moderate SUSE bug 1015187 CVE-2016-9933 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gd fixes the following security issues: - CVE-2016-9317: The gdImageCreate function in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (system hang) via an oversized image. (bsc#1022283) - CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx() could lead to libgd running out of memory even on small files. (bsc#1022264) - CVE-2016-10168: A signed integer overflow in the GD Graphics Library (aka libgd) could lead to memory corruption (bsc#1022265) Moderate SUSE bug 1022264 SUSE bug 1022265 SUSE bug 1022283 CVE-2016-10167 CVE-2016-10168 CVE-2016-9317 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gd fixes several issues. This security issue was fixed: - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This non-security issue was fixed: - Fixed gd2togif error message (bsc#1025223) Moderate SUSE bug 1025223 SUSE bug 1076391 CVE-2018-5711 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gdb fixes the following issues: Security issue fixed: - CVE-2019-1010180: Fixed a buffer overflow and out of bound memory access that can lead to deny of service, memory disclosure, and possible code execution (bsc#1142772). Moderate SUSE bug 1142772 CVE-2019-1010180 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript fixes the following issues: - CVE-2016-8602: Insufficient parameter check in .sethalftone5 (bsc#1004237) Moderate SUSE bug 1004237 CVE-2016-8602 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript-library fixes the following issues: - Multiple security vulnerabilities have been discovered where ghostscript's "-dsafer" flag did not provide sufficient protection against unintended access to the file system. Thus, a machine that would process a specially crafted Postscript file would potentially leak sensitive information to an attacker. (CVE-2013-5653, CVE-2016-7977, bsc#1001951) - Insufficient validation of the type of input in .initialize_dsc_parser used to allow remote code execution. (CVE-2016-7979, bsc#1001951) - An integer overflow in the gs_heap_alloc_bytes function used to allow remote attackers to cause a denial of service (crash) via specially crafted Postscript files. (CVE-2015-3228, boo#939342) Important SUSE bug 1001951 SUSE bug 939342 CVE-2013-5653 CVE-2015-3228 CVE-2016-7977 CVE-2016-7979 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript fixes the following security vulnerability: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) Important SUSE bug 1036453 CVE-2017-8291 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript fixes the following security vulnerability: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) This update is a reissue including the SUSE Linux Enterprise 11 SP3 product. Important SUSE bug 1036453 CVE-2017-8291 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript-library fixes several issues. These security issues were fixed: - CVE-2017-7207: The mem_get_bits_rectangle function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document (bsc#1030263). - CVE-2016-9601: Prevent heap-buffer overflow by checking for an integer overflow in jbig2_image_new function (bsc#1018128). - CVE-2017-9612: The Ins_IP function in base/ttinterp.c allowed remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050891) - CVE-2017-9726: The Ins_MDRP function in base/ttinterp.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050889) - CVE-2017-9727: The gx_ttfReader__Read function in base/gxttfb.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050888) - CVE-2017-9739: The Ins_JMPR function in base/ttinterp.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050887) - CVE-2017-11714: psi/ztoken.c mishandled references to the scanner state structure, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c (bsc#1051184) - CVE-2017-9835: The gs_alloc_ref_array function allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document (bsc#1050879) - CVE-2016-10219: The intersect function in base/gxfill.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file (bsc#1032138) - CVE-2017-9216: Prevent NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c which allowed for DoS (bsc#1040643) Moderate SUSE bug 1018128 SUSE bug 1030263 SUSE bug 1032138 SUSE bug 1032230 SUSE bug 1040643 SUSE bug 1050879 SUSE bug 1050887 SUSE bug 1050888 SUSE bug 1050889 SUSE bug 1050891 SUSE bug 1051184 CVE-2016-10219 CVE-2016-9601 CVE-2017-11714 CVE-2017-7207 CVE-2017-9216 CVE-2017-9612 CVE-2017-9726 CVE-2017-9727 CVE-2017-9739 CVE-2017-9835 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript-library fixes the following issues: - CVE-2018-10194: Fixed a stack-based buffer overflow in gdevpdts.c (bsc#1090099) - Fixed a crash in the fix for CVE-2016-9601. Moderate SUSE bug 1090099 CVE-2016-9601 CVE-2018-10194 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript-library fixes the following issues: - CVE-2018-16511: A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. (bsc#1107426) - CVE-2018-16540: Attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact. (bsc#1107420) - CVE-2018-16541: Attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter. (bsc#1107421) - CVE-2018-16542: Attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter. (bsc#1107413) - CVE-2018-16509: Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. (bsc#1107410 - CVE-2018-16513: Attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact. (bsc#1107412) - CVE-2018-15910: Attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code. (bsc#1106173) - CVE-2017-9611: The Ins_MIRP function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. (bsc#1050893) Important SUSE bug 1050893 SUSE bug 1106173 SUSE bug 1107410 SUSE bug 1107412 SUSE bug 1107413 SUSE bug 1107420 SUSE bug 1107421 SUSE bug 1107426 CVE-2017-9611 CVE-2018-15910 CVE-2018-16509 CVE-2018-16511 CVE-2018-16513 CVE-2018-16540 CVE-2018-16541 CVE-2018-16542 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ghostscript-library fixes the following issues: Security issue fixed: - CVE-2019-3838: Fixed various bugs which allows to reenable and misuse system Postscript operators to read files from within Postscript files and send them with the help of e.g. the %pipe% to the attacker (bsc#1129186). Important SUSE bug 1129186 CVE-2019-3838 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for giflib fixes the following issues: - CVE-2015-7555: Heap overflow in giffix (bsc#960319) Moderate SUSE bug 960319 CVE-2015-7555 SUSE Linux Enterprise Server 11 SP3-TERADATA giflib was updated to fix one security issue. This security issue was fixed: - CVE-2016-3977: Heap buffer overflow in gif2rgb (bsc#974847). Moderate SUSE bug 974847 CVE-2016-3977 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glib2 fixes the following issues: Security issues fixed: - CVE-2018-16429: Fixed out-of-bounds read vulnerability ing_markup_parse_context_parse() (bsc#1107116). - Fixing potentially exploitable bugs in UTF-8 validation in Variant and DBUS message parsing (bsc#1111499). Moderate SUSE bug 1107116 SUSE bug 1111499 CVE-2018-16429 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glib2 fixes the following issues: Security issue fixed: - CVE-2019-12450: Fixed an improper file permission when copy operation takes place (bsc#1137001). Important SUSE bug 1137001 CVE-2019-12450 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This glibc update fixes a critical privilege escalation problem and two non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv. * bnc#888347: printf-multibyte-format.patch: Don't parse %s format argument as multi-byte string. Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> SUSE bug 888347 SUSE bug 892065 SUSE bug 892073 CVE-2014-5119 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc provides fixes for security and non-security issues. These security issues have been fixed: - CVE-2015-1781: Buffer length after padding in resolv/nss_dns/dns-host.c. (bsc#927080) - CVE-2013-2207: pt_chown did not properly check permissions for tty files, which allowed local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. (bsc#830257) - CVE-2014-8121: DB_LOOKUP in the Name Service Switch (NSS) did not properly check if a file is open, which allowed remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over the database, which triggers the file pointer to be reset. (bsc#918187) - Fix read past end of pattern in fnmatch. (bsc#920338) These non-security issues have been fixed: - Fix locking in _IO_flush_all_lockp() to prevent deadlocks in applications. (bsc#851280) - Record TTL also for DNS PTR queries. (bsc#928723) - Fix invalid free in ld.so. (bsc#932059) - Make PowerPC64 default to non-executable stack. (bsc#933770) - Fix floating point exceptions in some circumstances with exp() and friends. (bsc#933903) - Fix bad TEXTREL in glibc.i686. (bsc#935286) Important SUSE bug 830257 SUSE bug 851280 SUSE bug 918187 SUSE bug 920338 SUSE bug 927080 SUSE bug 928723 SUSE bug 932059 SUSE bug 933770 SUSE bug 933903 SUSE bug 935286 CVE-2013-2207 CVE-2014-8121 CVE-2015-1781 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#930721: Accept leading and trailing spaces in getdate input string - bsc#942317: Recognize power8 platform - bsc#950944: Always enable pointer guard - bsc#956988: Fix deadlock in __dl_iterate_phdr Important SUSE bug 930721 SUSE bug 942317 SUSE bug 950944 SUSE bug 956988 SUSE bug 961721 SUSE bug 962736 SUSE bug 962737 SUSE bug 962738 SUSE bug 962739 CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: - Drop old fix that could break services that start before IPv6 is up. (bsc#931399) - Do not copy d_name field of struct dirent. (CVE-2016-1234, bsc#969727) - Fix memory leak in _nss_dns_gethostbyname4_r. (bsc#973010) - Relocate DSOs in dependency order, fixing a potential crash during symbol relocation phase. (bsc#986302) - Fix nscd assertion failure in gc. (bsc#965699) - Fix stack overflow in _nss_dns_getnetbyname_r. (CVE-2016-3075, bsc#973164) - Fix getaddrinfo stack overflow in hostent conversion. (CVE-2016-3706, bsc#980483) - Do not use alloca in clntudp_call. (CVE-2016-4429, bsc#980854) Moderate SUSE bug 931399 SUSE bug 965699 SUSE bug 969727 SUSE bug 973010 SUSE bug 973164 SUSE bug 973179 SUSE bug 980483 SUSE bug 980854 SUSE bug 986302 CVE-2016-1234 CVE-2016-3075 CVE-2016-3706 CVE-2016-4429 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] Important SUSE bug 1039357 CVE-2017-1000366 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: - A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293] Important SUSE bug 1074293 CVE-2018-1000001 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: Security issues: - CVE-2017-8804: Fix memory leak after deserialization failure in xdr_bytes, xdr_string (bsc#1037930) - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes (bsc#1051791) - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal memalign and malloc functions (bsc#1079036) - CVE-2018-1000001: Avoid underflow of malloced area in realpath (bsc#1074293) Also a non security issue was fixed: - Do not fail if one of the two responses to AF_UNSPEC fails (bsc#978209) Important SUSE bug 1037930 SUSE bug 1051791 SUSE bug 1074293 SUSE bug 1079036 SUSE bug 978209 CVE-2017-12132 CVE-2017-8804 CVE-2018-1000001 CVE-2018-6485 CVE-2018-6551 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: Security issues fixed: - CVE-2017-12133: Avoid use-after-free read access in clntudp_call (bsc#1081556) Non security issue fixed: - Fix incorrect getaddrinfo assertion trigger (bsc#1076871) Moderate SUSE bug 1076871 SUSE bug 1081556 CVE-2017-12133 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: Security issue fixed: - CVE-2018-11236: Fix 32bit arch integer overflow in stdlib/canonicalize.c when processing very long pathname arguments (bsc#1094161). Bug fixes: - bsc#1086690: Fix crash in resolver on memory allocation failure. - bsc#1077763: Fix allocation in in6ailist_add. - bsc#1079625: Fix allocation in nss_compat for large number of memberships to a group. Important SUSE bug 1077763 SUSE bug 1079625 SUSE bug 1086690 SUSE bug 1094161 CVE-2018-11236 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following security issues: - CVE-2017-15670: Prevent off-by-one error that lead to a heap-based buffer overflow in the glob function, related to the processing of home directories using the ~ operator followed by a long string (bsc#1064583) - CVE-2017-15804: The glob function contained a buffer overflow during unescaping of user names with the ~ operator (bsc#1064580) - CVE-2015-5180: res_query in libresolv allowed remote attackers to cause a denial of service (NULL pointer dereference and process crash) (bsc#941234). This non-security issue was fixed: - Fix inaccuracies in casin, cacos, casinh, cacosh (bsc#1058774) Important SUSE bug 1058774 SUSE bug 1064580 SUSE bug 1064583 SUSE bug 941234 CVE-2015-5180 CVE-2017-15670 CVE-2017-15804 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: Security issue fixed: - CVE-2017-15671: Fixed memory leak in glob with GLOB_TILDE (bsc#1064569, BZ #22325). Non-security issue fixed: - Avoid access beyond memory bounds in pthread_attr_getaffinity_np (bsc#1110170, BZ #15618). - Remove improper assert in dlclose (bsc#1110174, BZ #11941). Moderate SUSE bug 1064569 SUSE bug 1110170 SUSE bug 1110174 CVE-2017-15671 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issue: Security issue fixed: - CVE-2009-5155: Fixed a local denial of service inside the parse_reg_exp in posix/regcomp.c (bsc#1127223). Moderate SUSE bug 1127223 CVE-2009-5155 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for glibc fixes the following issues: Security issue fixed: - CVE-2019-9169: Fixed heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308). Important SUSE bug 1127308 CVE-2019-9169 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gnome-session fixes the following issues: - CVE-2017-11171: Fix a denial of service condition. an unauthenticated local user can create ICE connections, causing a file descriptor leak in gnome-session (bsc#1048274). Moderate SUSE bug 1048274 CVE-2017-11171 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> SUSE bug 880730 SUSE bug 880910 CVE-2014-3466 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This security update of gnutls fixes the following issues: - use minimal padding for CBC, the default random length padding causes problems with some servers (bsc#925499) * added gnutls-use_minimal_cbc_padding.patch - use the default DH minimum for gnutls-cli instead of hardcoding 512 * CVE-2015-4000 (Logjam) (bsc#932026) * added gnutls-CVE-2015-4000-logjam-use_the_default_DH_min_for_cli.patch Moderate SUSE bug 925499 SUSE bug 932026 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gnutls fixes the following security issues: - CVE-2015-8313: First byte of the padding in CBC mode is not checked (bsc#957568) - CVE-2015-2806: Two-byte stack overflow in asn1_der_decoding (bsc#924828) Moderate SUSE bug 924828 SUSE bug 947271 SUSE bug 957568 CVE-2015-2806 CVE-2015-8313 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491). - CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879). - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). Important SUSE bug 1005879 SUSE bug 1018832 SUSE bug 961491 CVE-2016-8610 CVE-2017-5335 CVE-2017-5336 CVE-2017-5337 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gnutls fixes the following issues: - GNUTLS-SA-2017-3 / CVE-2017-7869: An out-of-bounds write in OpenPGP certificate decoding was fixed (bsc#1034173) - CVE-2017-6891: A potential stack buffer overflow in the bundled libtasn1 was fixed (bsc#1040621) - An address read of 4 bytes past the end of buffer in OpenPGP certificate parsing was fixed (bsc#1038337) Moderate SUSE bug 1034173 SUSE bug 1038337 SUSE bug 1040621 CVE-2017-6891 CVE-2017-7869 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gnutls fixes the following issues: Security issues fixed: - CVE-2018-10846: Improve mitigations against Lucky 13 class of attacks (PRIME + PROBE) (bsc#1105460). - CVE-2017-10790: Fixed a denial of service in the _asn1_check_identifier() function (bsc#1047002). Moderate SUSE bug 1047002 SUSE bug 1105460 CVE-2017-10790 CVE-2018-10846 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA GPG2 has been updated to fix a possible denial of service. This security issue has been fixed: * Denial of service through infinite loop with garbled compressed data packets (CVE-2014-4617) Security Issues: * CVE-2014-4617 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617> SUSE bug 884130 CVE-2014-4617 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gpg2 fixes the following issues: - Fix cve-2015-1606 (bsc#918089) * Invalid memory read using a garbled keyring * 0001-Gpg-prevent-an-invalid-memory-read-using-a-garbled-k.patch - Fix cve-2015-1607 (bsc#918090) * Memcpy with overlapping ranges * 0001-Use-inline-functions-to-convert-buffer-data-to-scala.patch Moderate SUSE bug 918089 SUSE bug 918090 CVE-2015-1606 CVE-2015-1607 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gpg2 fixes the following issues: - CVE-2018-12020: GnuPG mishandled the original filename during decryption and verification actions, which allowed remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option (bsc#1096745) Important SUSE bug 1096745 CVE-2018-12020 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gpg2 fixes the following issues: Security issue fixed: - CVE-2019-13050: Fixed denial-of-service attacks via big keys. (bsc#1141093) Non-security issue fixed: - Allow coredumps in X11 desktop sessions (bsc#1124847). Moderate SUSE bug 1124847 SUSE bug 1141093 CVE-2019-13050 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This gpgme update fixes the following security issue: * bnc#890123: Fix possible overflow in gpgsm and uiserver engines (CVE-2014-3564) Security Issues: * CVE-2014-3564 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3564> SUSE bug 890123 CVE-2014-3564 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for grub2 provides the following fixes: A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370) Bugs fixed: - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539) - Add grub.xen config searching path on boot partition. (bsc#884828) - Add linux16 and initrd16 to grub.xen. (bsc#884830) Important SUSE bug 884828 SUSE bug 884830 SUSE bug 946148 SUSE bug 952539 SUSE bug 954592 SUSE bug 956631 CVE-2015-8370 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gstreamer-0_10-plugins-base fixes the following issue: - CVE-2016-9811: Out of bounds memory read in windows_icon_typefind (bsc#1013669). Moderate SUSE bug 1013669 CVE-2016-9811 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gstreamer-0_10-plugins-base fixes the following issues: Security issues fixed: - CVE-2017-5837: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024076). - CVE-2017-5844: Fixed a floating point exception in gst_riff_create_audio_caps (bsc#1024079). - CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser (bsc#1133375). Important SUSE bug 1024076 SUSE bug 1024079 SUSE bug 1133375 CVE-2017-5837 CVE-2017-5844 CVE-2019-9928 SUSE Linux Enterprise Server 11 SP3-TERADATA gstreamer-0_10-plugins-good was updated to fix six security issues. These security issues were fixed: - CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012102) - CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012103) - CVE-2016-9636: Prevent maliciously crafted flic files from causing invalid memory writes (bsc#1012104). - CVE-2016-9807: Prevent the reading of invalid memory in flx_decode_chunks, leading to DoS (bsc#1013655) - CVE-2016-9808: Prevent maliciously crafted flic files from causing invalid memory accesses (bsc#1013653) - CVE-2016-9810: Invalid files can be used to extraneous unreferences, leading to invalid memory access and DoS (bsc#1013663) Important SUSE bug 1012102 SUSE bug 1012103 SUSE bug 1012104 SUSE bug 1013653 SUSE bug 1013655 SUSE bug 1013663 CVE-2016-9634 CVE-2016-9635 CVE-2016-9636 CVE-2016-9807 CVE-2016-9808 CVE-2016-9810 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2 was updated to fix two security issues. These security issues were fixed: - CVE-2015-4491: Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, allowed remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that were mishandled during scaling (bsc#942801). - CVE-2015-7674: Fix overflow when scaling GIF files (bsc#948791). This non-security issue was fixed: - Add the script which generates gdk-pixbuf64.loaders to the spec file (bsc#922741). Moderate SUSE bug 922741 SUSE bug 942801 SUSE bug 948791 CVE-2015-4491 CVE-2015-7674 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gdk2 fixes the following security issues: - CVE-2015-7552: various overflows, including heap overflow in flipping bmp files (bsc#958963) The following non-security issues were fixed: - bsc#960155: fix a possible divide by zero Moderate SUSE bug 958963 SUSE bug 960155 CVE-2015-7552 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gtk2 fixes the following security issues: - CVE-2016-6352: Some crashes were fixed, including a out of bounds write in the OneLine32() function that could be used by attackers to crash GTK/GDK programs. - CVE-2013-7447: Avoid overflow when allocating a cairo pixbuf (bsc#966682). Moderate SUSE bug 966682 SUSE bug 988745 SUSE bug 991450 CVE-2013-7447 CVE-2016-6352 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gtk2 fixes the following issues: This security issue was fixed: - Add checks for multiplications at several locations to avoid mishandling memory. This allowed attackers to cause DoS or potentially RCE (bsc#1053417). Moderate SUSE bug 1053417 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for gtk2 provides the following fixes: These security issues were fixed: - CVE-2017-6312: Prevent integer overflow that allowed context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file (bsc#1027026). - CVE-2017-6314: The make_available_at_least function allowed context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file (bsc#1027025). - CVE-2017-6313: Prevent integer underflow in the load_resources function that allowed context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file (bsc#1027024). - CVE-2017-2862: Prevent heap overflow in the gdk_pixbuf__jpeg_image_load_increment function. A specially crafted jpeg file could have caused a heap overflow resulting in remote code execution (bsc#1048289) - CVE-2017-2870: Prevent integer overflow in the tiff_image_parse functionality. A specially crafted tiff file could have caused a heap-overflow resulting in remote code execution (bsc#1048544). This non-security issue was fixed: - Prevent an infinite loop when a window is destroyed while traversed (bsc#1039465). Moderate SUSE bug 1027024 SUSE bug 1027025 SUSE bug 1027026 SUSE bug 1039465 SUSE bug 1048289 SUSE bug 1048544 CVE-2017-2862 CVE-2017-2870 CVE-2017-6312 CVE-2017-6313 CVE-2017-6314 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA A predictable socketname in the guestfish commandline tool could be used by a local attacker to gain access to guestfish sessions of other users on the same system. (CVE-2013-4419) Security Issue reference: * CVE-2013-4419 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4419> SUSE bug 845720 CVE-2013-4419 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for guile fixes the following issues: - CVE-2016-8605: Fixed thread-unsafe umask modification (bsc#1004221). Low SUSE bug 1004221 CVE-2016-8605 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA hplip was updated to fix three security issues: * CVE-2013-0200: Some local file overwrite problems via predictable /tmp filenames were fixed. * CVE-2013-4325: hplip used an insecure polkit DBUS API (polkit-process subject race condition) which could lead to local privilege escalation. * CVE-2013-6402: hplip uses arbitrary file creation/overwrite (via hardcoded file name /tmp/hp-pkservice.log). Security Issue references: * CVE-2013-4325 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4325> * CVE-2013-0200 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0200> * CVE-2013-6402 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6402> SUSE bug 808355 SUSE bug 835827 SUSE bug 836937 SUSE bug 852368 CVE-2013-0200 CVE-2013-4325 CVE-2013-6402 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Various tmp races in ibdiagnet of ibutils have been fixed that could have been used by local attackers on machines where infiband was debugged to gain privileges. Security Issue reference: * CVE-2013-1894 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1894> SUSE bug 811660 CVE-2013-1894 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue in icu: * CVE-2014-9654: insufficient size limit checks in regular expression compiler (bsc#917129) Security Issues: * CVE-2014-9654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9654> SUSE bug 917129 CVE-2014-9654 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for icu fixes the following issue: The previous patch for CVE-2014-9654 was incorrect and lead to non-working regular expressions. This update fixes this problem (bsc#952260) Moderate SUSE bug 952260 CVE-2014-9654 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for icu fixes the following security issues: - Passing a locale string longer than 255 characters to uloc_getDisplayName() could have caused a buffer overflow resulting in denial of service or possible code execution (bsc#1012224, CVE-2014-9911). Moderate SUSE bug 1012224 CVE-2014-9911 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for icu fixes the following issues: - CVE-2014-9911: The fix was updated to not crash (NULL ptr deref) when resPath is NULL (bsc#1023033). Moderate SUSE bug 1023033 CVE-2014-9911 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for icu fixes the following issues: - CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in common/uloc.cpp did not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument. (bsc#990636) - CVE-2017-7868: ICU had an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function. (bsc#1034674) - CVE-2017-7867: ICU had an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function. (bsc#1034678) - CVE-2017-14952: Double free in i18n/zonemeta.cpp allowed remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue. (bsc#1067203) - CVE-2017-17484:The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp mishandled ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC. (bsc#1072193) - CVE-2017-15422: An integer overflow in persian calendar calculation was fixed, which could show wrong years. (bsc#1077999) Important SUSE bug 1034674 SUSE bug 1034678 SUSE bug 1067203 SUSE bug 1072193 SUSE bug 1077999 SUSE bug 990636 CVE-2016-6293 CVE-2017-14952 CVE-2017-15422 CVE-2017-17484 CVE-2017-7867 CVE-2017-7868 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for intel-SINIT fixes the following issues: Security issue fixed: - CVE-2011-5174: Fixed security issue in old SINIT files which allowed local users to bypass the TXT protection mechanism (bsc#1069754). Important SUSE bug 1069754 CVE-2011-5174 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA ipsec-tools was updated to fix one security issue and a bug. This security issue was fixed: - CVE-2015-4047: racoon/gssapi.c in ipsec-tools allowed remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests (bsc#931989). Due to a packaging error, the racoonf.conf config file was symlinked to /usr/share/doc/packages/ipsec-tools/examples/racoon/samples/racoon.conf on some processor platforms, edits might have happened only in this example file. Before upgrading, please check if /etc/racoon/racoon.conf is a symlink to this example file and backup the content. (bsc#939810) Moderate SUSE bug 931989 SUSE bug 939810 CVE-2015-4047 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ipsec-tools fixes one issue. This security issue was fixed: - CVE-2016-10396: The racoon daemon contained a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments that allowed a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order (bsc#1047443). Moderate SUSE bug 1047443 CVE-2016-10396 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to jakarta-commons-collections 3.2.2 fixes the following security issues: * bsc#954102 code-execution by unserialization Moderate SUSE bug 954102 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a security issue with jakarta-commons-fileupload: * bnc#862781: denial of service due to too-small buffer size used (CVE-2014-0050) Security Issue reference: * CVE-2014-0050 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0050> SUSE bug 862781 CVE-2014-0050 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jakarta-commons-fileupload fixes the following issue: Security issue fixed: - CVE-2016-1000031: Fixed remote execution (bsc#1128963, bsc#1128829). Important SUSE bug 1128829 SUSE bug 1128963 CVE-2016-1000031 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jakarta-taglibs-standard fixes the following issues: - CVE-2015-0254: Apache Standard Taglibs allowed remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) x:parse or (2) x:transform JSTL XML tag. (bsc#920813) Important SUSE bug 920813 CVE-2015-0254 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jasper fixes the following security issues: * CVE-2014-8137: Double free in jas_iccattrval_destroy(). Double call to free() allowed attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. (bsc#909474) * CVE-2014-8138: Heap overflow in jas_decode(). This could be used to do an arbitrary write and could result in arbitrary code execution. (bsc#909475) * CVE-2014-8157: Off-by-one error in the jpc_dec_process_sot(). Could allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. (bsc#911837) * CVE-2014-8158: Multiple stack-based buffer overflows in jpc_qmfb.c. Could allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. (bsc#911837) Security Issues: * CVE-2014-8138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8138> * CVE-2014-8137 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8137> * CVE-2014-8157 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8157> * CVE-2014-8158 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158> SUSE bug 909474 SUSE bug 909475 SUSE bug 911837 CVE-2014-8137 CVE-2014-8138 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jasper fixes the following issues: Security fixes: - CVE-2016-8887: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (bsc#1006836) - CVE-2016-8886: memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599) - CVE-2016-8884,CVE-2016-8885: two null pointer dereferences in bmp_getdata (incomplete fix for CVE-2016-8690) (bsc#1007009) - CVE-2016-8883: assert in jpc_dec_tiledecode() (bsc#1006598) - CVE-2016-8882: segfault / null pointer access in jpc_pi_destroy (bsc#1006597) - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593) - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591) - CVE-2016-8693: Double free vulnerability in mem_close (bsc#1005242) - CVE-2016-8691, CVE-2016-8692: Divide by zero in jpc_dec_process_siz (bsc#1005090) - CVE-2016-8690: Null pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084) - CVE-2016-2089: invalid read in the JasPer's jas_matrix_clip() function (bsc#963983) - CVE-2016-1867: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (bsc#961886) - CVE-2016-1577, CVE-2016-2116: double free vulnerability in the jas_iccattrval_destroy function (bsc#968373) - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553) - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919) - CVE-2008-3522: multiple integer overflows (bsc#392410) - bsc#1006839: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887) Moderate SUSE bug 1005084 SUSE bug 1005090 SUSE bug 1005242 SUSE bug 1006591 SUSE bug 1006593 SUSE bug 1006597 SUSE bug 1006598 SUSE bug 1006599 SUSE bug 1006836 SUSE bug 1006839 SUSE bug 1007009 SUSE bug 392410 SUSE bug 941919 SUSE bug 942553 SUSE bug 961886 SUSE bug 963983 SUSE bug 968373 CVE-2008-3522 CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089 CVE-2016-2116 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8880 CVE-2016-8881 CVE-2016-8882 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-8886 CVE-2016-8887 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jasper fixes the following issues: Security issues fixed: - CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec (bsc#1012530) - CVE-2016-9395: Missing sanity checks on the data in a SIZ marker segment (bsc#1010977). - CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int): Assertion 'x > 0' failed. (bsc#1010979) - CVE-2016-9560: stack-based buffer overflow in jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830) - CVE-2016-9583: Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400) - CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy (bsc#1015993) - CVE-2016-9600: Null Pointer Dereference due to missing check for UNKNOWN color space in JP2 encoder (bsc#1018088) - CVE-2016-10251: Use of uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497) - CVE-2017-5498: left-shift undefined behaviour (bsc#1020353) - CVE-2017-6850: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c) (bsc#1021868) Important SUSE bug 1010977 SUSE bug 1010979 SUSE bug 1011830 SUSE bug 1012530 SUSE bug 1015400 SUSE bug 1015993 SUSE bug 1018088 SUSE bug 1020353 SUSE bug 1021868 SUSE bug 1029497 CVE-2016-10251 CVE-2016-8654 CVE-2016-9395 CVE-2016-9398 CVE-2016-9560 CVE-2016-9583 CVE-2016-9591 CVE-2016-9600 CVE-2017-5498 CVE-2017-6850 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jasper fixes the following issues: Security issues fixed: - CVE-2016-9262: Multiple integer overflows in the jas_realloc function in base/jas_malloc.c and mem_resize function in base/jas_stream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994) - CVE-2016-9388: The ras_getcmap function in ras_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975) - CVE-2016-9389: The jpc_irct and jpc_iict functions in jpc_mct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968) - CVE-2016-9390: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774) - CVE-2016-9391: The jpc_bitstream_getbits function in jpc_bs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782) - CVE-2017-1000050: The jp2_encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958) CVEs already fixed with previous update: - CVE-2016-9392: The calcstepsizes function in jpc_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757) - CVE-2016-9393: The jpc_pi_nextrpcl function in jpc_t2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766) - CVE-2016-9394: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756) Moderate SUSE bug 1009994 SUSE bug 1010756 SUSE bug 1010757 SUSE bug 1010766 SUSE bug 1010774 SUSE bug 1010782 SUSE bug 1010968 SUSE bug 1010975 SUSE bug 1047958 CVE-2016-9262 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391 CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2017-1000050 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA java-1_6_0-ibm has been updated to version 1.6.0_sr16.2 to fix 18 security issues. These security issues has been fixed: * Unspecified vulnerability in Oracle Java SE 6u81 (CVE-2014-3065). * The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (CVE-2014-3566). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (CVE-2014-6513). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (CVE-2014-6503). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (CVE-2014-6532). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (CVE-2014-4288). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (CVE-2014-6493). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6492). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6458). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6466). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (CVE-2014-6506). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment (CVE-2014-6515). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (CVE-2014-6511). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (CVE-2014-6531). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (CVE-2014-6512). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (CVE-2014-6457). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (CVE-2014-6502). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (CVE-2014-6558). More information can be found at http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2014 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2014> Security Issues: * CVE-2014-3065 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3065> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-6506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6506> * CVE-2014-6511 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511> * CVE-2014-6531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6531> * CVE-2014-6512 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6512> * CVE-2014-6457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6457> * CVE-2014-6502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6502> * CVE-2014-6558 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6558> * CVE-2014-6513 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6513> * CVE-2014-6503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6503> * CVE-2014-4288 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4288> * CVE-2014-6493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6493> * CVE-2014-6532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6532> * CVE-2014-6492 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6492> * CVE-2014-6458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6458> * CVE-2014-6466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6466> * CVE-2014-6515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6515> * CVE-2014-6456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6456> * CVE-2014-6476 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6476> * CVE-2014-6527 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6527> SUSE bug 904889 CVE-2014-3065 CVE-2014-3566 CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 CVE-2014-6458 CVE-2014-6466 CVE-2014-6476 CVE-2014-6492 CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 CVE-2014-6506 CVE-2014-6511 CVE-2014-6512 CVE-2014-6513 CVE-2014-6515 CVE-2014-6527 CVE-2014-6531 CVE-2014-6532 CVE-2014-6558 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA IBM Java was updated to version 6 SR16 FP7 (6.0-16.7) to fix several security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-1931: IBM Java Security Components store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. (bnc#935540) * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. The following non-security bugs were fixed: * bsc#936844: misconfigured update-alternative entries * bsc#941939: provide %{name} instead of %{sdklnk} only in _jvmprivdir Important SUSE bug 935540 SUSE bug 936844 SUSE bug 938895 SUSE bug 941939 CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm fixes the following issues by updating to 6.0-16.20 (bsc#963937) - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package - bsc#960286: resolve package conflicts in the fonts subpackage Important SUSE bug 960286 SUSE bug 960402 SUSE bug 963937 CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 SUSE Linux Enterprise Server 11 SP3-LTSS This update for java-1_6_0-ibm fixes the following issues by updating to 6.0-16.20 (bsc#963937) - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package - bsc#960286: resolve package conflicts in the fonts subpackage Important SUSE bug 960286 SUSE bug 960402 SUSE bug 963937 CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This IBM Java 1.6.0 SR16 FP25 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Important SUSE bug 977646 SUSE bug 977648 SUSE bug 977650 SUSE bug 979252 CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA IBM Java 6 was updated to version 6.0-16.30. Following security issue was fixed: CVE-2016-3485 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Important SUSE bug 992537 CVE-2016-3485 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm fixes the following issues: - Version update to 6.0-16.35 (bsc#1009280) fixing the following CVE's: CVE-2016-5568, CVE-2016-5556, CVE-2016-5573, CVE-2016-5597, CVE-2016-5554, CVE-2016-5542 Important SUSE bug 1009280 CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5597 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm to 8.0-4.1 fixes the following issues: Security issue fixed: - CVE-2016-2183: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. (bsc#1027038) Moderate SUSE bug 1027038 CVE-2016-2183 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm fixes the following issues: - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client - Version update to 6.0-16.40 bsc#1027038 CVE-2016-2183 Important SUSE bug 1027038 SUSE bug 1038505 CVE-2016-2183 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-1289 CVE-2017-3509 CVE-2017-3514 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 (bsc#1070162) * CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345 Important SUSE bug 1070162 CVE-2016-9841 CVE-2017-10281 CVE-2017-10285 CVE-2017-10293 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_6_0-ibm fixes the following issues: - Version update to 6.0-16.15 bsc#955131: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 CVE-2015-2808 CVE-2015-2625 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Important SUSE bug 955131 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-2625 CVE-2015-2808 CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA java-1_7_0-ibm has been updated to version 1.7.0_sr7.2 to fix 21 security issues. These security issues have been fixed: * Unspecified vulnerability (CVE-2014-3065). * The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (CVE-2014-3566). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT (CVE-2014-6513). * Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors (CVE-2014-6456). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532 (CVE-2014-6503). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503 (CVE-2014-6532). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532 (CVE-2014-4288). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532 (CVE-2014-6493). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6492). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6458). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (CVE-2014-6466). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (CVE-2014-6506). * Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527 (CVE-2014-6476). * Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment (CVE-2014-6515). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D (CVE-2014-6511). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries (CVE-2014-6531). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries (CVE-2014-6512). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE (CVE-2014-6457). * Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476 (CVE-2014-6527). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries (CVE-2014-6502). * Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security (CVE-2014-6558). More information can be found at http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2014 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2014> Security Issues: * CVE-2014-3065 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3065> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-6506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6506> * CVE-2014-6511 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6511> * CVE-2014-6531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6531> * CVE-2014-6512 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6512> * CVE-2014-6457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6457> * CVE-2014-6502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6502> * CVE-2014-6558 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6558> * CVE-2014-6513 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6513> * CVE-2014-6503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6503> * CVE-2014-4288 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4288> * CVE-2014-6493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6493> * CVE-2014-6532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6532> * CVE-2014-6492 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6492> * CVE-2014-6458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6458> * CVE-2014-6466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6466> * CVE-2014-6515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6515> * CVE-2014-6456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6456> * CVE-2014-6476 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6476> * CVE-2014-6527 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6527> SUSE bug 904889 CVE-2014-3065 CVE-2014-3566 CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 CVE-2014-6458 CVE-2014-6466 CVE-2014-6476 CVE-2014-6492 CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 CVE-2014-6506 CVE-2014-6511 CVE-2014-6512 CVE-2014-6513 CVE-2014-6515 CVE-2014-6527 CVE-2014-6531 CVE-2014-6532 CVE-2014-6558 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA java-1_7_0-ibm was updated to fix 21 security issues. These security issues were fixed: - CVE-2015-4729: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allowed remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment (bsc#938895). - CVE-2015-4748: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security (bsc#938895). - CVE-2015-2664: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment (bsc#938895). - CVE-2015-0192: Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allowed remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine (bsc#938895). - CVE-2015-2613: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality via vectors related to JCE (bsc#938895). - CVE-2015-4731: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX (bsc#938895). - CVE-2015-2637: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#938895). - CVE-2015-4733: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI (bsc#938895). - CVE-2015-4732: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590 (bsc#938895). - CVE-2015-2621: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allowed remote attackers to affect confidentiality via vectors related to JMX (bsc#938895). - CVE-2015-2619: Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#938895). - CVE-2015-2590: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732 (bsc#938895). - CVE-2015-2638: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#938895). - CVE-2015-2625: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality via vectors related to JSSE (bsc#938895). - CVE-2015-2632: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allowed remote attackers to affect confidentiality via unknown vectors related to 2D (bsc#938895). - CVE-2015-1931: Unspecified vulnerability (bsc#938895). - CVE-2015-4760: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D (bsc#938895). - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue (bsc#935540). - CVE-2015-2601: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect confidentiality via vectors related to JCE (bsc#938895). - CVE-2015-2808: The RC4 algorithm, as used in the TLS protocol and SSL protocol, did not properly combine state data with key data during the initialization phase, which made it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue (bsc#938895). - CVE-2015-4749: Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allowed remote attackers to affect availability via vectors related to JNDI (bsc#938895). Important SUSE bug 935540 SUSE bug 938895 CVE-2015-0192 CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The java-1_7_0-ibm package was updated to version 7.0-9.20 to fix several security and non security issues: - bnc#955131: Version update to 7.0-9.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 - Add backcompat symlinks for sdkdir - bnc#941939: Fix to provide %{name} instead of %{sdklnk} only in _jvmprivdir Important SUSE bug 941939 SUSE bug 955131 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 CVE-2015-5006 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937): - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package Important SUSE bug 960402 SUSE bug 963937 CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 SUSE Linux Enterprise Server 11 SP3-LTSS This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937): - CVE-2015-5041: Could could have invoked non-public interface methods under certain circumstances - CVE-2015-7575: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate a TLS server and obtain credentials - CVE-2015-7981: libpng could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read in the png_convert_to_rfc1123 function. An attacker could exploit this vulnerability to obtain sensitive information - CVE-2015-8126: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8472: buffer overflow in libpng caused by improper bounds checking by the png_set_PLTE() and png_get_PLTE() functions - CVE-2015-8540: libpng is vulnerable to a buffer overflow, caused by a read underflow in png_check_keyword in pngwutil.c. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. - CVE-2016-0402: An unspecified vulnerability related to the Networking component has no confidentiality impact, partial integrity impact, and no availability impact - CVE-2016-0448: An unspecified vulnerability related to the JMX component could allow a remote attacker to obtain sensitive information - CVE-2016-0466: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service - CVE-2016-0483: An unspecified vulnerability related to the AWT component has complete confidentiality impact, complete integrity impact, and complete availability impact - CVE-2016-0494: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete availability impact The following bugs were fixed: - bsc#960402: resolve package conflicts in devel package Important SUSE bug 960402 SUSE bug 963937 CVE-2015-5041 CVE-2015-7575 CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 CVE-2015-8540 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This IBM Java 1.7.0 SR9 FP40 release fixes the following issues: Security issues fixed: - CVE-2016-0264: buffer overflow vulnerability in the IBM JVM (bsc#977648) - CVE-2016-0363: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix (bsc#977650) - CVE-2016-0376: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix (bsc#977646) - The following CVEs got also fixed during this update. (bsc#979252) CVE-2016-3443, CVE-2016-0687, CVE-2016-0686, CVE-2016-3427, CVE-2016-3449, CVE-2016-3422, CVE-2016-3426 Important SUSE bug 977646 SUSE bug 977648 SUSE bug 977650 SUSE bug 979252 CVE-2016-0264 CVE-2016-0363 CVE-2016-0376 CVE-2016-0686 CVE-2016-0687 CVE-2016-3422 CVE-2016-3426 CVE-2016-3427 CVE-2016-3443 CVE-2016-3449 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA IBM Java 7 was updated to 7.1-9.50, fixing bugs and security issues (bsc#992537). Security issues fixed: CVE-2016-3485 CVE-2016-3511 CVE-2016-3598 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Important SUSE bug 992537 CVE-2016-3485 CVE-2016-3511 CVE-2016-3598 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: - Version update to 7.0-9.60 (bsc#1009280, bsc#992537) fixing the following CVE's: CVE-2016-5568, CVE-2016-5556, CVE-2016-5573, CVE-2016-5597, CVE-2016-5554, CVE-2016-5542 Important SUSE bug 1009280 SUSE bug 992537 CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5597 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_1-ibm fixes the following issues: Security issue fixed: - CVE-2016-2183: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. (bsc#1027038) Moderate SUSE bug 1027038 CVE-2016-2183 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: Version update to 7.0-10.5 bsc#1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number - CVE-2016-9843: zlib: Big-endian out-of-bounds pointer - CVE-2017-1289: IBM JDK: XML External Entity Injection (XXE) error when processing XML data - CVE-2017-3509: OpenJDK: improper re-use of NTLM authenticated connections - CVE-2017-3511: OpenJDK: untrusted extension directories search path in Launcher - CVE-2017-3539: OpenJDK: MD5 allowed for jar verification - CVE-2017-3533: OpenJDK: newline injection in the FTP client - CVE-2017-3544: OpenJDK: newline injection in the SMTP client Important SUSE bug 1038505 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-1289 CVE-2017-3509 CVE-2017-3511 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: This update for java-1_7_1-ibm fixes the following issues: - Version update to 7.1-4.10 [bsc#1053431] * CVE-2017-10111 CVE-2017-10110 CVE-2017-10107 CVE-2017-10101 CVE-2017-10096 CVE-2017-10090 CVE-2017-10089 CVE-2017-10087 CVE-2017-10102 CVE-2017-10116 CVE-2017-10074 CVE-2017-10115 CVE-2017-10067 CVE-2017-10125 CVE-2017-10243 CVE-2017-10109 CVE-2017-10108 CVE-2017-10053 CVE-2017-10105 CVE-2017-10081: Multiple unspecified vulnerabilities in multiple Java components could lead to code execution or sandbox escape More information can be found here: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#Oracle_July_18_2017_CPU Important SUSE bug 1053431 CVE-2017-10053 CVE-2017-10067 CVE-2017-10074 CVE-2017-10081 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10105 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10111 CVE-2017-10115 CVE-2017-10116 CVE-2017-10125 CVE-2017-10243 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: - Security update to version 7.0.10.15 (bsc#1070162): * CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2016-10165 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345 Important SUSE bug 1070162 CVE-2016-10165 CVE-2016-9841 CVE-2017-10281 CVE-2017-10285 CVE-2017-10293 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm provides the following fixes: The version was updated to 7.0.10.20 [bsc#1082810]: * Following security issues were fixed: - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677 CVE-2018-2663 CVE-2018-2588 CVE-2018-2579 * Defect fixes: - IJ04281 Class Libraries: Startup time increase after applying apar IV96905 - IJ03822 Class Libraries: Update timezone information to tzdata2017c - IJ03605 Java Virtual Machine: Legacy security for com.ibm.jvm.dump, trace, log was not enabled by default - IJ03607 JIT Compiler: Result String contains a redundant dot when converted from BigDecimal with 0 on all platforms - IX90185 ORB: Upgrade ibmcfw.jar to version O1800.01 - IJ04282 Security: Change in location and default of jurisdiction policy files - IJ03853 Security: IBMCAC provider does not support SHA224 - IJ02679 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ02706 Security: IBMPKCS11Impl – Bad sessions are being allocated internally - IJ03552 Security: IBMPKCS11Impl - Config file problem with the slot specification attribute - IJ01901 Security: IBMPKCS11Impl – SecureRandom.setSeed() exception - IJ03801 Security: Issue with same DN certs, iKeyman GUI error with stash, JKS Chain issue and JVM argument parse issue with iKeyman - IJ02284 JIT Compiler: Division by zero in JIT compiler - Make it possible to run Java jnlp files from Firefox. (bsc#1057460) Important SUSE bug 1057460 SUSE bug 1076390 SUSE bug 1082810 SUSE bug 929900 SUSE bug 966304 CVE-2018-2579 CVE-2018-2582 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2657 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: IBM Java was updated to 7.1.4.25 (bsc#1093311, bsc#1085449) Security fixes: - CVE-2018-2814 CVE-2018-2794 CVE-2018-2783 CVE-2018-2799 CVE-2018-2798 CVE-2018-2797 CVE-2018-2796 CVE-2018-2795 CVE-2018-2800 CVE-2018-2790 CVE-2018-1417 Important SUSE bug 1085449 SUSE bug 1093311 CVE-2018-1417 CVE-2018-2783 CVE-2018-2790 CVE-2018-2794 CVE-2018-2795 CVE-2018-2796 CVE-2018-2797 CVE-2018-2798 CVE-2018-2799 CVE-2018-2800 CVE-2018-2814 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: Security issues fixed: - CVE-2018-1517: Fixed a flaw in the java.math component in IBM SDK, which may allow an attacker to inflict a denial-of-service attack with specially crafted String data. - CVE-2018-1656: Protect against path traversal attacks when extracting compressed dump files. - CVE-2018-2940: Fixed an easily exploitable vulnerability in the libraries subcomponent, which allowed unauthenticated attackers with network access via multiple protocols to compromise the Java SE, leading to unauthorized read access. - CVE-2018-2952: Fixed an easily exploitable vulnerability in the concurrency subcomponent, which allowed unauthenticated attackers with network access via multiple protocols to compromise the Java SE, leading to denial of service. - CVE-2018-2973: Fixed a difficult to exploit vulnerability in the JSSE subcomponent, which allowed unauthenticated attackers with network access via SSL/TLS to compromise the Java SE, leading to unauthorized creation, deletion or modification access to critical data. - CVE-2018-12539: Fixed a vulnerability in which users other than the process owner may be able to use Java Attach API to connect to the IBM JVM on the same machine and use Attach API operations, including the ability to execute untrusted arbitrary code. Other changes made: - Various JIT/JVM crash fixes - Version update to 7.1.4.30 (bsc#1104668) You can find detailed information about this update [here](https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_August_2018). Important SUSE bug 1104668 CVE-2018-12539 CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA java-1_7_0-ibm is updated to Java 7.0 Service Refresh 10 Fix Pack 35 (bsc#1116574): * Class Libraries - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-3149 - IJ10894 CVE-2018-3180 - IJ10933 CVE-2018-3214 - IJ09315 FLOATING POINT EXCEPTION FROM JAVA.TEXT.DECIMALFORMAT. FORMAT - IJ09088 INTRODUCING A NEW PROPERTY FOR TURKEY TIMEZONE FOR PRODUCTS NOT IDENTIFYING TRT - IJ10800 REMOVE EXPIRING ROOT CERTIFICATES IN IBM JDK’S CACERTS * Java Virtual Machine - IJ10931 CVE-2018-3169 * JIT Compiler - IJ08205 CRASH WHILE COMPILING * Security - IJ10492 'EC KEYSIZE < 384' IS NOT HONORED USING THE 'JDK.TLS.DISABLEDALGORIT HMS' SECURITY PROPERTY - IJ10491 AES/GCM CIPHER – AAD NOT RESET TO UN-INIT STATE AFTER DOFINAL( ) AND INIT( ) - IJ08442 HTTP PUBLIC KEY PINNING FINGERPRINT,PROBLEM WITH CONVERTING TO JKS KEYSTORE - IJ09107 IBMPKCS11IMPL CRYPTO PROVIDER – INTERMITTENT ERROR WITH SECP521R1 SIGNATURE ON Z/OS - IJ10136 IBMPKCS11IMPL – INTERMITTENT ERROR WITH SECP521R1 SIG ON Z/OS AND Z/LINUX - IJ08530 IBMPKCS11IMPL PROVIDER USES THE WRONG RSA CIPHER MECHANISM FOR THE RSA/ECB/PKCS1PADDING CIPHER - IJ08723 JAAS THROWS A ‘ARRAY INDEX OUT OF RANGE’ EXCEPTION - IJ08704 THE SECURITY PROPERTY ‘JDK.CERTPATH.DISABLEDAL GORITHMS’ IS MISTAKENLY BEING USED TO FILTER JAR SIGNING ALGORITHMS - PH01244 OUTPUT BUFFER TOO SHORT FOR GCM MODE ENCRYPTION USING IBMJCEHYBRID Important SUSE bug 1116574 CVE-2018-13785 CVE-2018-3136 CVE-2018-3139 CVE-2018-3149 CVE-2018-3169 CVE-2018-3180 CVE-2018-3214 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm to version 7.0.10.40 fixes the following issues: Security issues fixed: - CVE-2019-2422: Fixed a memory disclosure in FileChannelImpl (bsc#1122293). - CVE-2018-11212: Fixed an issue in alloc_sarray function in jmemmgr.c (bsc#1122299). More information: https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_February_2019 Important SUSE bug 1122293 SUSE bug 1122299 CVE-2018-11212 CVE-2019-2422 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for java-1_7_0-ibm fixes the following issues: Update to Java 7.0 Service Refresh 10 Fix Pack 45. Security issues fixed: - CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes (bsc#1134718). - CVE-2019-2698: Fixed out of bounds access flaw in the 2D component (bsc#1132729). - CVE-2019-2697: Fixed flaw inside the 2D component (bsc#1132734). - CVE-2019-2602: Fixed flaw inside BigDecimal implementation (Component: Libraries) (bsc#1132728). - CVE-2019-2684: Fixed flaw was found in the RMI registry implementation (bsc#1132732). Important SUSE bug 1132728 SUSE bug 1132729 SUSE bug 1132732 SUSE bug 1132734 SUSE bug 1134718 CVE-2019-10245 CVE-2019-2602 CVE-2019-2684 CVE-2019-2697 CVE-2019-2698 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jpeg fixes the following issues: * CVE-2017-15232: NULL pointer dereferences in jdpostct.c and jquant1.c could lead to denial of service (crash) when processing images [bsc#1062937] * CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c, which allowed remote attackers to cause a denial-of-service via crafted JPG files due to a large loop [bsc#1096209] * CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused by a divide by zero when processing a crafted BMP image [bsc#1098155] Moderate SUSE bug 1062937 SUSE bug 1096209 SUSE bug 1098155 CVE-2017-15232 CVE-2018-1152 CVE-2018-11813 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for jpeg fixes the following issue: Security issue fixed: - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function which could allow to an attacker to cause denial of service (bsc#1128712). - CVE-2018-11212: Fixed divide by zero in alloc_sarray function in jmemmgr.c (bsc#1122299). - CVE-2018-14498: Fixed denial of service in get_8bit_row in rdbmp.c (bsc#1128712). Low SUSE bug 1122299 SUSE bug 1128712 CVE-2018-11212 CVE-2018-14498 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This kdebase4-workspace update fixes two security issues: * NULL pointer dereference in KDM and KCheckPass. (CVE-2013-4132) * Memory leak that could lead to a denial of service. (CVE-2013-4133) Security Issues references: * CVE-2013-4132 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4132> * CVE-2013-4133 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4133> SUSE bug 829857 CVE-2013-4132 CVE-2013-4133 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA kdebase4-runtime has been updated to fix one security issue: * CVE-2013-7252: Added gpg based encryption support to kwallet (bnc#857200). Security Issues: * CVE-2013-7252 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7252> SUSE bug 857200 CVE-2013-7252 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kdebase4-workspace fixes the following issues: - CVE-2014-8651: Privilege escalation via KDE Clock KCM helper when non-default polkit settings are used (bsc#904625) The following non-security bugs were fixed: - bsc#929718: Make kdm recognize an IPv6 localhost address as localhost Moderate SUSE bug 904625 SUSE bug 929718 CVE-2014-8651 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kdelibs3 fixes the following issues: - CVE-2015-7543: Insecure creation of temporary directories allowed local users to hijack the IPC by pre-creating the temporary directory (bsc#958347). Moderate SUSE bug 958347 CVE-2015-7543 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of the kdelibs4 KSSL interface makes it select a set of default ciphers that is recommended for current usage. This update is needed for Konqueror to restrict its cipher set when using https. SUSE bug 865241 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The following security issue has been fixed: * #868682: CVE-2014-2527 CVE-2014-2528: kdirstat: command injection in kcleanup Security Issues: * CVE-2014-2527 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2527> * CVE-2014-2528 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2528> SUSE bug 868682 CVE-2014-2527 CVE-2014-2528 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues. The following security bugs have been fixed: * CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call (bnc#882804). * CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518). * CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000 (bnc#883724). * CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422). * CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (bnc#887082). * CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction (bnc#889173). * CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. (bnc#892490) * CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. (bnc#892490) * CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) * CVE-2014-4027: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (bnc#882639) * CVE-2014-3153 The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. (bnc#880892) * CVE-2014-6410: Avoid infinite loop when processing indirect ICBs (bnc#896689) The following non-security bugs have been fixed: * ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). * ACPI: Fix bug when ACPI reset register is implemented in system memory (bnc#882900). * ACPI: Limit access to custom_method (bnc#884333). * ALSA: hda - Enabling Realtek ALC 671 codec (bnc#891746). * Add option to automatically enforce module signatures when in Secure Boot mode (bnc#884333). * Add secure_modules() call (bnc#884333). * Add wait_on_atomic_t() and wake_up_atomic_t() (bnc#880344). * Backported new patches of Lock down functions for UEFI secure boot Also updated series.conf and removed old patches. * Btrfs: Return EXDEV for cross file system snapshot. * Btrfs: abort the transaction when we does not find our extent ref. * Btrfs: avoid warning bomb of btrfs_invalidate_inodes. * Btrfs: cancel scrub on transaction abortion. * Btrfs: correctly set profile flags on seqlock retry. * Btrfs: does not check nodes for extent items. * Btrfs: fix a possible deadlock between scrub and transaction committing. * Btrfs: fix corruption after write/fsync failure + fsync + log recovery (bnc#894200). * Btrfs: fix csum tree corruption, duplicate and outdated checksums (bnc#891619). * Btrfs: fix double free in find_lock_delalloc_range. * Btrfs: fix possible memory leak in btrfs_create_tree(). * Btrfs: fix use of uninit "ret" in end_extent_writepage(). * Btrfs: free delayed node outside of root->inode_lock (bnc#866864). * Btrfs: make DEV_INFO ioctl available to anyone. * Btrfs: make FS_INFO ioctl available to anyone. * Btrfs: make device scan less noisy. * Btrfs: make sure there are not any read requests before stopping workers. * Btrfs: more efficient io tree navigation on wait_extent_bit. * Btrfs: output warning instead of error when loading free space cache failed. * Btrfs: retrieve more info from FS_INFO ioctl. * Btrfs: return EPERM when deleting a default subvolume (bnc#869934). * Btrfs: unset DCACHE_DISCONNECTED when mounting default subvol (bnc#866615). * Btrfs: use right type to get real comparison. * Btrfs: wake up @scrub_pause_wait as much as we can. * Btrfs: wake up transaction thread upon remount. * CacheFiles: Add missing retrieval completions (bnc#880344). * CacheFiles: Does not try to dump the index key if the cookie has been cleared (bnc#880344). * CacheFiles: Downgrade the requirements passed to the allocator (bnc#880344). * CacheFiles: Fix the marking of cached pages (bnc#880344). * CacheFiles: Implement invalidation (bnc#880344). * CacheFiles: Make some debugging statements conditional (bnc#880344). * Drivers: hv: util: Fix a bug in the KVP code (bnc#886840). * Drivers: hv: vmbus: Fix a bug in the channel callback dispatch code (bnc#886840). * FS-Cache: Add transition to handle invalidate immediately after lookup (bnc#880344). * FS-Cache: Check that there are no read ops when cookie relinquished (bnc#880344). * FS-Cache: Clear remaining page count on retrieval cancellation (bnc#880344). * FS-Cache: Convert the object event ID #defines into an enum (bnc#880344). * FS-Cache: Does not sleep in page release if __GFP_FS is not set (bnc#880344). * FS-Cache: Does not use spin_is_locked() in assertions (bnc#880344). * FS-Cache: Exclusive op submission can BUG if there is been an I/O error (bnc#880344). * FS-Cache: Fix __wait_on_atomic_t() to call the action func if the counter != 0 (bnc#880344). * FS-Cache: Fix object state machine to have separate work and wait states (bnc#880344). * FS-Cache: Fix operation state management and accounting (bnc#880344). * FS-Cache: Fix signal handling during waits (bnc#880344). * FS-Cache: Initialise the object event mask with the calculated mask (bnc#880344). * FS-Cache: Limit the number of I/O error reports for a cache (bnc#880344). * FS-Cache: Make cookie relinquishment wait for outstanding reads (bnc#880344). * FS-Cache: Mark cancellation of in-progress operation (bnc#880344). * FS-Cache: One of the write operation paths doeses not set the object state (bnc#880344). * FS-Cache: Provide proper invalidation (bnc#880344). * FS-Cache: Simplify cookie retention for fscache_objects, fixing oops (bnc#880344). * FS-Cache: The retrieval remaining-pages counter needs to be atomic_t (bnc#880344). * FS-Cache: Uninline fscache_object_init() (bnc#880344). * FS-Cache: Wrap checks on object state (bnc#880344). * HID: usbhid: add always-poll quirk (bnc#888607). * HID: usbhid: enable always-poll quirk for Elan Touchscreen (bnc#888607). * IB/iser: Add TIMEWAIT_EXIT event handling (bnc#890297). * Ignore "flags" change to event_constraint (bnc#876114). * Ignore data_src/weight changes to perf_sample_data (bnc#876114). * NFS: Allow more operations in an NFSv4.1 request (bnc#890513). * NFS: Clean up helper function nfs4_select_rw_stateid() (bnc#888968). * NFS: Does not copy read delegation stateids in setattr (bnc#888968). * NFS: Does not use a delegation to open a file when returning that delegation (bnc#888968, bnc#892200, bnc#893596, bnc#893496) * NFS: Fixes for NFS RCU-walk support in line with code going upstream * NFS: Use FS-Cache invalidation (bnc#880344). * NFS: allow lockless access to access_cache (bnc#866130). * NFS: avoid mountpoint being displayed as " (deleted)" in /proc/mounts (bnc#888591). * NFS: nfs4_do_open should add negative results to the dcache (bnc#866130). * NFS: nfs_migrate_page() does not wait for FS-Cache to finish with a page (bnc#880344). * NFS: nfs_open_revalidate: only evaluate parent if it will be used (bnc#866130). * NFS: prepare for RCU-walk support but pushing tests later in code (bnc#866130). * NFS: support RCU_WALK in nfs_permission() (bnc#866130). * NFS: teach nfs_lookup_verify_inode to handle LOOKUP_RCU (bnc#866130). * NFS: teach nfs_neg_need_reval to understand LOOKUP_RCU (bnc#866130). * NFSD: Does not hand out delegations for 30 seconds after recalling them (bnc#880370). * NFSv4 set open access operation call flag in nfs4_init_opendata_res (bnc#888968, bnc#892200, bnc#893596, bnc#893496). * NFSv4: Add a helper for encoding opaque data (bnc#888968). * NFSv4: Add a helper for encoding stateids (bnc#888968). * NFSv4: Add helpers for basic copying of stateids (bnc#888968). * NFSv4: Clean up nfs4_select_rw_stateid() (bnc#888968). * NFSv4: Fix the return value of nfs4_select_rw_stateid (bnc#888968). * NFSv4: Rename nfs4_copy_stateid() (bnc#888968). * NFSv4: Resend the READ/WRITE RPC call if a stateid change causes an error (bnc#888968). * NFSv4: Simplify the struct nfs4_stateid (bnc#888968). * NFSv4: The stateid must remain the same for replayed RPC calls (bnc#888968). * NFSv4: nfs4_stateid_is_current should return "true" for an invalid stateid (bnc#888968). * One more fix for kABI breakage. * PCI: Lock down BAR access when module security is enabled (bnc#884333). * PCI: enable MPS "performance" setting to properly handle bridge MPS (bnc#883376). * PM / Hibernate: Add memory_rtree_find_bit function (bnc#860441). * PM / Hibernate: Create a Radix-Tree to store memory bitmap (bnc#860441). * PM / Hibernate: Implement position keeping in radix tree (bnc#860441). * PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free() (bnc#860441). * PM / Hibernate: Remove the old memory-bitmap implementation (bnc#860441). * PM / Hibernate: Touch Soft Lockup Watchdog in rtree_next_node (bnc#860441). * Restrict /dev/mem and /dev/kmem when module loading is restricted (bnc#884333). * Reuse existing "state" field to indicate PERF_X86_EVENT_PEBS_LDLAT (bnc#876114). * USB: handle LPM errors during device suspend correctly (bnc#849123). * Update kabi files to reflect fscache change (bnc#880344) * Update x86_64 config files: re-enable SENSORS_W83627EHF (bnc#891281) * VFS: Make more complete truncate operation available to CacheFiles (bnc#880344). * [FEAT NET1222] ib_uverbs: Allow explicit mmio trigger (FATE#83366, ltc#83367). * acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted (bnc#884333). * af_iucv: correct cleanup if listen backlog is full (bnc#885262, LTC#111728). * asus-wmi: Restrict debugfs interface when module loading is restricted (bnc#884333). * autofs4: allow RCU-walk to walk through autofs4 (bnc#866130). * autofs4: avoid taking fs_lock during rcu-walk (bnc#866130). * autofs4: does not take spinlock when not needed in autofs4_lookup_expiring (bnc#866130). * autofs4: factor should_expire() out of autofs4_expire_indirect (bnc#866130). * autofs4: make "autofs4_can_expire" idempotent (bnc#866130). * autofs4: remove a redundant assignment (bnc#866130). * autofs: fix lockref lookup (bnc#888591). * be2net: add dma_mapping_error() check for dma_map_page() (bnc#881759). * block: add cond_resched() to potentially long running ioctl discard loop (bnc#884725). * block: fix race between request completion and timeout handling (bnc#881051). * cdc-ether: clean packet filter upon probe (bnc#876017). * cpuset: Fix memory allocator deadlock (bnc#876590). * crypto: Allow CRYPTO_FIPS without MODULE_SIGNATURES. Not all archs have them, but some are FIPS certified, with some kernel support. * crypto: fips - only panic on bad/missing crypto mod signatures (bnc#887503). * crypto: testmgr - allow aesni-intel and ghash_clmulni-intel in fips mode (bnc#889451). * dasd: validate request size before building CCW/TCW (bnc#891087, LTC#114068). * dm mpath: fix race condition between multipath_dtr and pg_init_done (bnc#826486). * dm-mpath: fix panic on deleting sg device (bnc#870161). * drm/ast: AST2000 cannot be detected correctly (bnc#895983). * drm/ast: Actually load DP501 firmware when required (bnc#895608 bnc#871134). * drm/ast: Add missing entry to dclk_table[]. * drm/ast: Add reduced non reduced mode parsing for wide screen mode (bnc#892723). * drm/ast: initial DP501 support (v0.2) (bnc#871134). * drm/ast: open key before detect chips (bnc#895983). * drm/i915: Fix up cpt pixel multiplier enable sequence (bnc#879304). * drm/i915: Only apply DPMS to the encoder if enabled (bnc#893064). * drm/i915: clear the FPGA_DBG_RM_NOCLAIM bit at driver init (bnc#869055). * drm/i915: create functions for the "unclaimed register" checks (bnc#869055). * drm/i915: use FPGA_DBG for the "unclaimed register" checks (bnc#869055). * drm/mgag200: Initialize data needed to map fbdev memory (bnc #806990). * e1000e: enable support for new device IDs (bnc#885509). * fs/fscache: remove spin_lock() from the condition in while() (bnc#880344). * hibernate: Disable in a signed modules environment (bnc#884333). * hugetlb: does not use ERR_PTR with VM_FAULT* values * ibmvscsi: Abort init sequence during error recovery (bnc#885382). * ibmvscsi: Add memory barriers for send / receive (bnc#885382). * inet: add a redirect generation id in inetpeer (bnc#860593). * inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). * ipv6: tcp: fix tcp_v6_conn_request() (bnc#887645). * kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). * kernel: 3215 tty hang (bnc#891087, LTC#114562). * kernel: fix data corruption when reading /proc/sysinfo (bnc#891087, LTC#114480). * kernel: fix kernel oops with load of fpc register (bnc#889061, LTC#113596). * kernel: sclp console tty reference counting (bnc#891087, LTC#115466). * kexec: Disable at runtime if the kernel enforces module loading restrictions (bnc#884333). * md/raid6: avoid data corruption during recovery of double-degraded RAID6. * memcg, vmscan: Fix forced scan of anonymous pages (memory reclaim fix). * memcg: do not expose uninitialized mem_cgroup_per_node to world (bnc#883096). * mm, hugetlb: add VM_NORESERVE check in vma_has_reserves() * mm, hugetlb: change variable name reservations to resv * mm, hugetlb: decrement reserve count if VM_NORESERVE alloc page cache * mm, hugetlb: defer freeing pages when gathering surplus pages * mm, hugetlb: do not use a page in page cache for cow optimization * mm, hugetlb: fix and clean-up node iteration code to alloc or free * mm, hugetlb: fix race in region tracking * mm, hugetlb: fix subpool accounting handling * mm, hugetlb: improve page-fault scalability * mm, hugetlb: improve, cleanup resv_map parameters * mm, hugetlb: move up the code which check availability of free huge page * mm, hugetlb: protect reserved pages when soft offlining a hugepage * mm, hugetlb: remove decrement_hugepage_resv_vma() * mm, hugetlb: remove redundant list_empty check in gather_surplus_pages() * mm, hugetlb: remove resv_map_put * mm, hugetlb: remove useless check about mapping type * mm, hugetlb: return a reserved page to a reserved pool if failed * mm, hugetlb: trivial commenting fix * mm, hugetlb: unify region structure handling * mm, hugetlb: unify region structure handling kabi * mm, hugetlb: use long vars instead of int in region_count() (Hugetlb Fault Scalability). * mm, hugetlb: use vma_resv_map() map types * mm, oom: fix badness score underflow (bnc#884582, bnc#884767). * mm, oom: normalize oom scores to oom_score_adj scale only for userspace (bnc#884582, bnc#884767). * mm, thp: do not allow thp faults to avoid cpuset restrictions (bnc#888849). * net/mlx4_core: Load higher level modules according to ports type (bnc#887680). * net/mlx4_core: Load the IB driver when the device supports IBoE (bnc#887680). * net/mlx4_en: Fix a race between napi poll function and RX ring cleanup (bnc#863586). * net/mlx4_en: Fix selftest failing on non 10G link speed (bnc#888058). * net: fix checksumming features handling in output path (bnc#891259). * pagecache_limit: batch large nr_to_scan targets (bnc#895221). * pagecachelimit: reduce lru_lock congestion for heavy parallel reclaim fix (bnc#895680). * perf/core: Add weighted samples (bnc#876114). * perf/x86: Add flags to event constraints (bnc#876114). * perf/x86: Add memory profiling via PEBS Load Latency (bnc#876114). * perf: Add generic memory sampling interface (bnc#876114). * qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (bnc#859840). * qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (bnc#859840). * qla2xxx: Does not check for firmware hung during the reset context for ISP82XX (bnc#859840). * qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (bnc#859840). * qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (bnc#859840). * qla2xxx: Set host can_queue value based on available resources (bnc#859840). * restore smp_mb() in unlock_new_inode() (bnc#890526). * s390/pci: introduce lazy IOTLB flushing for DMA unmap (bnc#889061, LTC#113725). * sched: fix the theoretical signal_wake_up() vs schedule() race (bnc#876055). * sclp_vt220: Enable integrated ASCII console per default (bnc#885262, LTC#112035). * scsi_dh: use missing accessor "scsi_device_from_queue" (bnc#889614). * scsi_transport_fc: Cap dev_loss_tmo by fast_io_fail (bnc#887608). * scsiback: correct grant page unmapping. * scsiback: fix retry handling in __report_luns(). * scsiback: free resources after error. * sunrpc/auth: allow lockless (rcu) lookup of credential cache (bnc#866130). * supported.conf: remove external from drivers/net/veth (bnc#889727) * supported.conf: support net/sched/act_police.ko (bnc#890426) * tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). * tg3: Change nvram command timeout value to 50ms (bnc#855657). * tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#855657). * tg3: Set the MAC clock to the fastest speed during boot code load (bnc#855657). * usb: Does not enable LPM if the exit latency is zero (bnc#832309). * usbcore: Does not log on consecutive debounce failures of the same port (bnc#888105). * usbhid: fix PIXART optical mouse (bnc#888607). * uswsusp: Disable when module loading is restricted (bnc#884333). * vscsi: support larger transfer sizes (bnc#774818). * writeback: Do not sync data dirtied after sync start (bnc#833820). * x86 thermal: Delete power-limit-notification console messages (bnc#882317). * x86 thermal: Disable power limit notification interrupt by default (bnc#882317). * x86 thermal: Re-enable power limit notification interrupt by default (bnc#882317). * x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable() (bnc#887418). * x86/UV: Add call to KGDB/KDB from NMI handler (bnc#888847). * x86/UV: Add kdump to UV NMI handler (bnc#888847). * x86/UV: Add summary of cpu activity to UV NMI handler (bnc#888847). * x86/UV: Move NMI support (bnc#888847). * x86/UV: Update UV support for external NMI signals (bnc#888847). * x86/uv/nmi: Fix Sparse warnings (bnc#888847). * x86: Add check for number of available vectors before CPU down (bnc#887418). * x86: Lock down IO port access when module security is enabled (bnc#884333). * x86: Restrict MSR access when module loading is restricted (bnc#884333). Security Issues: * CVE-2013-1979 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1979> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-4027 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027> * CVE-2014-4171 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4171> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4943 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077> * CVE-2014-5471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5471> * CVE-2014-5472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5472> * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> * CVE-2014-6410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6410> The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues. Following security bugs were fixed: CVE-2013-1979: The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application (bnc#816708). CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call (bnc#882804). CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518). CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000 (bnc#883724). CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422). CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (bnc#887082). CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction (bnc#889173). CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. (bnc#892490) CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. (bnc#892490) CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) CVE-2014-4027: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (bnc#882639) CVE-2014-3153 The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. (bnc#880892) CVE-2014-6410: Avoid infinite loop when processing indirect ICBs (bnc#896689) The following non-security bugs were fixed: - ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). - ACPI: Fix bug when ACPI reset register is implemented in system memory (bnc#882900). - ACPI: Limit access to custom_method (bnc#884333). - ALSA: hda - Enabling Realtek ALC 671 codec (bnc#891746). - Add option to automatically enforce module signatures when in Secure Boot mode (bnc#884333). - Add secure_modules() call (bnc#884333). - Add wait_on_atomic_t() and wake_up_atomic_t() (bnc#880344). - Backported new patches of Lock down functions for UEFI secure boot Also updated series.conf and removed old patches. - Btrfs: Return EXDEV for cross file system snapshot. - Btrfs: abort the transaction when we does not find our extent ref. - Btrfs: avoid warning bomb of btrfs_invalidate_inodes. - Btrfs: cancel scrub on transaction abortion. - Btrfs: correctly set profile flags on seqlock retry. - Btrfs: does not check nodes for extent items. - Btrfs: fix a possible deadlock between scrub and transaction committing. - Btrfs: fix corruption after write/fsync failure + fsync + log recovery (bnc#894200). - Btrfs: fix csum tree corruption, duplicate and outdated checksums (bnc#891619). - Btrfs: fix double free in find_lock_delalloc_range. - Btrfs: fix possible memory leak in btrfs_create_tree(). - Btrfs: fix use of uninit "ret" in end_extent_writepage(). - Btrfs: free delayed node outside of root->inode_lock (bnc#866864). - Btrfs: make DEV_INFO ioctl available to anyone. - Btrfs: make FS_INFO ioctl available to anyone. - Btrfs: make device scan less noisy. - Btrfs: make sure there are not any read requests before stopping workers. - Btrfs: more efficient io tree navigation on wait_extent_bit. - Btrfs: output warning instead of error when loading free space cache failed. - Btrfs: retrieve more info from FS_INFO ioctl. - Btrfs: return EPERM when deleting a default subvolume (bnc#869934). - Btrfs: unset DCACHE_DISCONNECTED when mounting default subvol (bnc#866615). - Btrfs: use right type to get real comparison. - Btrfs: wake up @scrub_pause_wait as much as we can. - Btrfs: wake up transaction thread upon remount. - CacheFiles: Add missing retrieval completions (bnc#880344). - CacheFiles: Does not try to dump the index key if the cookie has been cleared (bnc#880344). - CacheFiles: Downgrade the requirements passed to the allocator (bnc#880344). - CacheFiles: Fix the marking of cached pages (bnc#880344). - CacheFiles: Implement invalidation (bnc#880344). - CacheFiles: Make some debugging statements conditional (bnc#880344). - Drivers: hv: util: Fix a bug in the KVP code (bnc#886840). - Drivers: hv: vmbus: Fix a bug in the channel callback dispatch code (bnc#886840). - FS-Cache: Add transition to handle invalidate immediately after lookup (bnc#880344). - FS-Cache: Check that there are no read ops when cookie relinquished (bnc#880344). - FS-Cache: Clear remaining page count on retrieval cancellation (bnc#880344). - FS-Cache: Convert the object event ID #defines into an enum (bnc#880344). - FS-Cache: Does not sleep in page release if __GFP_FS is not set (bnc#880344). - FS-Cache: Does not use spin_is_locked() in assertions (bnc#880344). - FS-Cache: Exclusive op submission can BUG if there is been an I/O error (bnc#880344). - FS-Cache: Fix __wait_on_atomic_t() to call the action func if the counter != 0 (bnc#880344). - FS-Cache: Fix object state machine to have separate work and wait states (bnc#880344). - FS-Cache: Fix operation state management and accounting (bnc#880344). - FS-Cache: Fix signal handling during waits (bnc#880344). - FS-Cache: Initialise the object event mask with the calculated mask (bnc#880344). - FS-Cache: Limit the number of I/O error reports for a cache (bnc#880344). - FS-Cache: Make cookie relinquishment wait for outstanding reads (bnc#880344). - FS-Cache: Mark cancellation of in-progress operation (bnc#880344). - FS-Cache: One of the write operation paths doeses not set the object state (bnc#880344). - FS-Cache: Provide proper invalidation (bnc#880344). - FS-Cache: Simplify cookie retention for fscache_objects, fixing oops (bnc#880344). - FS-Cache: The retrieval remaining-pages counter needs to be atomic_t (bnc#880344). - FS-Cache: Uninline fscache_object_init() (bnc#880344). - FS-Cache: Wrap checks on object state (bnc#880344). - HID: usbhid: add always-poll quirk (bnc#888607). - HID: usbhid: enable always-poll quirk for Elan Touchscreen (bnc#888607). - IB/iser: Add TIMEWAIT_EXIT event handling (bnc#890297). - Ignore "flags" change to event_constraint (bnc#876114). - Ignore data_src/weight changes to perf_sample_data (bnc#876114). - NFS: Allow more operations in an NFSv4.1 request (bnc#890513). - NFS: Clean up helper function nfs4_select_rw_stateid() (bnc#888968). - NFS: Does not copy read delegation stateids in setattr (bnc#888968). - NFS: Does not use a delegation to open a file when returning that delegation (bnc#888968, bnc#892200, bnc#893596, bnc#893496) - NFS: Fixes for NFS RCU-walk support in line with code going upstream - NFS: Use FS-Cache invalidation (bnc#880344). - NFS: allow lockless access to access_cache (bnc#866130). - NFS: avoid mountpoint being displayed as " (deleted)" in /proc/mounts (bnc#888591). - NFS: nfs4_do_open should add negative results to the dcache (bnc#866130). - NFS: nfs_migrate_page() does not wait for FS-Cache to finish with a page (bnc#880344). - NFS: nfs_open_revalidate: only evaluate parent if it will be used (bnc#866130). - NFS: prepare for RCU-walk support but pushing tests later in code (bnc#866130). - NFS: support RCU_WALK in nfs_permission() (bnc#866130). - NFS: teach nfs_lookup_verify_inode to handle LOOKUP_RCU (bnc#866130). - NFS: teach nfs_neg_need_reval to understand LOOKUP_RCU (bnc#866130). - NFSD: Does not hand out delegations for 30 seconds after recalling them (bnc#880370). - NFSv4 set open access operation call flag in nfs4_init_opendata_res (bnc#888968, bnc#892200, bnc#893596, bnc#893496). - NFSv4: Add a helper for encoding opaque data (bnc#888968). - NFSv4: Add a helper for encoding stateids (bnc#888968). - NFSv4: Add helpers for basic copying of stateids (bnc#888968). - NFSv4: Clean up nfs4_select_rw_stateid() (bnc#888968). - NFSv4: Fix the return value of nfs4_select_rw_stateid (bnc#888968). - NFSv4: Rename nfs4_copy_stateid() (bnc#888968). - NFSv4: Resend the READ/WRITE RPC call if a stateid change causes an error (bnc#888968). - NFSv4: Simplify the struct nfs4_stateid (bnc#888968). - NFSv4: The stateid must remain the same for replayed RPC calls (bnc#888968). - NFSv4: nfs4_stateid_is_current should return "true" for an invalid stateid (bnc#888968). - One more fix for kABI breakage. - PCI: Lock down BAR access when module security is enabled (bnc#884333). - PCI: enable MPS "performance" setting to properly handle bridge MPS (bnc#883376). - PM / Hibernate: Add memory_rtree_find_bit function (bnc#860441). - PM / Hibernate: Create a Radix-Tree to store memory bitmap (bnc#860441). - PM / Hibernate: Implement position keeping in radix tree (bnc#860441). - PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free() (bnc#860441). - PM / Hibernate: Remove the old memory-bitmap implementation (bnc#860441). - PM / Hibernate: Touch Soft Lockup Watchdog in rtree_next_node (bnc#860441). - Restrict /dev/mem and /dev/kmem when module loading is restricted (bnc#884333). - Reuse existing "state" field to indicate PERF_X86_EVENT_PEBS_LDLAT (bnc#876114). - USB: handle LPM errors during device suspend correctly (bnc#849123). - Update kabi files to reflect fscache change (bnc#880344) - Update x86_64 config files: re-enable SENSORS_W83627EHF (bnc#891281) - VFS: Make more complete truncate operation available to CacheFiles (bnc#880344). - [FEAT NET1222] ib_uverbs: Allow explicit mmio trigger (FATE#83366, ltc#83367). - acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted (bnc#884333). - af_iucv: correct cleanup if listen backlog is full (bnc#885262, LTC#111728). - asus-wmi: Restrict debugfs interface when module loading is restricted (bnc#884333). - autofs4: allow RCU-walk to walk through autofs4 (bnc#866130). - autofs4: avoid taking fs_lock during rcu-walk (bnc#866130). - autofs4: does not take spinlock when not needed in autofs4_lookup_expiring (bnc#866130). - autofs4: factor should_expire() out of autofs4_expire_indirect (bnc#866130). - autofs4: make "autofs4_can_expire" idempotent (bnc#866130). - autofs4: remove a redundant assignment (bnc#866130). - autofs: fix lockref lookup (bnc#888591). - be2net: add dma_mapping_error() check for dma_map_page() (bnc#881759). - block: add cond_resched() to potentially long running ioctl discard loop (bnc#884725). - block: fix race between request completion and timeout handling (bnc#881051). - cdc-ether: clean packet filter upon probe (bnc#876017). - cpuset: Fix memory allocator deadlock (bnc#876590). - crypto: Allow CRYPTO_FIPS without MODULE_SIGNATURES. Not all archs have them, but some are FIPS certified, with some kernel support. - crypto: fips - only panic on bad/missing crypto mod signatures (bnc#887503). - crypto: testmgr - allow aesni-intel and ghash_clmulni-intel in fips mode (bnc#889451). - dasd: validate request size before building CCW/TCW (bnc#891087, LTC#114068). - dm mpath: fix race condition between multipath_dtr and pg_init_done (bnc#826486). - dm-mpath: fix panic on deleting sg device (bnc#870161). - drm/ast: AST2000 cannot be detected correctly (bnc#895983). - drm/ast: Actually load DP501 firmware when required (bnc#895608 bnc#871134). - drm/ast: Add missing entry to dclk_table[]. - drm/ast: Add reduced non reduced mode parsing for wide screen mode (bnc#892723). - drm/ast: initial DP501 support (v0.2) (bnc#871134). - drm/ast: open key before detect chips (bnc#895983). - drm/i915: Fix up cpt pixel multiplier enable sequence (bnc#879304). - drm/i915: Only apply DPMS to the encoder if enabled (bnc#893064). - drm/i915: clear the FPGA_DBG_RM_NOCLAIM bit at driver init (bnc#869055). - drm/i915: create functions for the "unclaimed register" checks (bnc#869055). - drm/i915: use FPGA_DBG for the "unclaimed register" checks (bnc#869055). - drm/mgag200: Initialize data needed to map fbdev memory (bnc #806990). - e1000e: enable support for new device IDs (bnc#885509). - fs/fscache: remove spin_lock() from the condition in while() (bnc#880344). - hibernate: Disable in a signed modules environment (bnc#884333). - hugetlb: does not use ERR_PTR with VM_FAULT* values - ibmvscsi: Abort init sequence during error recovery (bnc#885382). - ibmvscsi: Add memory barriers for send / receive (bnc#885382). - inet: add a redirect generation id in inetpeer (bnc#860593). - inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). - ipv6: tcp: fix tcp_v6_conn_request() (bnc#887645). - kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). - kernel: 3215 tty hang (bnc#891087, LTC#114562). - kernel: fix data corruption when reading /proc/sysinfo (bnc#891087, LTC#114480). - kernel: fix kernel oops with load of fpc register (bnc#889061, LTC#113596). - kernel: sclp console tty reference counting (bnc#891087, LTC#115466). - kexec: Disable at runtime if the kernel enforces module loading restrictions (bnc#884333). - md/raid6: avoid data corruption during recovery of double-degraded RAID6. - memcg, vmscan: Fix forced scan of anonymous pages (memory reclaim fix). - memcg: do not expose uninitialized mem_cgroup_per_node to world (bnc#883096). - mm, hugetlb: add VM_NORESERVE check in vma_has_reserves() - mm, hugetlb: change variable name reservations to resv - mm, hugetlb: decrement reserve count if VM_NORESERVE alloc page cache - mm, hugetlb: defer freeing pages when gathering surplus pages - mm, hugetlb: do not use a page in page cache for cow optimization - mm, hugetlb: fix and clean-up node iteration code to alloc or free - mm, hugetlb: fix race in region tracking - mm, hugetlb: fix subpool accounting handling - mm, hugetlb: improve page-fault scalability - mm, hugetlb: improve, cleanup resv_map parameters - mm, hugetlb: move up the code which check availability of free huge page - mm, hugetlb: protect reserved pages when soft offlining a hugepage - mm, hugetlb: remove decrement_hugepage_resv_vma() - mm, hugetlb: remove redundant list_empty check in gather_surplus_pages() - mm, hugetlb: remove resv_map_put - mm, hugetlb: remove useless check about mapping type - mm, hugetlb: return a reserved page to a reserved pool if failed - mm, hugetlb: trivial commenting fix - mm, hugetlb: unify region structure handling - mm, hugetlb: unify region structure handling kabi - mm, hugetlb: use long vars instead of int in region_count() (Hugetlb Fault Scalability). - mm, hugetlb: use vma_resv_map() map types - mm, oom: fix badness score underflow (bnc#884582, bnc#884767). - mm, oom: normalize oom scores to oom_score_adj scale only for userspace (bnc#884582, bnc#884767). - mm, thp: do not allow thp faults to avoid cpuset restrictions (bnc#888849). - net/mlx4_core: Load higher level modules according to ports type (bnc#887680). - net/mlx4_core: Load the IB driver when the device supports IBoE (bnc#887680). - net/mlx4_en: Fix a race between napi poll function and RX ring cleanup (bnc#863586). - net/mlx4_en: Fix selftest failing on non 10G link speed (bnc#888058). - net: fix checksumming features handling in output path (bnc#891259). - pagecache_limit: batch large nr_to_scan targets (bnc#895221). - pagecachelimit: reduce lru_lock congestion for heavy parallel reclaim fix (bnc#895680). - perf/core: Add weighted samples (bnc#876114). - perf/x86: Add flags to event constraints (bnc#876114). - perf/x86: Add memory profiling via PEBS Load Latency (bnc#876114). - perf: Add generic memory sampling interface (bnc#876114). - qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (bnc#859840). - qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (bnc#859840). - qla2xxx: Does not check for firmware hung during the reset context for ISP82XX (bnc#859840). - qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (bnc#859840). - qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (bnc#859840). - qla2xxx: Set host can_queue value based on available resources (bnc#859840). - restore smp_mb() in unlock_new_inode() (bnc#890526). - s390/pci: introduce lazy IOTLB flushing for DMA unmap (bnc#889061, LTC#113725). - sched: fix the theoretical signal_wake_up() vs schedule() race (bnc#876055). - sclp_vt220: Enable integrated ASCII console per default (bnc#885262, LTC#112035). - scsi_dh: use missing accessor "scsi_device_from_queue" (bnc#889614). - scsi_transport_fc: Cap dev_loss_tmo by fast_io_fail (bnc#887608). - scsiback: correct grant page unmapping. - scsiback: fix retry handling in __report_luns(). - scsiback: free resources after error. - sunrpc/auth: allow lockless (rcu) lookup of credential cache (bnc#866130). - supported.conf: remove external from drivers/net/veth (bnc#889727) - supported.conf: support net/sched/act_police.ko (bnc#890426) - tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). - tg3: Change nvram command timeout value to 50ms (bnc#855657). - tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#855657). - tg3: Set the MAC clock to the fastest speed during boot code load (bnc#855657). - usb: Does not enable LPM if the exit latency is zero (bnc#832309). - usbcore: Does not log on consecutive debounce failures of the same port (bnc#888105). - usbhid: fix PIXART optical mouse (bnc#888607). - uswsusp: Disable when module loading is restricted (bnc#884333). - vscsi: support larger transfer sizes (bnc#774818). - writeback: Do not sync data dirtied after sync start (bnc#833820). - x86 thermal: Delete power-limit-notification console messages (bnc#882317). - x86 thermal: Disable power limit notification interrupt by default (bnc#882317). - x86 thermal: Re-enable power limit notification interrupt by default (bnc#882317). - x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable() (bnc#887418). - x86/UV: Add call to KGDB/KDB from NMI handler (bnc#888847). - x86/UV: Add kdump to UV NMI handler (bnc#888847). - x86/UV: Add summary of cpu activity to UV NMI handler (bnc#888847). - x86/UV: Move NMI support (bnc#888847). - x86/UV: Update UV support for external NMI signals (bnc#888847). - x86/uv/nmi: Fix Sparse warnings (bnc#888847). - x86: Add check for number of available vectors before CPU down (bnc#887418). - x86: Lock down IO port access when module security is enabled (bnc#884333). - x86: Restrict MSR access when module loading is restricted (bnc#884333). Security Issues: * CVE-2013-1979 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1979> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-4027 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027> * CVE-2014-4171 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4171> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4943 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077> * CVE-2014-5471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5471> * CVE-2014-5472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5472> * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> * CVE-2014-6410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6410> SUSE bug 774818 SUSE bug 806990 SUSE bug 816708 SUSE bug 826486 SUSE bug 832309 SUSE bug 833820 SUSE bug 849123 SUSE bug 855657 SUSE bug 859840 SUSE bug 860441 SUSE bug 860593 SUSE bug 863586 SUSE bug 866130 SUSE bug 866615 SUSE bug 866864 SUSE bug 866911 SUSE bug 869055 SUSE bug 869934 SUSE bug 870161 SUSE bug 871134 SUSE bug 871797 SUSE bug 876017 SUSE bug 876055 SUSE bug 876114 SUSE bug 876590 SUSE bug 879304 SUSE bug 879921 SUSE bug 880344 SUSE bug 880370 SUSE bug 880892 SUSE bug 881051 SUSE bug 881759 SUSE bug 882317 SUSE bug 882639 SUSE bug 882804 SUSE bug 882900 SUSE bug 883096 SUSE bug 883376 SUSE bug 883518 SUSE bug 883724 SUSE bug 884333 SUSE bug 884582 SUSE bug 884725 SUSE bug 884767 SUSE bug 885262 SUSE bug 885382 SUSE bug 885422 SUSE bug 885509 SUSE bug 886840 SUSE bug 887082 SUSE bug 887418 SUSE bug 887503 SUSE bug 887608 SUSE bug 887645 SUSE bug 887680 SUSE bug 888058 SUSE bug 888105 SUSE bug 888591 SUSE bug 888607 SUSE bug 888847 SUSE bug 888849 SUSE bug 888968 SUSE bug 889061 SUSE bug 889173 SUSE bug 889451 SUSE bug 889614 SUSE bug 889727 SUSE bug 890297 SUSE bug 890426 SUSE bug 890513 SUSE bug 890526 SUSE bug 891087 SUSE bug 891259 SUSE bug 891281 SUSE bug 891619 SUSE bug 891746 SUSE bug 892200 SUSE bug 892490 SUSE bug 892723 SUSE bug 893064 SUSE bug 893496 SUSE bug 893596 SUSE bug 894200 SUSE bug 895221 SUSE bug 895608 SUSE bug 895680 SUSE bug 895983 SUSE bug 896689 CVE-2013-1979 CVE-2014-1739 CVE-2014-2706 CVE-2014-3153 CVE-2014-4027 CVE-2014-4171 CVE-2014-4508 CVE-2014-4667 CVE-2014-4943 CVE-2014-5077 CVE-2014-5471 CVE-2014-5472 CVE-2014-6410 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-3955: The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel allowed remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet (bnc#975945). - CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary (bnc#986365). - CVE-2015-7513: arch/x86/kvm/x86.c in the Linux kernel did not reset the PIT counter values during state restoration, which allowed guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions (bnc#960689). - CVE-2013-4312: The Linux kernel allowed local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c (bnc#839104). - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362). - CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572). - CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure was initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755). - CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213). - CVE-2016-1583: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling (bnc#983143). - CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandled NM (aka alternate name) entries containing \0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725). - CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267). - CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371). - CVE-2016-0758: Integer overflow in lib/asn1_decoder.c in the Linux kernel allowed local users to gain privileges via crafted ASN.1 data (bnc#979867). - CVE-2015-7833: The usbvision driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor (bnc#950998). - CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971944). - CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401). - CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548). - CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762). - CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821). - CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879). - CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213). - CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822). - CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126). - CVE-2016-5696: net/ipv4/tcp_input.c in the Linux kernel did not properly determine the rate of challenge ACK segments, which made it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. (bsc#989152) - CVE-2016-6480: Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. (bsc#991608) The following non-security bugs were fixed: - Update patches.fixes/pci-determine-actual-vpd-size-on-first-access.patch (bsc#971729, bsc#974428). - Update PCI VPD size patch to upstream: * PCI: Determine actual VPD size on first access (bsc#971729). * PCI: Update VPD definitions (bsc#971729). (cherry picked from commit d2af5b7e0cd7ee2a54f02ad65ec300d16b3ad956) - Update patches.fixes/pci-update-vpd-definitions.patch (bsc#971729, bsc#974428). - cgroups: do not attach task to subsystem if migration failed (bnc#979274). - cgroups: more safe tasklist locking in cgroup_attach_proc (bnc#979274). - fs/cifs: Fix cifs_uniqueid_to_ino_t() function for s390x (bsc#944309) - fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681) - hid: add ALWAYS_POLL quirk for a Logitech 0xc055 (bnc#962404). - hid: add HP OEM mouse to quirk ALWAYS_POLL (bsc#919351). - hid: add quirk for PIXART OEM mouse used by HP (bsc#919351). - hid-elo: kill not flush the work. - ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360). - ipv4: fix ineffective source address selection (bsc#980788). - ipvs: count pre-established TCP states as active (bsc#970114). - kabi, unix: properly account for FDs passed over unix sockets (bnc#839104). - mm/hugetlb.c: correct missing private flag clearing (VM Functionality, bnc#971446). - mm/hugetlb: fix backport of upstream commit 07443a85ad (VM Functionality, bnc#971446). - mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED (VM Functionality, bnc#986445). - nfs: Do not attempt to decode missing directory entries (bsc#980931). - nfs: fix memory corruption rooted in get_ih_name pointer math (bsc#984107). - nfs: reduce access cache shrinker locking (bnc#866130). - ppp: defer netns reference release for ppp channel (bsc#980371). - s390/cio: collect format 1 channel-path description data (bsc#966460,LTC#136434). - s390/cio: ensure consistent measurement state (bsc#966460,LTC#136434). - s390/cio: fix measurement characteristics memleak (bsc#966460,LTC#136434). - s390/cio: update measurement characteristics (bsc#966460,LTC#136434). - usbhid: add device USB_DEVICE_ID_LOGITECH_C077 (bsc#919351). - usbhid: more mice with ALWAYS_POLL (bsc#919351). - usbhid: yet another mouse with ALWAYS_POLL (bsc#919351). - veth: do not modify ip_summed (bsc#969149). - virtio_scsi: Implement eh_timed_out callback. - vmxnet3: segCnt can be 1 for LRO packets (bsc#988065). - xfs: Avoid grabbing ilock when file size is not changed (bsc#983535). - xfs: avoid xfs_buf hang in lookup node directory corruption (bsc#989401). - xfs: only update the last_sync_lsn when a transaction completes (bsc#987709). Important SUSE bug 839104 SUSE bug 866130 SUSE bug 919351 SUSE bug 944309 SUSE bug 950998 SUSE bug 960689 SUSE bug 962404 SUSE bug 963655 SUSE bug 963762 SUSE bug 966460 SUSE bug 969149 SUSE bug 970114 SUSE bug 971126 SUSE bug 971360 SUSE bug 971446 SUSE bug 971729 SUSE bug 971944 SUSE bug 974428 SUSE bug 975945 SUSE bug 978401 SUSE bug 978821 SUSE bug 978822 SUSE bug 979213 SUSE bug 979274 SUSE bug 979548 SUSE bug 979681 SUSE bug 979867 SUSE bug 979879 SUSE bug 980371 SUSE bug 980725 SUSE bug 980788 SUSE bug 980931 SUSE bug 981267 SUSE bug 983143 SUSE bug 983213 SUSE bug 983535 SUSE bug 984107 SUSE bug 984755 SUSE bug 986362 SUSE bug 986365 SUSE bug 986445 SUSE bug 986572 SUSE bug 987709 SUSE bug 988065 SUSE bug 989152 SUSE bug 989401 SUSE bug 991608 CVE-2013-4312 CVE-2015-7513 CVE-2015-7833 CVE-2016-0758 CVE-2016-1583 CVE-2016-2053 CVE-2016-2187 CVE-2016-3134 CVE-2016-3955 CVE-2016-4470 CVE-2016-4482 CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4805 CVE-2016-4913 CVE-2016-4997 CVE-2016-5244 CVE-2016-5696 CVE-2016-5829 CVE-2016-6480 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP 3 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Important SUSE bug 1013533 SUSE bug 1013604 CVE-2016-9576 CVE-2016-9794 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following security bug: CVE-2017-2636: A race condition in the n_hdlc tty Linux kernel driver (drivers/tty/n_hdlc.c) could have been exploited to gain a local privilege escalation (bnc#1027565) Important SUSE bug 1027565 CVE-2017-2636 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security fixes. The following security bugs were fixed: - CVE-2017-1000364: The default stack guard page was too small and could be "jumped over" by userland programs using more than one page of stack in functions and so lead to memory corruption. This update extends the stack guard page to 1 MB (for 4k pages) and 16 MB (for 64k pages) to reduce this attack vector. This is not a kernel bugfix, but a hardening measure against this kind of userland attack.(bsc#1039348) - CVE-2015-3288: mm/memory.c in the Linux kernel mishandled anonymous pages, which allowed local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero (bnc#979021). Critical SUSE bug 1039348 SUSE bug 979021 CVE-2015-3288 CVE-2017-1000364 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following issues: - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. [bsc#1045340, bsc#1045406] Important SUSE bug 1045340 SUSE bug 1045406 CVE-2017-1000364 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to fix the following issues: - Stack corruption could have lead to local privilege escalation (bsc#1059525, CVE-2017-1000253). Important SUSE bug 1059525 CVE-2017-1000253 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912). - CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903) - CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689) - CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511) - CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509) - CVE-2018-15572: The spectre_v2_select_mitigation function did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517) - CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322). - CVE-2018-14734: ucma_leave_multicast accessed a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bsc#1103119). The following non-security bugs were fixed: - KVM: VMX: Work around kABI breakage in 'enum vmx_l1d_flush_state' (bsc#1106369). - KVM: VMX: fixes for vmentry_l1d_flush module parameter (bsc#1106369). - KVM: x86: Free vmx_msr_bitmap_longmode while kvm_init failed (bsc#1104367). - Refresh patches.xen/xen3-x86-l1tf-04-protect-PROT_NONE-ptes.patch (bsc#1105100). - kabi: x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536). - kabi: x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536). - ptrace: fix PTRACE_LISTEN race corrupting task->state (bnc#1107001). - rpm/kernel-docs.spec.in: Expand kernel tree directly from sources (bsc#1057199) - x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104684, bnc#1104818). - x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM (bnc#1105536). - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (bnc#1087081). - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536). - x86/speculation/l1tf: Suggest what to do on systems with too much RAM (bnc#1105536). - xen x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM (bnc#1105536). - xen x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bnc#1105536). - xen, x86, l1tf: Protect PROT_NONE PTEs against speculation fixup (bnc#1104684, bnc#1104818). - xen: x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (bnc#1087081). Important SUSE bug 1057199 SUSE bug 1087081 SUSE bug 1092903 SUSE bug 1102517 SUSE bug 1103119 SUSE bug 1104367 SUSE bug 1104684 SUSE bug 1104818 SUSE bug 1105100 SUSE bug 1105296 SUSE bug 1105322 SUSE bug 1105323 SUSE bug 1105536 SUSE bug 1106369 SUSE bug 1106509 SUSE bug 1106511 SUSE bug 1107001 SUSE bug 1107689 SUSE bug 1108912 CVE-2018-10902 CVE-2018-10940 CVE-2018-14634 CVE-2018-14734 CVE-2018-15572 CVE-2018-16658 CVE-2018-6554 CVE-2018-6555 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata Kernel was updated to fix the following security issues: * vfs: Fix race between fcntl() and file->f_flags checks (bnc#900881, CVE-2014-8086). * fs: Take i_mutex during prepare_binprm for setid executables (bnc#928130, CVE-2015-3339). * ib/uverbs: Prevent integer overflow in ib_umem_get address arithmetic (bsc#914742, CVE-2014-8159). * eCryptfs: Remove buggy and unnecessary write in file name decode routine (bsc#918333, CVE-2014-9683). * x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (bsc#926240, CVE-2015-2830). * net/rds: Use correct size for max unacked packets and bytes (bsc#919018, CVE-2015-2042). * net/sctp: Fix slab corruption from use after free on INIT collisions (bsc#915577, CVE-2015-1421). * usbback: Copy only filled buffers to guest (bsc#917830, CVE-2015-0777). * xen-pciback: Limit guest control of command register (bsc#919463, CVE-2015-2150, XSA-120). * (update) kvm/x86: Distinguish between stack operation and near branches (bnc#899192, bsc#924721, CVE-2014-3647). * (update) kvm/x86: Emulator fixes for eip canonical checks on near branches (bnc#899192, bsc#924721, CVE-2014-3647). Additionally, the following non-security issues have been fixed: * supported.conf: Mark crc32c-intel module as supported (bnc#925927). * supported.conf: Mark tcp_westwood module as supported (bnc#871224). * x86/reboot: Fix a warning message triggered by stop_other_cpus() (bnc#930284). * Deal with deadlock in d_walk fix (bnc#929148, bnc#929283). * mm, slab: Lock the correct nodelist after reenabling irqs (bnc#926439). * nfs: Don't try to use lock state when we hold a delegation (bnc#831029). Security Issues: * CVE-2014-8086 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8086> * CVE-2015-3339 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3339> * CVE-2014-8159 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8159> * CVE-2014-9683 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9683> * CVE-2015-2830 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2830> * CVE-2015-2042 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2042> * CVE-2015-1421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1421> * CVE-2015-0777 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0777> * CVE-2015-2150 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2150> * CVE-2014-3647 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3647> * CVE-2014-3647 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3647> SUSE bug 831029 SUSE bug 871224 SUSE bug 900881 SUSE bug 914742 SUSE bug 915577 SUSE bug 917830 SUSE bug 918333 SUSE bug 919018 SUSE bug 919463 SUSE bug 924721 SUSE bug 925927 SUSE bug 926240 SUSE bug 926439 SUSE bug 928130 SUSE bug 929148 SUSE bug 929283 SUSE bug 930284 CVE-2014-3647 CVE-2014-8086 CVE-2014-8159 CVE-2014-9683 CVE-2015-0777 CVE-2015-1421 CVE-2015-2042 CVE-2015-2150 CVE-2015-2830 CVE-2015-3339 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following bugs and security issues. The following security issues have been fixed: - Update patches.fixes/udp-fix-behavior-of-wrong-checksums.patch (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Btrfs: make xattr replace operations atomic (bnc#923908, CVE-2014-9710). - udp: fix behavior of wrong checksums (bsc#936831, CVE-2015-5364, CVE-2015-5366). - vfs: read file_handle only once in handle_to_path (bsc#915517, CVE-2015-1420). - x86: bpf_jit: fix compilation of large bpf programs (bnc#935705,CVE-2015-4700). - udf: Check length of extended attributes and allocation (bsc#936831, CVE-2015-5364, CVE-2015-5366). - Update patches.fixes/udf-Check-component-length-before-reading-it.patch (bsc#933904, CVE-2014-9728, CVE-2014-9730). - Update patches.fixes/udf-Verify-i_size-when-loading-inode.patch (bsc#933904, CVE-2014-9728, CVE-2014-9729). - Update patches.fixes/udf-Verify-symlink-size-before-loading-it.patch (bsc#933904, CVE-2014-9728). - Update patches.fixes/udf-Check-path-length-when-reading-symlink.patch (bnc#933896, CVE-2014-9731). - pipe: fix iov overrun for failed atomic copy (bsc#933429, CVE-2015-1805). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). - ipv6: Don't reduce hop limit for an interface (bsc#922583, CVE-2015-2922). - net: llc: use correct size for sysctl timeout entries (bsc#919007, CVE-2015-2041). - ipv4: Missing sk_nulls_node_init() in ping_unhash() (bsc#929525, CVE-2015-3636). The following non-security issues have been fixed: - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - net/mlx4_core: Don't disable SRIOV if there are active VFs (bsc#927355). - udf: Remove repeated loads blocksize (bsc#933907). - Refresh patches.fixes/deal-with-deadlock-in-d_walk-fix.patch. based on 3.2 stable fix 20defcec264c ("dcache: Fix locking bugs in backported "deal with deadlock in d_walk()""). Not harmfull for regular SLES kernels but RT or PREEMPT kernels would see disbalance. - sched: Fix potential near-infinite distribute_cfs_runtime() loop (bnc#930786) - tty: Correct tty buffer flush (bnc#929647). - tty: hold lock across tty buffer finding and buffer filling (bnc#929647). Important SUSE bug 915517 SUSE bug 919007 SUSE bug 922583 SUSE bug 923908 SUSE bug 927355 SUSE bug 929525 SUSE bug 929647 SUSE bug 930786 SUSE bug 933429 SUSE bug 933896 SUSE bug 933904 SUSE bug 933907 SUSE bug 935705 SUSE bug 936831 CVE-2014-9710 CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-1420 CVE-2015-1805 CVE-2015-2041 CVE-2015-2922 CVE-2015-3636 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 SUSE Linux Enterprise Server 11 SP3 The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. Following security bugs were fixed: - CVE-2015-5707: An integer overflow in the SCSI generic driver could be potentially used by local attackers to crash the kernel or execute code (bsc#940338). - CVE-2015-5364: A remote denial of service (hang) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-5366: A remote denial of service (unexpected error returns) via UDP flood with incorrect package checksums was fixed. (bsc#936831). - CVE-2015-1420: A race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel allowed local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function (bnc#915517). - CVE-2015-4700: A local user could have created a bad instruction in the JIT processed BPF code, leading to a kernel crash (bnc#935705). - CVE-2015-4167: The UDF filesystem in the Linux kernel was vulnerable to a crash which could occur while fetching inode information from a corrupted/malicious udf file system image. (bsc#933907). - CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731: Various issues in handling UDF filesystems in the Linux kernel allowed the corruption of kernel memory and other issues. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash. (bsc#933904 bsc#933896) - CVE-2015-2150: The Linux kernel did not properly restrict access to PCI command registers, which might have allowed local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (bsc#919463). - CVE-2015-0777: drivers/xen/usbback/usbback.c as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allowed guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors (bnc#917830). - CVE-2015-2830: arch/x86/kernel/entry_64.S in the Linux kernel did not prevent the TS_COMPAT flag from reaching a user-mode task, which might have allowed local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16 (bnc#926240). - CVE-2015-1805: The Linux kernels implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (bsc#933429). Also the following non-security bugs were fixed: - audit: keep inode pinned (bsc#851068). - btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#942350). - btrfs: check if previous transaction aborted to avoid fs corruption (bnc#942350). - btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#942350). - cifs: Fix missing crypto allocation (bnc#937402). - client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set (bnc#932348). - drm: ast,cirrus,mgag200: use drm_can_sleep (bnc#883380, bsc#935572). - drm/cirrus: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: do not attempt to acquire a reservation while in an interrupt handler (bsc#935572). - drm/mgag200: Do not do full cleanup if mgag200_device_init fails. - ext3: Fix data corruption in inodes with journalled data (bsc#936637) - ext4: handle SEEK_HOLE/SEEK_DATA generically (bsc#934944). - fanotify: Fix deadlock with permission events (bsc#935053). - fork: reset mm->pinned_vm (bnc#937855). - hrtimer: prevent timer interrupt DoS (bnc#886785). - hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES (bnc#930092). - IB/core: Fix mismatch between locked and pinned pages (bnc#937855). - iommu/amd: Fix memory leak in free_pagetable (bsc#935866). - iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538). - iommu/amd: Handle large pages correctly in free_pagetable (bsc#935866). - ipr: Increase default adapter init stage change timeout (bsc#930761). - ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (bsc#927355). - kdump: fix crash_kexec()/smp_send_stop() race in panic() (bnc#937444). - kernel: add panic_on_warn. (bsc#934742) - kvm: irqchip: Break up high order allocations of kvm_irq_routing_table (bnc#926953). - libata: prevent HSM state change race between ISR and PIO (bsc#923245). - md: use kzalloc() when bitmap is disabled (bsc#939994). - megaraid_sas: Use correct reset sequence in adp_reset() (bsc#894936). - mlx4: Check for assigned VFs before disabling SR-IOV (bsc#927355). - mm/hugetlb: check for pte NULL pointer in __page_check_address() (bnc#929143). - mm: restrict access to slab files under procfs and sysfs (bnc#936077). - net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference (bsc#867362). - net: Fix "ip rule delete table 256" (bsc#873385). - net: ipv6: fib: do not sleep inside atomic lock (bsc#867362). - net/mlx4_core: Do not disable SRIOV if there are active VFs (bsc#927355). - nfsd: Fix nfsv4 opcode decoding error (bsc#935906). - nfsd: support disabling 64bit dir cookies (bnc#937503). - nfs: never queue requests with rq_cong set on the sending queue (bsc#932458). - nfsv4: Minor cleanups for nfs4_handle_exception and nfs4_async_handle_error (bsc#939910). - pagecache limit: add tracepoints (bnc#924701). - pagecache limit: Do not skip over small zones that easily (bnc#925881). - pagecache limit: export debugging counters via /proc/vmstat (bnc#924701). - pagecache limit: fix wrong nr_reclaimed count (bnc#924701). - pagecache limit: reduce starvation due to reclaim retries (bnc#925903). - pci: Add SRIOV helper function to determine if VFs are assigned to guest (bsc#927355). - pci: Disable Bus Master only on kexec reboot (bsc#920110). - pci: disable Bus Master on PCI device shutdown (bsc#920110). - pci: Disable Bus Master unconditionally in pci_device_shutdown() (bsc#920110). - pci: Don't try to disable Bus Master on disconnected PCI devices (bsc#920110). - perf, nmi: Fix unknown NMI warning (bsc#929142). - perf/x86/intel: Move NMI clearing to end of PMI handler (bsc#929142). - rtlwifi: rtl8192cu: Fix kernel deadlock (bnc#927786). - sched: fix __sched_setscheduler() vs load balancing race (bnc#921430) - scsi_error: add missing case statements in scsi_decide_disposition() (bsc#920733). - scsi: Set hostbyte status in scsi_check_sense() (bsc#920733). - scsi: set host msg status correctly (bnc#933936) - scsi: vmw_pvscsi: Fix pvscsi_abort() function (bnc#940398 bsc#930934). - st: null pointer dereference panic caused by use after kref_put by st_open (bsc#936875). - udf: Remove repeated loads blocksize (bsc#933907). - usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset (bnc#937641). - vmxnet3: Bump up driver version number (bsc#936423). - vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423). - vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423). - vmxnet3: Register shutdown handler for device (fwd) (bug#936423). - x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032). - x86, tls: Interpret an all-zero struct user_desc as "no segment" (bsc#920250). - x86, tls, ldt: Stop checking lm in LDT_empty (bsc#920250). - xenbus: add proper handling of XS_ERROR from Xenbus for transactions. - xfs: avoid mounting of xfs filesystems with inconsistent option (bnc#925705) - zcrypt: Fixed reset and interrupt handling of AP queues (bnc#936925, LTC#126491). Important SUSE bug 851068 SUSE bug 867362 SUSE bug 873385 SUSE bug 883380 SUSE bug 886785 SUSE bug 894936 SUSE bug 915517 SUSE bug 917830 SUSE bug 919463 SUSE bug 920110 SUSE bug 920250 SUSE bug 920733 SUSE bug 921430 SUSE bug 923245 SUSE bug 924701 SUSE bug 925705 SUSE bug 925881 SUSE bug 925903 SUSE bug 926240 SUSE bug 926953 SUSE bug 927355 SUSE bug 927786 SUSE bug 929142 SUSE bug 929143 SUSE bug 930092 SUSE bug 930761 SUSE bug 930934 SUSE bug 931538 SUSE bug 932348 SUSE bug 932458 SUSE bug 933429 SUSE bug 933896 SUSE bug 933904 SUSE bug 933907 SUSE bug 933936 SUSE bug 934742 SUSE bug 934944 SUSE bug 935053 SUSE bug 935572 SUSE bug 935705 SUSE bug 935866 SUSE bug 935906 SUSE bug 936077 SUSE bug 936423 SUSE bug 936637 SUSE bug 936831 SUSE bug 936875 SUSE bug 936925 SUSE bug 937032 SUSE bug 937402 SUSE bug 937444 SUSE bug 937503 SUSE bug 937641 SUSE bug 937855 SUSE bug 939910 SUSE bug 939994 SUSE bug 940338 SUSE bug 940398 SUSE bug 942350 CVE-2014-9728 CVE-2014-9729 CVE-2014-9730 CVE-2014-9731 CVE-2015-0777 CVE-2015-1420 CVE-2015-1805 CVE-2015-2150 CVE-2015-2830 CVE-2015-4167 CVE-2015-4700 CVE-2015-5364 CVE-2015-5366 CVE-2015-5707 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security bugs have been fixed: - CVE-2015-6252: Possible file descriptor leak for each VHOST_SET_LOG_FD command issued. This could eventually waste available system resources and create a denial of service. (bsc#942367) - CVE-2015-5707: Possible integer overflow in the calculation of total number of pages in bio_map_user_iov(). (bsc#940338) The following non-security bugs have been fixed: - ib/iser: Add Discovery support. (bsc#923002) - ib/iser: Move informational messages from error to info level. (bsc#923002) - scsi: Limit iscsi kABI changes to discovery session. (bsc#923002) - scsi: Fix force panic issue with the megaraid_sas driver with Intel Romley hardware. (bsc#938485) - scsi: Update megaraid_sas's threshold based reply post host index register.(bsc#919808) - scsi: megaraid_sas: Use correct reset sequence in adp_reset(). (bsc#894936) - scsi: Fix scsi_error_handler vs. scsi_host_dev_release race. (bsc#942204) - scsi: Exporting new attrs for iscsi session and connection in sysfs. (bsc#923002) - ext3: Fix data corruption in inodes with journalled data. (bsc#936637) - libiscsi: Exporting new attrs for iscsi session and connection in sysfs. (bsc#923002) - watchdog: Report watchdog state properly after failure. (bsc#937444) - x86/mm: Improve AMD Bulldozer ASLR workaround. (bsc#937032) - Make sure that there's not too many elements in iovec. (bsc#940338) Moderate SUSE bug 894936 SUSE bug 919808 SUSE bug 923002 SUSE bug 936637 SUSE bug 937032 SUSE bug 937444 SUSE bug 938485 SUSE bug 940338 SUSE bug 942204 SUSE bug 942367 CVE-2015-5707 CVE-2015-6252 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - keys: Don't permit request_key() to construct a new keyring (bsc#951440, CVE-2015-7872). - keys: Fix crash when attempt to garbage collect an uninstantiated keyring (bsc#951440, CVE-2015-7872). - rds: Verify the underlying transport exists before creating a connection (bsc#945825, CVE-2015-6937). - ipv6/addrconf: Validate new MTU before applying it (bsc#944296, CVE-2015-0272). - rcu: Move lockless_dereference() out of rcupdate.h (bsc#938706, CVE-2015-5157). - x86/ldt: Correct FPU emulation access to LDT (bsc#938706, CVE-2015-5157). - x86/ldt: Correct LDT access in single stepping logic (bsc#938706, CVE-2015-5157). - x86/ldt: Further fix FPU emulation (bsc#938706, CVE-2015-5157). - x86/ldt: Make modify_ldt synchronous (bsc#938706, CVE-2015-5157). - x86/nmi/64: Switch stacks on userspace NMI entry (bsc#938706, CVE-2015-5157). The following non-security issues have been fixed: - Enable x86_64/ec2 configuration (bsc#951771). - keys: Fix race between key destruction and finding a keyring by name (bsc#951440). - scsi/hosts: Update to use ida_simple for host_no management (bsc#939926). - sched/core: Fix task and run queue sched_info::run_delay inconsistencies (bsc#949100). - x86/tls/ldt: Stop checking lm in LDT_empty (bsc#920250). - x86/irq: Check for valid irq descriptor in check_irq_vectors_for_cpu_disable (bsc#914726). - xfs: Fix softlockup in xfs_inode_ag_walk() (bsc#948347). Important SUSE bug 914726 SUSE bug 920250 SUSE bug 938706 SUSE bug 939926 SUSE bug 944296 SUSE bug 945825 SUSE bug 948347 SUSE bug 949100 SUSE bug 951440 SUSE bug 951771 CVE-2015-0272 CVE-2015-5157 CVE-2015-6937 CVE-2015-7872 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following security issues. - kvm/svm: Unconditionally intercept #DB (bsc#954404, CVE-2015-8104). - kvm/x86: Work around infinite loop in microcode when #AC is delivered (bsc#953527, CVE-2015-5307). - rds: Fix race condition when sending a message on unbound socket (bsc#952384, CVE-2015-7990). Important SUSE bug 952384 SUSE bug 953527 SUSE bug 954404 CVE-2015-5307 CVE-2015-7990 CVE-2015-8104 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - bluetooth: Validate socket address length in sco_sock_bind() (bsc#959399, CVE-2015-8575). - ext4: Make orphan functions be no-op in no-journal mode (bsc#956709, CVE-2015-7509). - input/aiptek: Adjust error-handling code label (bsc#956708, CVE-2015-7515). - input/aiptek: Fix crash on detecting device without endpoints (bsc#956708, CVE-2015-7515). - isdn_ppp: Add checks for allocation failure in isdn_ppp_open() (bsc#949936, CVE-2015-7799). - kabi: Protect struct unix_sock layout after epoll fix (bsc#917648, bsc#955654, CVE-2013-7446). - keys: Fix handling of stored error in a negatively instantiated user key (bsc#958463, CVE-2015-8539). - keys: Fix race between read and revoke (bsc#958951, CVE-2015-7550). - net: Add validation for the socket syscall protocol argument (bsc#958886, CVE-2015-8543). - ppp/slip: Validate VJ compression slot parameters completely (bsc#949936, CVE-2015-7799). - pptp: Verify sockaddr_len in pptp_bind() and pptp_connect() (bsc#959190, CVE-2015-8569). - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (bsc#961509, CVE-2015-8767). - tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (bsc#961500, CVE-2016-0723). - unix: Avoid use-after-free in ep_remove_wait_queue (bsc#917648, bsc#955654, CVE-2013-7446). - xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set (bsc#957990, CVE-2015-8551, CVE-2015-8552, XSA-157). - xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled (bsc#957990, CVE-2015-8551, CVE-2015-8552, XSA-157). - xen/pciback: Return error on XEN_PCI_OP_enable_msix/XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled (bsc#957990, CVE-2015-8551, CVE-2015-8552 XSA-157). - Guarantee one time reads of shared ring contents (bsc#957988, CVE-2015-8550, XSA-155). The following non-security issues have been fixed: - new helper: single_open_size() (bsc#928122, bsc#962407). - proc: Speed up /proc/stat handling (bsc#928122, bsc#962407). - /proc/stat: Convert to single_open_size() (bsc#928122, bsc#962407). - xfs: Fix lost direct IO write in the last block (bsc#949744). - Fix build error caused by missing U8_MAX. - Add references for bsc#955354 and CVE-2015-8215 to patch. - Refreshed patch to fix bsc#959705. Important SUSE bug 917648 SUSE bug 928122 SUSE bug 949744 SUSE bug 949936 SUSE bug 955354 SUSE bug 955654 SUSE bug 956708 SUSE bug 956709 SUSE bug 957988 SUSE bug 957990 SUSE bug 958463 SUSE bug 958886 SUSE bug 958951 SUSE bug 959190 SUSE bug 959399 SUSE bug 959705 SUSE bug 961500 SUSE bug 961509 SUSE bug 962407 CVE-2013-7446 CVE-2015-7509 CVE-2015-7515 CVE-2015-7550 CVE-2015-7799 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8550 CVE-2015-8551 CVE-2015-8552 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2016-0723 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - usb/serial/visor: Fix crash on detecting device without write_urbs (bsc#961512, CVE-2015-7566). - alsa/hrtimer: Fix stall by hrtimer_cancel() (CVE-2016-2549,bsc#968013). - alsa/timer: Harden slave timer list handling (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012). - alsa/timer: Fix race among timer ioctls (CVE-2016-2546,bsc#967975). - alsa/timer: Fix double unlink of active_list (CVE-2016-2545,bsc#967974). - alsa/seq: Fix race at timer setup and close (CVE-2016-2544,bsc#967973). - alsa/seq: Fix missing NULL check at remove_events ioctl (CVE-2016-2543,bsc#967972). - alsa/usb-audio: Avoid freeing umidi object twice (CVE-2016-2384,bsc#966693). - iw_cxgb3: Fix incorrectly returning error on success (bsc#966437, CVE-2015-8812). - fuse: Break infinite loop in fuse_fill_write_pages() (bsc#963765, CVE-2015-8785). - x86/mm: Add barriers and document switch_mm()-vs-flush synchronization (bsc#963767, CVE-2016-2069). The following new features have been implemented: - Indirect request segment descriptors protocol additions (fate#320200, bsc#956084). - Add BLKIF_OP_INDIRECT to the blkif protocol (fate#320200, bsc#956084). - blkif: Indirect request segment descriptors definitions (fate#316876, bsc#956084). - blkfront: Allow using indirect request segment descriptors (fate#316876, bsc#956084). - Update patches.xen/xen-blkif-discard (fate#309305, bsc#956084). - Refresh patches.xen/xen-blkif-op-packet (fate#300964, bsc#956084). - Build Xen blkfront PV driver (bsc#956084). - Add Xen platform-pci PV driver (bsc#956084). The following bugs have been fixed: - Fix PV and pvops builds (bsc#956084). - Fix blkfront crashes on resume (bsc#956084). - Limit expansion of names_list (bsc#966102). Important SUSE bug 956084 SUSE bug 961512 SUSE bug 963765 SUSE bug 963767 SUSE bug 966102 SUSE bug 966437 SUSE bug 966693 SUSE bug 967972 SUSE bug 967973 SUSE bug 967974 SUSE bug 967975 SUSE bug 968011 SUSE bug 968012 SUSE bug 968013 CVE-2015-7566 CVE-2015-8785 CVE-2015-8812 CVE-2016-2069 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654). - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015 (bnc#956707). - CVE-2015-7515: An out of bounds memory access in the aiptek USB driver could be used by physical local attackers to crash the kernel (bnc#956708). - CVE-2015-7550: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls (bnc#958951). - CVE-2015-7566: A malicious USB device could cause kernel crashes in the visor device driver (bnc#961512). - CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936). - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product (bnc#955354). - CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c (bnc#958463). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886). - CVE-2015-8550: Optimizations introduced by the compiler could have lead to double fetch vulnerabilities, potentially possibly leading to arbitrary code execution in backend (bsc#957988). (bsc#957988 XSA-155). - CVE-2015-8551: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks (bnc#957990). - CVE-2015-8552: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks (bnc#957990). - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel do not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8575: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959399). - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux kernel did not properly manage the relationship between a lock and a socket, which allowed local users to cause a denial of service (deadlock) via a crafted sctp_accept call (bnc#961509). - CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel allowed local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov (bnc#963765). - CVE-2015-8812: A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario.(bsc#966437). - CVE-2015-8816: A malicious USB device could cause kernel crashes in the in hub_activate() function (bnc#968010). - CVE-2016-0723: Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). - CVE-2016-2069: A race in invalidating paging structures that were not in use locally could have lead to disclosoure of information or arbitrary code exectution (bnc#963767). - CVE-2016-2143: On zSeries a fork of a large process could have caused memory corruption due to incorrect page table handling. (bnc#970504, LTC#138810). - CVE-2016-2184: A malicious USB device could cause kernel crashes in the alsa usb-audio device driver (bsc#971125). - CVE-2016-2185: A malicious USB device could cause kernel crashes in the usb_driver_claim_interface function (bnc#971124). - CVE-2016-2186: A malicious USB device could cause kernel crashes in the powermate device driver (bnc#970958). - CVE-2016-2384: A double free on the ALSA umidi object was fixed. (bsc#966693). - CVE-2016-2543: A missing NULL check at remove_events ioctl in the ALSA seq driver was fixed. (bsc#967972). - CVE-2016-2544: Fix race at timer setup and close in the ALSA seq driver was fixed. (bsc#967973). - CVE-2016-2545: A double unlink of active_list in the ALSA timer driver was fixed. (bsc#967974). - CVE-2016-2546: A race among ALSA timer ioctls was fixed (bsc#967975). - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list handling was hardened against hangs and races. (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012). - CVE-2016-2549: A stall in ALSA hrtimer handling was fixed (bsc#968013). - CVE-2016-2782: A malicious USB device could cause kernel crashes in the visor device driver (bnc#968670). - CVE-2016-3137: A malicious USB device could cause kernel crashes in the cypress_m8 device driver (bnc#970970). - CVE-2016-3139: A malicious USB device could cause kernel crashes in the wacom device driver (bnc#970909). - CVE-2016-3140: A malicious USB device could cause kernel crashes in the digi_acceleport device driver (bnc#970892). - CVE-2016-3156: A quadratic algorithm could lead to long kernel ipv4 hangs when removing a device with a large number of addresses. (bsc#971360). - CVE-2016-3955: A remote buffer overflow in the usbip driver could be used by authenticated attackers to crash the kernel. (bsc#975945) - CVE-2016-2847: A local user could exhaust kernel memory by pushing lots of data into pipes. (bsc#970948). - CVE-2016-2188: A malicious USB device could cause kernel crashes in the iowarrior device driver (bnc#970956). - CVE-2016-3138: A malicious USB device could cause kernel crashes in the cdc-acm device driver (bnc#970911). The following non-security bugs were fixed: - af_unix: Guard against other == sk in unix_dgram_sendmsg (bsc#973570). - blktap: also call blkif_disconnect() when frontend switched to closed (bsc#952976). - blktap: refine mm tracking (bsc#952976). - cachefiles: Avoid deadlocks with fs freezing (bsc#935123). - cifs: Schedule on hard mount retry (bsc#941514). - cpuset: Fix potential deadlock w/ set_mems_allowed (bsc#960857, bsc#974646). - dcache: use IS_ROOT to decide where dentry is hashed (bsc#949752). - driver: Vmxnet3: Fix ethtool -S to return correct rx queue stats (bsc#950750). - drm/i915: Change semantics of hw_contexts_disabled (bsc#963276). - drm/i915: Evict CS TLBs between batches (bsc#758040). - drm/i915: Fix SRC_COPY width on 830/845g (bsc#758040). - e1000e: Do not read ICR in Other interrupt (bsc#924919). - e1000e: Do not write lsc to ics in msi-x mode (bsc#924919). - e1000e: Fix msi-x interrupt automask (bsc#924919). - e1000e: Remove unreachable code (bsc#924919). - ext3: fix data=journal fast mount/umount hang (bsc#942082). - ext3: NULL dereference in ext3_evict_inode() (bsc#942082). - firmware: Create directories for external firmware (bsc#959312). - firmware: Simplify directory creation (bsc#959312). - fs: Avoid deadlocks of fsync_bdev() and fs freezing (bsc#935123). - fs: Fix deadlocks between sync and fs freezing (bsc#935123). - ftdi_sio: private backport of TIOCMIWAIT (bnc#956375). - ipr: Fix incorrect trace indexing (bsc#940913). - ipr: Fix invalid array indexing for HRRQ (bsc#940913). - ipv6: make fib6 serial number per namespace (bsc#965319). - ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs (bsc#956852). - ipv6: per netns fib6 walkers (bsc#965319). - ipv6: per netns FIB garbage collection (bsc#965319). - ipv6: replace global gc_args with local variable (bsc#965319). - jbd: Fix unreclaimed pages after truncate in data=journal mode (bsc#961516). - kabi: protect struct netns_ipv6 after FIB6 GC series (bsc#965319). - kbuild: create directory for dir/file.o (bsc#959312). - kexec: Fix race between panic() and crash_kexec() called directly (bnc#937444). - lpfc: Fix null ndlp dereference in target_reset_handler (bsc#951392). - mld, igmp: Fix reserved tailroom calculation (bsc#956852). - mm-memcg-print-statistics-from-live-counters-fix (bnc#969307). - netfilter: xt_recent: fix namespace destroy path (bsc#879378). - nfs4: treat lock owners as opaque values (bnc#968141). - nfs: Fix handling of re-write-before-commit for mmapped NFS pages (bsc#964201). - nfs: use smaller allocations for 'struct id_map' (bsc#965923). - nfsv4: Fix two infinite loops in the mount code (bsc#954628). - nfsv4: Recovery of recalled read delegations is broken (bsc#956514). - panic/x86: Allow cpus to save registers even if they (bnc#940946). - panic/x86: Fix re-entrance problem due to panic on (bnc#937444). - pciback: do not allow MSI-X ops if PCI_COMMAND_MEMORY is not set. - pciback: for XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. - pciback: return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled. - pciback: return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled. - pci: Update VPD size with correct length (bsc#958906). - quota: Fix deadlock with suspend and quotas (bsc#935123). - rdma/ucma: Fix AB-BA deadlock (bsc#963998). - README.BRANCH: Switch to LTSS mode - Refresh patches.xen/xen3-08-x86-ldt-make-modify_ldt-synchronous.patch (bsc#959705). - Restore kabi after lock-owner change (bnc#968141). - s390/pageattr: Do a single TLB flush for change_page_attr (bsc#940413). - scsi_dh_rdac: always retry MODE SELECT on command lock violation (bsc#956949). - scsi: mpt2sas: Rearrange the the code so that the completion queues are initialized prior to sending the request to controller firmware (bsc#967863). - skb: Add inline helper for getting the skb end offset from head (bsc#956852). - sunrcp: restore fair scheduling to priority queues (bsc#955308). - sunrpc: refactor rpcauth_checkverf error returns (bsc#955673). - tcp: avoid order-1 allocations on wifi and tx path (bsc#956852). - tcp: fix skb_availroom() (bsc#956852). - tg3: 5715 does not link up when autoneg off (bsc#904035). - Update patches.fixes/mm-exclude-reserved-pages-from-dirtyable-memory-fix.patch (bnc#940017, bnc#949298, bnc#947128). - usb: ftdi_sio: fix race condition in TIOCMIWAIT, and abort of TIOCMIWAIT when the device is removed (bnc#956375). - usb: ftdi_sio: fix status line change handling for TIOCMIWAIT and TIOCGICOUNT (bnc#956375). - usb: ftdi_sio: fix tiocmget and tiocmset return values (bnc#956375). - usb: ftdi_sio: fix tiocmget indentation (bnc#956375). - usb: ftdi_sio: optimise chars_in_buffer (bnc#956375). - usb: ftdi_sio: refactor modem-control status retrieval (bnc#956375). - usb: ftdi_sio: remove unnecessary memset (bnc#956375). - usb: ftdi_sio: use ftdi_get_modem_status in chars_in_buffer (bnc#956375). - usb: ftdi_sio: use generic chars_in_buffer (bnc#956375). - usb: serial: export usb_serial_generic_chars_in_buffer (bnc#956375). - usb: serial: ftdi_sio: Add missing chars_in_buffer function (bnc#956375). - usbvision fix overflow of interfaces array (bnc#950998). - veth: extend device features (bsc#879381). - vfs: Provide function to get superblock and wait for it to thaw (bsc#935123). - vmxnet3: adjust ring sizes when interface is down (bsc#950750). - vmxnet3: fix building without CONFIG_PCI_MSI (bsc#958912). - vmxnet3: fix ethtool ring buffer size setting (bsc#950750). - vmxnet3: fix netpoll race condition (bsc#958912). - writeback: Skip writeback for frozen filesystem (bsc#935123). - x86/evtchn: make use of PHYSDEVOP_map_pirq. - x86, kvm: fix kvm's usage of kernel_fpu_begin/end() (bsc#961518). - x86, kvm: fix maintenance of guest/host xcr0 state (bsc#961518). - x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() (bsc#961518). - x86/mce: Fix return value of mce_chrdev_read() when erst is disabled (bsc#934787). - xen/panic/x86: Allow cpus to save registers even if they (bnc#940946). - xen/panic/x86: Fix re-entrance problem due to panic on (bnc#937444). - xen: x86: mm: drop TLB flush from ptep_set_access_flags (bsc#948330). - xen: x86: mm: only do a local tlb flush in ptep_set_access_flags() (bsc#948330). - xfrm: do not segment UFO packets (bsc#946122). - xhci: silence TD warning (bnc#939955). Important SUSE bug 758040 SUSE bug 781018 SUSE bug 879378 SUSE bug 879381 SUSE bug 904035 SUSE bug 924919 SUSE bug 934787 SUSE bug 935123 SUSE bug 937444 SUSE bug 939955 SUSE bug 940017 SUSE bug 940413 SUSE bug 940913 SUSE bug 940946 SUSE bug 941514 SUSE bug 942082 SUSE bug 946122 SUSE bug 947128 SUSE bug 948330 SUSE bug 949298 SUSE bug 949752 SUSE bug 949936 SUSE bug 950750 SUSE bug 950998 SUSE bug 951392 SUSE bug 952976 SUSE bug 954628 SUSE bug 955308 SUSE bug 955354 SUSE bug 955654 SUSE bug 955673 SUSE bug 956375 SUSE bug 956514 SUSE bug 956707 SUSE bug 956708 SUSE bug 956709 SUSE bug 956852 SUSE bug 956949 SUSE bug 957988 SUSE bug 957990 SUSE bug 958463 SUSE bug 958886 SUSE bug 958906 SUSE bug 958912 SUSE bug 958951 SUSE bug 959190 SUSE bug 959312 SUSE bug 959399 SUSE bug 959705 SUSE bug 960857 SUSE bug 961500 SUSE bug 961509 SUSE bug 961512 SUSE bug 961516 SUSE bug 961518 SUSE bug 963276 SUSE bug 963765 SUSE bug 963767 SUSE bug 963998 SUSE bug 964201 SUSE bug 965319 SUSE bug 965923 SUSE bug 966437 SUSE bug 966693 SUSE bug 967863 SUSE bug 967972 SUSE bug 967973 SUSE bug 967974 SUSE bug 967975 SUSE bug 968010 SUSE bug 968011 SUSE bug 968012 SUSE bug 968013 SUSE bug 968141 SUSE bug 968670 SUSE bug 969307 SUSE bug 970504 SUSE bug 970892 SUSE bug 970909 SUSE bug 970911 SUSE bug 970948 SUSE bug 970956 SUSE bug 970958 SUSE bug 970970 SUSE bug 971124 SUSE bug 971125 SUSE bug 971360 SUSE bug 973570 SUSE bug 974646 SUSE bug 975945 CVE-2013-7446 CVE-2015-7509 CVE-2015-7515 CVE-2015-7550 CVE-2015-7566 CVE-2015-7799 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8550 CVE-2015-8551 CVE-2015-8552 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2016-0723 CVE-2016-2069 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2782 CVE-2016-2847 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-3955 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - alsa/usb-audio: Add sanity checks for endpoint accesses (CVE-2016-2184,bsc#971125). - alsa/usb-audio: Fix NULL dereference in create_fixed_stream_quirk() (CVE-2016-2184,bsc#971125). - input/powermate: Fix oops with malicious USB descriptors (bsc#970958, CVE-2016-2186). - ipv4: Don't do expensive useless work during inetdev destroy (CVE-2016-3156, bsc#971360). - pipe: Limit the per-user amount of pages allocated in pipes (bsc#970948, CVE-2016-2847). - usb/cdc-acm: More sanity checking (bsc#970911, CVE-2016-3138). - usb/cypress_m8: Add endpoint sanity check (bsc#970970, CVE-2016-3137). - usb/digi_acceleport: Do sanity checking for the number of ports (bsc#970892, CVE-2016-3140). - usb: Fix invalid memory access in hub_activate() (bsc#968010, CVE-2015-8816). - usb/iowarrior: Fix oops with malicious USB descriptors (bsc#970956, CVE-2016-2188). - usb/usb_driver_claim_interface: Add sanity checking (bsc#971124, CVE-2016-2185). - usb/usbip: Fix potential out-of-bounds write (bsc#975945, CVE-2016-3955). - usb/visor: Fix null-deref at probe (bsc#968670, CVE-2016-2782). - wacom: Fix crash due to missing endpoint (bsc#970909, CVE-2016-3139). The NVMe driver was updated to the current SLE11-SP4 version, which includes the following fixes enhancements: - NVMe: Free cmdid on nvme_submit_bio error (bsc#913030, fate#317455, fate#320430). - NVMe: End queued bio requests when freeing queue (bsc#913030, fate#317455, fate#320430). - NVMe: Set result from user admin command (bsc#913030, fate#317455, fate#320430). - NVMe: Add result to nvme_get_features (bsc#913030, fate#317455, fate#320430). - NVMe: Define SMART log (bsc#913030, fate#317455, fate#320430). - NVMe: Initialize iod nents to 0 (bsc#913030, fate#317455, fate#320430). - NVMe: Add namespaces with no LBA range feature (bsc#913030, fate#317455, fate#320430). - NVMe: Add discard support for capable devices (bsc#913030, fate#317455, fate#320430). - NVMe: Rename nvme.c to nvme-core.c (bsc#913030, fate#317455, fate#320430). - NVMe: Move structures & definitions to header file (bsc#913030, fate#317455, fate#320430). - NVMe: Add definitions for format command (bsc#913030, fate#317455, fate#320430). - NVMe: Add nvme-scsi.c (bsc#913030, fate#317455, fate#320430). - NVMe: Use round_jiffies_relative() for the periodic, once-per-second (bsc#913030, fate#317455, fate#320430). - NVMe: Abstract out sector to block number conversion (bsc#913030, fate#317455, fate#320430). - NVMe: Don't fail initialisation unnecessarily (bsc#913030, fate#317455, fate#320430). - NVMe: Fix sparse warnings in scsi emulation (bsc#913030, fate#317455, fate#320430). - NVMe: Fix I/O cancellation status on big-endian machines (bsc#913030, fate#317455, fate#320430). - NVMe: Fix endian-related problems in user I/O submission path (bsc#913030, fate#317455, fate#320430). - NVMe: Add a character device for each nvme device (bsc#913030, fate#317455, fate#320430). - NVMe: Set TASK_INTERRUPTIBLE before processing queues (bsc#913030, fate#317455, fate#320430). - NVMe: Queue usage fixes in nvme-scsi (bsc#913030, fate#317455, fate#320430). - NVMe: Add scsi unmap to SG_IO (bsc#913030, fate#317455, fate#320430). - NVMe: Free admin queue on request_irq error (bsc#913030, fate#317455, fate#320430). - NVMe: Fix error clean-up on nvme_alloc_queue (bsc#913030, fate#317455, fate#320430). - NVMe: Check for NULL memory in nvme_dev_add (bsc#913030, fate#317455, fate#320430). - NVMe: Remove dead code in nvme_dev_add (bsc#913030, fate#317455, fate#320430). - NVMe: Split non-mergeable bio requests (bsc#913030, fate#317455, fate#320430). - NVMe: Device specific stripe size handling (bsc#913030, fate#317455, fate#320430). - NVMe: Meta-data support in NVME_IOCTL_SUBMIT_IO (bsc#913030, fate#317455, fate#320430). - NVMe: Schedule timeout for sync commands (bsc#913030, fate#317455, fate#320430). - NVMe: Wait for device to acknowledge shutdown (bsc#913030, fate#317455, fate#320430). - NVMe: Only clear the enable bit when disabling controller (bsc#913030, fate#317455, fate#320430). - NVMe: Simplify Firmware Activate code slightly (bsc#913030, fate#317455, fate#320430). - NVMe: Use user defined admin ioctl timeout (bsc#913030, fate#317455, fate#320430). - NVMe: Remove redundant version.h header include (bsc#913030, fate#317455, fate#320430). - NVMe: Fix a signedness bug in nvme_trans_modesel_get_mp (bsc#913030, fate#317455, fate#320430). - NVMe: Check for integer overflow in nvme_map_user_pages() (bsc#913030, fate#317455, fate#320430). - NVMe: Fix error return code in nvme_submit_bio_queue() (bsc#913030, fate#317455, fate#320430). - NVMe: Do not cancel command multiple times (bsc#913030, fate#317455, fate#320430). - NVMe: Use dma_set_mask() correctly (bsc#913030, fate#317455, fate#320430). - NVMe: Add MSI support (bsc#913030, fate#317455, fate#320430). - NVMe: Use kzalloc instead of kmalloc+memset (bsc#913030, fate#317455, fate#320430). - NVMe: Restructure MSI / MSI-X setup (bsc#913030, fate#317455, fate#320430). - NVMe: Disk IO statistics (bsc#913030, fate#317455, fate#320430). - NVMe: Return correct value from interrupt handler (bsc#913030, fate#317455, fate#320430). - NVMe: Remove "process_cq did something" message (bsc#913030, fate#317455, fate#320430). - NVMe: Call nvme_process_cq from submission path (bsc#913030, fate#317455, fate#320430). - NVMe: Split header file into user-visible and kernel-visible pieces (bsc#913030, fate#317455, fate#320430). - NVMe: Update nvme_id_power_state with latest spec (bsc#913030, fate#317455, fate#320430). - NVMe: Namespace IDs are unsigned (bsc#913030, fate#317455, fate#320430). - NVMe: Fix checkpatch issues (bsc#913030, fate#317455, fate#320430). - NVMe: Bring up cdev on set feature failure (bsc#913030, fate#317455, fate#320430). - NVMe: Disk stats for read/write commands only (bsc#913030, fate#317455, fate#320430). - NVMe: Group pci related actions in functions (bsc#913030, fate#317455, fate#320430). - NVMe: Separate queue alloc/free from create/delete (bsc#913030, fate#317455, fate#320430). - NVMe: Separate controller init from disk discovery (bsc#913030, fate#317455, fate#320430). - NVMe: Use normal shutdown (bsc#913030, fate#317455, fate#320430). - NVMe: Add pci suspend/resume driver callbacks (bsc#913030, fate#317455, fate#320430). - NVMe: Handle ioremap failure (bsc#913030, fate#317455, fate#320430). - NVMe: Merge issue on character device bring-up (bsc#913030, fate#317455, fate#320430). - DMA-API: block: nvme-core: replace (bsc#913030, fate#317455, fate#320430). - NVMe: Avoid shift operation when writing cq head doorbell (bsc#913030, fate#317455, fate#320430). - NVMe: Remove deprecated IRQF_DISABLED (bsc#913030, fate#317455, fate#320430). - NVMe: Compat SG_IO ioctl (bsc#913030, fate#317455, fate#320430). - NVMe: Fix lockdep warnings (bsc#913030, fate#317455, fate#320430). - NVMe: Cache dev->pci_dev in a local pointer (bsc#913030, fate#317455, fate#320430). - NVMe: Device resume error handling (bsc#913030, fate#317455, fate#320430). - NVMe: Schedule reset for failed controllers (bsc#913030, fate#317455, fate#320430). - NVMe: Abort timed out commands (bsc#913030, fate#317455, fate#320430). - NVMe: Surprise removal handling (bsc#913030, fate#317455, fate#320430). - NVMe: Async IO queue deletion (bsc#913030, fate#317455, fate#320430). - NVMe: Dynamically allocate partition numbers (bsc#913030, fate#317455, fate#320430). - NVMe: Disable admin queue on init failure (bsc#913030, fate#317455, fate#320430). - NVMe: Add a pci_driver shutdown method (bsc#913030, fate#317455, fate#320430). - NVMe: Include device and queue numbers in interrupt name (bsc#913030, fate#317455, fate#320430). - NVMe: Correct uses of INIT_WORK (bsc#913030, fate#317455, fate#320430). - NVMe: Namespace use after free on surprise removal (bsc#913030, fate#317455, fate#320430). - NVMe: Add CONFIG_PM_SLEEP to suspend/resume functions (bsc#913030, fate#317455, fate#320430). - NVMe: Initialize device reference count earlier (bsc#913030, fate#317455, fate#320430). - NVMe: RCU protected access to io queues (bsc#913030, fate#317455, fate#320430). - NVMe: IOCTL path RCU protect queue access (bsc#913030, fate#317455, fate#320430). - NVMe: Fix divide-by-zero in nvme_trans_io_get_num_cmds (bsc#913030, fate#317455, fate#320430). - NVMe: Replace DEFINE_PCI_DEVICE_TABLE (bsc#913030, fate#317455, fate#320430). - NVMe: Per-cpu io queues (bsc#913030, fate#317455, fate#320430). - NVMe: CPU hot plug notification (bsc#913030, fate#317455, fate#320430). - NVMe: Make I/O timeout a module parameter (bsc#913030, fate#317455, fate#320430). - NVMe: Start-stop nvme_thread during device add-remove (bsc#913030, fate#317455, fate#320430). - NVMe: Add getgeo to block ops (bsc#913030, fate#317455, fate#320430). - NVMe: Retry failed commands with non-fatal errors (bsc#913030, fate#317455, fate#320430). - NVMe: Update copyright headers (bsc#913030, fate#317455, fate#320430). - NVMe: Improve error messages (bsc#913030, fate#317455, fate#320430). - NVMe: Protect against badly formatted CQEs (bsc#913030, fate#317455, fate#320430). - NVMe: Configure support for block flush (bsc#913030, fate#317455, fate#320430). - NVMe: Enable BUILD_BUG_ON checks (bsc#913030, fate#317455, fate#320430). - NVMe: Fix the buffer size passed in GetLogPage(CDW10.NUMD) (bsc#913030, fate#317455, fate#320430). - NVMe: Prevent possible NULL pointer dereference (bsc#913030, fate#317455, fate#320430). - NVMe: Make iod bio timeout a parameter (bsc#913030, fate#317455, fate#320430). - NVMe: Make admin timeout a module parameter (bsc#913030, fate#317455, fate#320430). - NVMe: Delete NVME_GET_FEAT_TEMP_THRESH (bsc#913030, fate#317455, fate#320430). - NVMe: Fix nvme get/put queue semantics (bsc#913030, fate#317455, fate#320430). - NVMe: Adhere to request queue block accounting enable/disable (bsc#913030, fate#317455, fate#320430). - NVMe: Use last bytes of f/w rev SCSI Inquiry (bsc#913030, fate#317455, fate#320430). - NVMe: Rename io_timeout to nvme_io_timeout (bsc#913030, fate#317455, fate#320430). - NVMe: Fix hot cpu notification dead lock (bsc#913030, fate#317455, fate#320430). - NVMe: Define Log Page constants (bsc#913030, fate#317455, fate#320430). - NVMe: Use Log Page constants in SCSI emulation (bsc#913030, fate#317455, fate#320430). - NVMe: Fix START_STOP_UNIT Scsi->NVMe translation (bsc#913030, fate#317455, fate#320430). - NVMe: Async event request (bsc#913030, fate#317455, fate#320430). - NVMe: Update list of status codes (bsc#913030, fate#317455, fate#320430). - NVMe: Mismatched host/device page size support (bsc#913030, fate#317455, fate#320430). - NVMe: Change nvme_enable_ctrl to set EN and manage CC thru (bsc#913030, fate#317455, fate#320430). - NVMe: Handling devices incapable of I/O (bsc#913030, fate#317455, fate#320430). - NVMe: Skip orderly shutdown on failed devices (bsc#913030, fate#317455, fate#320430). - NVMe: Add shutdown timeout as module parameter (bsc#913030, fate#317455, fate#320430). - NVMe: Call nvme_free_queue directly (bsc#913030, fate#317455, fate#320430). - NVMe: Fix filesystem sync deadlock on removal (bsc#913030, fate#317455, fate#320430). - NVMe: Correctly handle IOCTL_SUBMIT_IO when cpus > online queues (bsc#913030, fate#317455, fate#320430). - NVMe: Replace rcu_assign_pointer() with RCU_INIT_POINTER() (bsc#913030, fate#317455, fate#320430). - NVMe: Reference count pci device (bsc#913030, fate#317455, fate#320430). - NVMe: Remove duplicate compat SG_IO code (bsc#913030, fate#317455, fate#320430). - NVMe: Fix SG_IO status values (bsc#913030, fate#317455, fate#320430). - NVMe: Translate NVMe status to errno (bsc#913030, fate#317455, fate#320430). - NVMe: Fix nvmeq waitqueue entry initialization (bsc#913030, fate#317455, fate#320430). - NVMe: Add revalidate_disk callback (bsc#913030, fate#317455, fate#320430). - NVMe: Passthrough IOCTL for IO commands (bsc#913030, fate#317455, fate#320430). - NVMe: Updates for 1.1 spec (bsc#913030, fate#317455, fate#320430). - NVMe: Fix device probe waiting on kthread (bsc#913030, fate#317455, fate#320430). - NVMe: Clear QUEUE_FLAG_STACKABLE (bsc#913030, fate#317455, fate#320430). - NVMe: Do not open disks that are being deleted (bsc#913030, fate#317455, fate#320430). - NVMe: Do not over allocate for discard requests (bsc#913030, fate#317455, fate#320430). - NVMe: Make setup work for devices that don't do INTx (bsc#913030, fate#317455, fate#320430). - NVMe: Fail pci initialization if the device doesn't have any BARs (bsc#913030, fate#317455, fate#320430). - NVMe: Return 0 from make request on ended bio (bsc#926480, fate#320430). - NVMe: Add tracepoints (bsc#926056, fate#320430). - NVMe: Flush with data support (bsc#926056, fate#320430). - NVMe: Update namespace and controller identify structures to the 1.1a spec (bsc#926056, fate#320430). - NVMe: Update data structures for NVMe 1.2 (bsc#926056, fate#320430). - NVMe: Update SCSI Inquiry VPD 83h translation (bsc#926056, fate#320430). - NVMe: Register management handle under nvme class (bsc#926056, fate#320430). - NVMe: Asynchronous controller probe (bsc#926056, fate#320430). - NVMe: Fix potential corruption during shutdown (bsc#926056, fate#320430). - NVMe: Fix potential corruption on sync commands (bsc#926056, fate#320430). - NVMe: Fix PRP list calculation for non-4k system page size (bsc#926056, fate#320430). - NVMe: Initialize device list head before starting (bsc#926056, fate#320430). - NVMe: Add translation for block limits (bsc#926056, fate#320430). - NVMe: Clear BIO_SEG_VALID flag in nvme_bio_split() (bsc#954992, fate#320430). - NVMe: default to 4k device page size (bsc#967042, fate#320430). - DMA-API: provide a helper to set both DMA and coherent DMA masks (bug#909498 fate#317395). - tty: Use lockless flip buffer free list (bsc#913030, fate#317455). The following bugs have been fixed: - Return ENODEV instead of EIO when device is removed with IO pending (bsc#963060). - af_unix: Guard against other == sk in unix_dgram_sendmsg (bsc#973570). - scsi_dh_alua: Do not block request queue if workqueue is active (bsc#960458). - xen/panic-handler: Only call the HV when we don't boot into a crash-kernel (bsc#973691). Important SUSE bug 913030 SUSE bug 926056 SUSE bug 926480 SUSE bug 954992 SUSE bug 960458 SUSE bug 963060 SUSE bug 967042 SUSE bug 968010 SUSE bug 968670 SUSE bug 970892 SUSE bug 970909 SUSE bug 970911 SUSE bug 970948 SUSE bug 970956 SUSE bug 970958 SUSE bug 970970 SUSE bug 971124 SUSE bug 971125 SUSE bug 971360 SUSE bug 973570 SUSE bug 973691 SUSE bug 975945 CVE-2015-8816 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2782 CVE-2016-2847 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-3955 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - ALSA/timer: Fix leak in events via snd_timer_user_ccallback (bsc#979213, CVE-2016-4569). - ALSA/timer: Fix leak in events via snd_timer_user_tinterrupt (bsc#979213, CVE-2016-4569). - ALSA/timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (bsc#979213, CVE-2016-4569). - ASN.1: Fix non-match detection failure on data overrun (bsc#963762, CVE-2016-2053). - ecryptfs: Don't allow mmap when the lower file system doesn't allow it (bsc#983143, CVE-2016-1583). - get_rock_ridge_filename(): Handle malformed NM entries (bsc#980725, CVE-2016-4913). - HID: hiddev: Validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (bsc#986572, CVE-2016-5829). - IB/security: Restrict use of the write() interface (bsc#979548, CVE-2016-4565). - Input/gtco: Fix crash on detecting device without endpoints (bsc#971944, CVE-2016-2187). - Input/gtco: Fix usb_dev leak (bsc#971944, CVE-2016-2187). - Input/gtco: Use sign_extend32() for sign extension (bsc#971944, CVE-2016-2187). - KEYS: Fix ASN.1 indefinite length object parsing (bsc#979867, CVE-2016-0758). - KEYS: Potential uninitialized variable (bsc#984755, CVE-2016-4470). - [media] usbvision: Fix crash on detecting device with invalid configuration (bsc#950998, CVE-2015-7833). - netfilter/x_tables: Fix unconditional helper (bsc#971126, CVE-2016-3134). - netfilter/x_tables: Make sure e->next_offset covers remaining blob size (bsc#971126, CVE-2016-3134). - netfilter/x_tables: Validate e->target_offset early (bsc#971126, CVE-2016-3134). - net: Fix a kernel infoleak in x25 module (bsc#981267, CVE-2016-4580). - net: Fix infoleak in llc (bsc#978821, CVE-2016-4485). - net: Fix infoleak in rtnetlink (bsc#978822, CVE-2016-4486). - ppp: Take reference on channels netns (bsc#980371, CVE-2016-4805). - rds: Fix an infoleak in rds_inc_info_copy (bsc#983213, CVE-2016-5244). - USB/usbfs: Fix potential infoleak in devio (bsc#978401, CVE-2016-4482). The following bugs have been fixed: - hrtimer: Remove HRTIMER_STATE_MIGRATE (bsc#981431). - ipv4/fib: Don't warn when primary address is missing if in_dev is dead (bsc#971360). - kexec: Export PG_hwpoison flag into vmcoreinfo (bsc#983544). Additionally, the following bug references have been added: - Update tags in two patches for CVE-2016-4578, bsc#979879 Important SUSE bug 950998 SUSE bug 963762 SUSE bug 971126 SUSE bug 971360 SUSE bug 971944 SUSE bug 978401 SUSE bug 978821 SUSE bug 978822 SUSE bug 979213 SUSE bug 979548 SUSE bug 979867 SUSE bug 979879 SUSE bug 980371 SUSE bug 980725 SUSE bug 981267 SUSE bug 981431 SUSE bug 983143 SUSE bug 983213 SUSE bug 983544 SUSE bug 984755 SUSE bug 986572 CVE-2015-7833 CVE-2016-0758 CVE-2016-1583 CVE-2016-2053 CVE-2016-2187 CVE-2016-3134 CVE-2016-4470 CVE-2016-4482 CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4805 CVE-2016-4913 CVE-2016-5244 CVE-2016-5829 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - aacraid: Check size values after double-fetch from user (CVE-2016-6480 bsc#991608). - aacraid: Prevent out-of-bounds access due to changing fip header sizes (bsc#991608, CVE-2016-6480). - kabi: Revert xt_compat_match_from_user signature change (CVE-2016-4997 bsc#986362). - kvm/x86: Reload pit counters for all channels when restoring state (bsc#960689 CVE-2015-7513). - netfilter/arp_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/ip6_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/ip_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Add and use xt_check_entry_offsets (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Add compat version of xt_check_entry_offsets (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Assert minimum target size (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Check for bogus target offset (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Check standard target size too (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Do compat validation via translate_table (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Don't move to non-existent next rule (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Don't reject valid target size on some architectures (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Kill check_entry helper (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Speed up jump target validation (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Validate all offsets and sizes in a rule (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Validate targets of jumps (CVE-2016-4997 bsc#986362). - netfilter/x_tables: xt_compat_match_from_user doesn't need a retval (CVE-2016-4997 bsc#986362). - scsi/arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (bsc#999932 CVE-2016-7425). - tcp: Fix use after free in tcp_xmit_retransmit_queue() (CVE-2016-6828 bsc#994296). - tcp: Make challenge acks less predictable (CVE-2016-5696 bsc#989152). - unix: Properly account for FDs passed over unix sockets (bsc#839104, CVE-2013-4312). Additionally the following non-security bugs have been fixed: - Add blist flags (fate#317533). - Add support for netvsc build without CONFIG_SYSFS flag (fate#317533). - clockevents: Export clockevents_config_and_register for module use (fate#317533). - Fix the VLAN_TAG_PRESENT in netvsc_recv_callback() (fate#317533). - flow_dissector: Add support for IPPROTO_IPV6 (fate#317533). - flow_dissector: Clean up IPIP case (fate#317533). - flow_dissector: Factor out the ports extraction in skb_flow_get_ports (fate#317533). - flow_dissector: Fail on evil iph->ihl (fate#317533). - flow_dissector: Fix thoff for IPPROTO_AH (fate#317533). - flow_dissector: Small optimizations in IPv4 dissect (fate#317533). - flow_dissector: Use a 64bit load/store (fate#317533). - flow_dissector: Use IPv6 flow label in flow_dissector (fate#317533). - flow_keys: Include thoff into flow_keys for later usage (fate#317533). - flow_keys: Record IP layer protocol in skb_flow_dissect() (fate#317533). - flow_keys: Remove extern from function prototypes (fate#317533). - hid/hyperv: Make sure input buffer is big enough (fate#317533). - hid/hyperv: Match wait_for_completion_timeout return type (fate#317533). - hid/hyperv: Register as a wakeup source (fate#317533). - hv/balloon: Make pressure posting thread sleep interruptibly (fate#317533). - hv/balloon: Ensure pressure reports are posted regularly (fate#317533). - hv: Change variable type to bool (fate#317533). - hv/channel: Match var type to return type of wait_for_completion (fate#317533). - hv/channel_mgmt: Match var type to return type of wait_for_completion (fate#317533). - hv: Check vmbus_device_create() return value in vmbus_process_offer() (fate#317533). - hv: Don't do hypercalls when hypercall_page is NULL. - hv: Eliminate the channel spinlock in the callback path (fate#317533). - hv: fcopy_open() can be static (fate#317533). - hv: Fix wrong check for synic_event_page (fate#317533). - hv/balloon: Avoid memory leak on alloc_error of 2MB memory block. - hv/balloon: Correctly handle num_pages>INT_MAX case (fate#317533). - hv/balloon: Correctly handle val.freeram<num_pages case (fate#317533). - hv/balloon: Do not online pages in offline blocks (fate#317533). - hv/balloon: Don't lose memory when onlining order is not natural (fate#317533). - hv/balloon: Don't post pressure status from interrupt context (fate#317533). - hv/balloon: Eliminate jumps in piecewiese linear floor function (fate#317533). - hv/balloon: Eliminate the trylock path in acquire/release_region_mutex (fate#317533). - hv/balloon: Fix a locking bug in the balloon driver (fate#317533). - hv/balloon: Keep locks balanced on add_memory() failure (fate#317533). - hv/balloon: Make adjustments in computing the floor (fate#317533). - hv/balloon: Match var type to return type of wait_for_completion (fate#317533). - hv/balloon: Refuse to balloon below the floor (fate#317533). - hv/balloon: Report offline pages as being used (fate#317533). - hv/balloon: Survive ballooning request with num_pages=0 (fate#317533). - hv/hv_fcopy: Drop the obsolete message on transfer failure (fate#317533). - hv/hv_fcopy: Fix a race condition for SMP guest (fate#317533). - hv/hv_util: Move vmbus_open() to a later place (fate#317533). - hv/hypervvssd: Call endmntent before call setmntent again (fate#317533). - hv: Implement the file copy service (fate#317533). - hv/kvp: Move poll_channel() to hyperv_vmbus.h. - hv/kvp,vss: Fast propagation of userspace communication failure. - hv: Make "monitor_pages" a "real" pointer array (fate#317533). - hv: Mark the function hv_synic_free_cpu() as static in hv.c (fate#317533). - hv_netvsc: Cleanup the test for freeing skb when we use sendbuf mechanism (fate#317533). - hv_netvsc: Convert to SKB paged frag API. - hv_netvsc: Include net/flow_keys.h (fate#317533). - hv_netvsc: Remove vmbus_are_subchannels_present() in rndis_filter_device_add() (fate#317533). - hv: Remove the per-channel workqueue (fate#317533). - hv: Remove unnecessary comparison of unsigned against 0 (fate#317533). - hv: Rename sc_lock to the more generic lock (fate#317533). - hv: Run non-blocking message handlers in the dispatch tasklet (fate#317533). - hv_storvsc: Use small sg_tablesize on x86 (bsc#937256). - hv: Use correct order when freeing monitor_pages (fate#317533). - hv/util: Make struct hv_do_fcopy match Hyper-V host messages. - hv/util: Move kvp/vss function declarations to hyperv_vmbus.h. - hv/util: On device remove, close the channel after de-initializing the service (fate#317533). - hv/util: Properly pack the data for file copy functionality. - hv/vmbus: Add gradually increased delay for retries in vmbus_post_msg() (fate#317533). - hv/vmbus: Add special crash handler (bsc#930770). - hv/vmbus: Add special kexec handler. - hv/vmbus: Add support for the NetworkDirect GUID (fate#317533). - hv/vmbus: Add support for VMBus panic notifier handler (fate#317533). - hv/vmbus: Avoid double kfree for device_obj (fate#317533). - hv/vmbus: Avoid scheduling in interrupt context in vmbus_initiate_unload() (bsc#986337). - hv/vmbus: Avoid wait_for_completion() on crash (bsc#986337). - hv/vmbus: Cleanup hv_post_message() (fate#317533). - hv/vmbus: Cleanup the packet send path (fate#317533). - hv/vmbus: Cleanup vmbus_close_internal() (fate#317533). - hv/vmbus: Cleanup vmbus_establish_gpadl() (fate#317533). - hv/vmbus: Cleanup vmbus_post_msg() (fate#317533). - hv/vmbus: Cleanup vmbus_teardown_gpadl() (fate#317533). - hv/vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY (fate#317533). - hv/vmbus: Don't loose HVMSG_TIMER_EXPIRED messages (bsc#986337). - hv/vmbus: Don't send CHANNELMSG_UNLOAD on pre-Win2012R2 hosts (bsc#986337). - hv/vmbus: Don't timeout during the initial connection with host (fate#317533). - hv/vmbus: Don't wait after requesting offers (fate#317533). - hv/vmbus: Enable interrupt driven flow control (fate#317533). - hv/vmbus: Export the vmbus_sendpacket_pagebuffer_ctl() (fate#317533). - hv/vmbus: Extract the mmio information from DSDT (fate#317533). - hv/vmbus: Fix a bug in channel rescind code (fate#317533). - hv/vmbus: Fix a bug in rescind processing in vmbus_close_internal() (fate#317533). - hv/vmbus: Fix a bug in the error path in vmbus_open() (fate#317533). - hv/vmbus: Fix a bug in vmbus_establish_gpadl() (fate#317533). - hv/vmbus: Fix a bug in vmbus_open() (fate#317533). - hv/vmbus: Fix a race condition when unregistering a device. - hv/vmbus: Fix a signaling host signaling issue (fate#317533). - hv/vmbus: Fix vmbus_recvpacket_raw() return code (fate#317533). - hv/vmbus: Get rid of some unnecessary messages (fate#317533). - hv/vmbus: Get rid of some unused definitions. - hv/vmbus: Handle both rescind and offer messages in the same context (fate#317533). - hv/vmbus: Handle various crash scenarios (bsc#986337). - hv/vmbus: hv_process_timer_expiration() can be static (fate#317533). - hv/vmbus: Implement a clockevent device (fate#317533). - hv/vmbus: Implement per-CPU mapping of relid to channel (fate#317533). - hv/vmbus: Implement the protocol for tearing down vmbus state. - hv/vmbus: Increase the limit on the number of pfns we can handle (fate#317533). - hv/vmbus: Introduce a function to remove a rescinded offer (fate#317533). - hv/vmbus: Kill tasklets on module unload. - hv/vmbus: Missing curly braces in vmbus_process_offer() (fate#317533). - hv/vmbus: Negotiate version 3.0 when running on ws2012r2 hosts (fate#317533). - hv/vmbus_open(): Reset the channel state on ENOMEM (fate#317533). - hv/vmbus: Perform device register in the per-channel work element (fate#317533). - hv/vmbus_post_msg: Retry the hypercall on some transient errors (fate#317533). - hv/vmbus: Prefer 'die' notification chain to 'panic'. - hv/vmbus: Prevent cpu offlining on newer hypervisors (fate#317533). - hv/vmbus: Properly handle child device remove (fate#317533). - hv/vmbus: Properly protect calls to smp_processor_id() (fate#317533). - hv/vmbus: Remove code duplication in message handling (bsc#986337). - hv/vmbus: Remove hv_synic_free_cpu() call from hv_synic_cleanup(). - hv/vmbus: Remove the channel from the channel list(s) on failure (fate#317533). - hv/vmbus: Rename channel work queues (fate#317533). - hv/vmbus: Serialize Offer and Rescind offer (fate#317533). - hv/vmbus: Specify the target CPU that should receive notification (fate#317533). - hv/vmbus: Support an API to send packet with additional - hv/vmbus: Support an API to send pagebuffers with additional control (fate#317533). - hv/vmbus: Support a vmbus API for efficiently sending page arrays (fate#317533). - hv/vmbus: Support per-channel driver state (fate#317533). - hv/vmbus: Teardown clockevent devices on module unload (fate#317533). - hv/vmbus: Teardown hv_vmbus_con workqueue and vmbus_connection pages on shutdown (fate#317533). - hv/vmbus: Teardown synthetic interrupt controllers on module unload (fate#317533). - hv/vmbus: Unregister panic notifier on module unload. - hv/vmbus: Use a round-robin algorithm for picking the outgoing channel (fate#317533). - hv/vmbus: Use get_cpu() to get the current CPU (fate#317533). - hv/vss: Introduce timeout for communication with userspace. - hv/vss: Run only on supported host versions (bsc#986337). - hyperv: Add handler for RNDIS_STATUS_NETWORK_CHANGE event (fate#317533). - hyperv: Add handling of IP header with option field in netvsc_set_hash() (fate#317533). - hyperv: Add hash value into RNDIS Per-packet info (fate#317533). - hyperv: Add IPv6 into the hash computation for vRSS (fate#317533). - hyperv: Add latest NetVSP versions to auto negotiation (fate#317533). - hyperv: Add netpoll support (fate#317533). - hyperv: Add processing of MTU reduced by the host. - hyperv: Add support for physically discontinuous receive buffer (fate#317533). - hyperv: Add support for virtual Receive Side Scaling (vRSS) (fate#317533). - hyperv: Add support for vNIC hot removal. - hyperv: Adjust the size of sendbuf region to support ws2008r2 (fate#317533). - hyperv: Change the receive buffer size for legacy hosts (fate#317533). - hyperv: Enable sendbuf mechanism on the send path (fate#317533). - hyperv-fb: Add blanking support (fate#317533). - hyperv-fb: Add pci stub (fate#317533). - hyperv-fb: Add support for generation 2 virtual machines (fate#317533). - hyperv-fb: Kick off efifb early (fate#317533). - hyperv: Fix a bug in netvsc_send() (fate#317533). - hyperv: Fix a bug in netvsc_start_xmit() (fate#317533). - hyperv: Fix apparent cut-n-paste error in send path teardown (fate#317533). - hyperv: Fix error return code in netvsc_init_buf() (fate#317533). - hyperv: Fix race between probe and open calls (fate#317533). - hyperv: Fix some variable name typos in send-buffer init/revoke (fate#317533). - hyperv: Fix sparse warnings (fate#317533). - hyperv: Fix the carrier status setting (fate#317533). - hyperv: Fix the error processing in netvsc_send() (fate#317533). - hyperv: Fix the total_data_buflen in send path (fate#317533). - hyperv: Fix vlan_proto setting in netvsc_recv_callback() (fate#317533). - hyperv/hyperv_fb: Match wait_for_completion_timeout return type (fate#317533). - hyperv: Implement netvsc_get_channels() ethtool op (fate#317533). - hyperv: Increase the buffer length for netvsc_channel_cb() (fate#317533). - hyper-v: Make uuid_le const (fate#317533). - hyperv: Match wait_for_completion_timeout return type (fate#317533). - hyperv: Move state setting for link query (fate#317533). - hyperv: Negotiate version with the host without waiting for the daemon (bsc#930821). - hyperv/netvsc: Match wait_for_completion_timeout return type (fate#317533). - hyperv: NULL dereference on error (fate#317533). - hyperv: Properly handle checksum offload (fate#317533). - hyperv: Remove meaningless pr_err() in vmbus_recvpacket_raw() (fate#317533). - hyperv: Remove recv_pkt_list and lock (fate#317533). - hyperv: Simplify the send_completion variables (fate#317533). - input: Add a driver to support Hyper-V synthetic keyboard (fate#317533). - input/hyperv-keyboard: Pass through 0xE1 prefix (fate#317533). - input/hyperv-keyboard: Register as a wakeup source (fate#317533). - ip: Introduce ip_is_fragment helper inline function (fate#317533). - ipv6: Add ip6_flowlabel helper (fate#317533). - ipv6: Add ipv6_addr_hash() helper (fate#317533). - ipv6: Optimize ipv6 addresses compares (fate#317533). - kabi: Imported SLE11-SP4 HyperV code has changed kABI in several places. Regenerate it. (bsc#986337) - kabi/unix: Properly account for FDs passed over unix sockets (bsc#839104). - kaweth: Fix firmware download (bsc#993890). - kaweth: Fix oops upon failed memory allocation (bsc#993890). - kdump: Fix crash_kexec()/smp_send_stop() race in panic() (bsc#937444). - kexec: Fix race between panic() and crash_kexec() called directly (bsc#937444). - kvm/x86: SYSENTER emulation is broken (bsc#994618). - mshyperv: Fix recognition of Hyper-V guest crash MSR's (bsc#986337). - net: Add function to set the rxhash (fate#317533). - net: Add skb frag size accessors. - net: Add skb_get_hash_raw (fate#317533). - net: Add utility functions to clear rxhash (fate#317533). - net/hyperv: Address UDP checksum issues (fate#317533). - net/hyperv: Allocate memory for all possible per-packet information (fate#317533). - net/hyperv: Cleanup the netvsc receive callback function (fate#317533). - net/hyperv: Cleanup the receive path (fate#317533). - net/hyperv: Cleanup the send path (fate#317533). - net/hyperv: Deletion of an unnecessary check before the function call "vfree". - net/hyperv: Enable large send offload (fate#317533). - net/hyperv: Enable offloads on the host (fate#317533). - net/hyperv: Enable receive side IP checksum offload (fate#317533). - net/hyperv: Enable scatter gather I/O (fate#317533). - net/hyperv: Enable send side checksum offload (fate#317533). - net/hyperv: Get rid of the rndis_filter_packet structure (fate#317533). - net/hyperv: Increase the size of the sendbuf region (fate#317533). - net/hyperv: Negotiate suitable ndis version for offload support (fate#317533). - net/hyperv: Remove unnecessary null test before kfree (fate#317533). - net: Introduce skb_flow_dissect() (fate#317533). - net: Reset mac header in dev_start_xmit(). - netvsc: Don't flush peers notifying work during setting mtu (fate#317533). - panic/x86: Allow cpus to save registers even if they (bsc#940946). - panic/x86: Fix re-entrance problem due to panic on (bsc#937444). - pci: Disable Bus Master only on kexec reboot (bsc#920110). - pci: Disable Bus Master on PCI device shutdown (bsc#920110). - pci: Disable Bus Master unconditionally in pci_device_shutdown() (bsc#920110). - pci: Don't try to disable Bus Master on disconnected PCI devices (bsc#920110). - ppp: Defer netns reference release for ppp channel (bsc#980371). - random32: Add prandom_u32_max (bsc#989152). - rps: Add flag to skb to indicate rxhash is based on L4 tuple (fate#317533). - sched: Replace INIT_COMPLETION with reinit_completion (fate#317533). - scsi: Add a blacklist flag which enables VPD page inquiries (fate#317533). - scsi/scan: Restrict sequential scan to 256 LUNs (fate#317533). - scsi/storvsc: Always send on the selected outgoing channel (fate#317533). - scsi/storvsc: Change the limits to reflect the values on the host (fate#317533). - scsi/storvsc: Correctly handle TEST_UNIT_READY failure (fate#317533). - scsi/storvsc: Don't assume that the scatterlist is not chained (fate#317533 bsc#923775). - scsi/storvsc: Filter commands based on the storage protocol version (fate#317533). - scsi/storvsc: Fix a bug in copy_from_bounce_buffer() (fate#317533 bsc#923775). - scsi/storvsc: Fix a bug in handling VMBUS protocol version (fate#317533). - scsi/storvsc: Implement a eh_timed_out handler (fate#317533). - scsi/storvsc: Increase the ring buffer size (fate#317533). - scsi/storvsc: Retrieve information about the capability of the target (fate#317533). - scsi/storvsc: Set cmd_per_lun to reflect value supported by the Host (fate#317533). - scsi/storvsc: Set srb_flags in all cases (fate#317533). - scsi/storvsc: Set the tablesize based on the information given by the host (fate#317533 bsc#923775). - scsi/storvsc: Size the queue depth based on the ringbuffer size (fate#317533). - storvsc: Fix a bug in storvsc limits (fate#317533). - storvsc: Force discovery of LUNs that may have been removed (fate#317533). - storvsc: Force SPC-3 compliance on win8 and win8 r2 hosts (fate#317533). - storvsc: Get rid of overly verbose warning messages (fate#317533). - storvsc: In response to a scan event, scan the host (fate#317533). - storvsc: Set the SRB flags correctly when no data transfer is needed (bsc#931130). - tools/hv: Address compiler warnings for hv_fcopy_daemon.c (fate#317533). - tools/hv: Address compiler warnings for hv_kvp_daemon.c (fate#317533). - tools/hv: Cache FQDN in kvp_daemon to avoid timeouts (fate#317533). - tools/hv: Do not add redundant '/' in hv_start_fcopy() (fate#317533). - tools/hv: Fix file overwriting of hv_fcopy_daemon (fate#317533). - tools/hv: Handle the case when the target file exists correctly (fate#317533). - tools/hv: Ignore ENOBUFS and ENOMEM in the KVP daemon. - tools/hv: Introduce -n/--no-daemon option. - tools/hv/kvp_daemon: Make IPv6-only-injection work (fate#317533). - tools/hv: Remove inclusion of linux/types.h (fate#317533). - tools/hv: Remove unused bytes_written from kvp_update_file() (fate#317533). - tools/hv: Use single send+recv buffer (fate#317533). - tools/hv/vssdaemon: Ignore the EBUSY on multiple freezing the same partition. - tools/hv/vssdaemon: Ignore VFAT mounts during the Freeze operation (fate#317533). - usb: Fix typo in wMaxPacketSize validation (bsc#991665). - usb: Validate wMaxPacketValue entries in endpoint descriptors (bsc#991665). - video/hyperv: Refresh the VM screen by force on VM panic (fate#317533). - vmbus: Add missing breaks (fate#317533). - vmbus: Use resource for hyperv mmio region (fate#317533). - Workaround for disks that report bad optimal transfer length (fate#317533). - x86/apic: Allow use of lapic timer early calibration result (fate#317533). - x86/hyperv: Bypass the timer_irq_works() check (fate#317533). - x86/hyperv: Correctly guard the local APIC calibration code (fate#317533). - x86/hyperv: Fix build error due to missing <asm/apic.h> include (fate#317533). - x86/hyperv: Get the local APIC timer frequency from the hypervisor (fate#317533). - x86/hyperv: Mark the Hyper-V clocksource as being continuous (fate#317533). - x86/hyperv: Move a variable to avoid an unused variable warning (fate#317533). - x86/irq, pic: Probe for legacy PIC and set legacy_pic appropriately (fate#317533). - x86/mm: Create slow_virt_to_phys() (fate#317533). - x86/mm: Pagetable level size/shift/mask helpers (fate#317533). - x86/pageattr: Prevent overflow in slow_virt_to_phys() for X86_PAE (fate#317533, bsc#937256). - xen/panic/x86: Allow cpus to save registers even if they (bsc#940946). - xen/panic/x86: Fix re-entrance problem due to panic on (bsc#937444). Important SUSE bug 839104 SUSE bug 920110 SUSE bug 923775 SUSE bug 930770 SUSE bug 930821 SUSE bug 931130 SUSE bug 937256 SUSE bug 937444 SUSE bug 940946 SUSE bug 960689 SUSE bug 980371 SUSE bug 986337 SUSE bug 986362 SUSE bug 986365 SUSE bug 989152 SUSE bug 991608 SUSE bug 991665 SUSE bug 993890 SUSE bug 994296 SUSE bug 994618 SUSE bug 999932 CVE-2013-4312 CVE-2015-7513 CVE-2016-4997 CVE-2016-5696 CVE-2016-6480 CVE-2016-6828 CVE-2016-7425 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix one security issue. This kernel reverts the changes introduced by the last kernel update (bsc#1005199). This security bug was fixed: - CVE-2016-5195: Local privilege escalation using MAP_PRIVATE. It is reportedly exploited in the wild (bsc#1004418). Important SUSE bug 1004418 SUSE bug 1005199 CVE-2016-5195 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - aacraid: Check size values after double-fetch from user (CVE-2016-6480 bsc#991608). - aacraid: Prevent out-of-bounds access due to changing fip header sizes (bsc#991608, CVE-2016-6480). - bluetooth: Fix potential NULL dereference in RFCOMM bind callback (bsc#1003925, CVE-2015-8956). - cdc-acm: Added sanity checking for probe() (bsc#993891). - kabi: Revert xt_compat_match_from_user signature change (CVE-2016-4997 bsc#986362). - kaweth: Fix firmware download (bsc#993890). - kaweth: Fix oops upon failed memory allocation (bsc#993890). - kvm/x86: Fix SYSENTER emulation (bsc#994618 CVE-2015-0239). - kvm/x86: Reload pit counters for all channels when restoring state (bsc#960689 CVE-2015-7513). - netfilter/arp_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/ip6_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/ip_tables: Simplify translate_compat_table args (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Add and use xt_check_entry_offsets (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Add compat version of xt_check_entry_offsets (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Assert minimum target size (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Check for bogus target offset (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Check standard target size too (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Do compat validation via translate_table (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Don't move to non-existent next rule (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Don't reject valid target size on some architectures (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Kill check_entry helper (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Speed up jump target validation (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Validate all offsets and sizes in a rule (CVE-2016-4997 bsc#986362). - netfilter/x_tables: Validate targets of jumps (CVE-2016-4997 bsc#986362). - netfilter/x_tables: xt_compat_match_from_user doesn't need a retval (CVE-2016-4997 bsc#986362). - net: Fix use after free in the recvmmsg exit path (CVE-2016-7117 bsc#1003077). - pagemap: Do not leak physical addresses to non-privileged userspace (bsc#994759 CVE-2016-0823). - ppp: defer netns reference release for ppp channel (bsc#980371 CVE-2016-4805). - scsi/arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (bsc#999932 CVE-2016-7425). - tcp: Fix use after free in tcp_xmit_retransmit_queue() (CVE-2016-6828 bsc#994296). - tcp: Make challenge acks less predictable (CVE-2016-5696 bsc#989152). - unix: Properly account for FDs passed over unix sockets (bsc#839104, CVE-2013-4312). - usb: Fix typo in wMaxPacketSize validation (bsc#991665). - usb: Validate wMaxPacketValue entries in endpoint descriptors (bsc#991665). Additionally the following non-security bugs have been fixed: - Backport HyperV drivers from 11-SP4 (fate#317533, bsc#986337). - kdump: Fix crash_kexec()/smp_send_stop() race in panic() (bsc#937444). - kexec: Fix race between panic() and crash_kexec() called directly (bsc#937444). - mm: Fix sleeping function warning from __put_anon_vma (bsc#1005857). - panic/x86: Allow cpus to save registers even if they (bsc#940946). - panic/x86: Fix re-entrance problem due to panic on (bsc#937444). - pci: Disable Bus Master only on kexec reboot (bsc#920110). - pci: Disable Bus Master on PCI device shutdown (bsc#920110). - pci: Disable Bus Master unconditionally in pci_device_shutdown() (bsc#920110). - pci: Don't try to disable Bus Master on disconnected PCI devices (bsc#920110). - xen/panic/x86: Allow cpus to save registers even if they (bsc#940946). - xen/panic/x86: Fix re-entrance problem due to panic on (bsc#937444). Important SUSE bug 1003077 SUSE bug 1003925 SUSE bug 1005857 SUSE bug 839104 SUSE bug 920110 SUSE bug 923775 SUSE bug 930770 SUSE bug 930821 SUSE bug 931130 SUSE bug 937256 SUSE bug 937444 SUSE bug 940946 SUSE bug 960689 SUSE bug 967716 SUSE bug 980371 SUSE bug 986337 SUSE bug 986362 SUSE bug 986365 SUSE bug 989152 SUSE bug 991608 SUSE bug 991665 SUSE bug 993890 SUSE bug 993891 SUSE bug 994296 SUSE bug 994618 SUSE bug 994759 SUSE bug 999932 CVE-2013-4312 CVE-2015-0239 CVE-2015-7513 CVE-2015-8956 CVE-2016-0823 CVE-2016-4805 CVE-2016-4997 CVE-2016-5696 CVE-2016-6480 CVE-2016-6828 CVE-2016-7117 CVE-2016-7425 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issue has been fixed: - KEYS: Fix short sprintf buffer in /proc/keys show function (bsc#1004517, CVE-2016-7042). Additionally the following non-security bugs have been fixed: - net: sched: Shrink struct qdisc_skb_cb to 28 bytes (bsc#919482). - IB/iser: Replace connection waitqueue with completion object (bsc#997801). - IB/iser: Protect iser state machine with a mutex (bsc#997801). - IB/iser: Simplify connection management (bsc#997801). - IB/iser: Fix device removal flow (bsc#997801). Important SUSE bug 1004517 SUSE bug 919482 SUSE bug 997801 CVE-2016-7042 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix the following issues: - alsa/pcm: Call kill_fasync() in stream lock (CVE-2016-9794 bsc#1013533). - block: Fix use-after-free in seq file (CVE-2016-7910 bsc#1010716). - block: Fix use-after-free in sys_ioprio_get() (CVE-2016-7911 bsc#1010711). - crypto/algif_hash: Only export and import on sockets with data (CVE-2016-8646,bsc#1010150). - firewire/net: Guard against rx buffer overflows (bsc#1008833, CVE-2016-8633). - fs: Avoid premature clearing of capabilities (bsc#914939 CVE-2015-1350). - fs: Give dentry to inode_change_ok() instead of inode (bsc#914939 CVE-2015-1350). - hv: Avoid vfree() on crash (bsc#1012471). - hv_storvsc: Set sg_tablesize to BIO_MAX_PAGES (bsc#1010208). - ipv6: Add complete rcu protection around np->opt (bsc#992566, CVE-2016-3841). - ipv6/sctp: Clone options to avoid use after free (bsc#992566, CVE-2016-3841). - ipv6/tcp: Add rcu locking in tcp_v6_send_synack() (bsc#992566, CVE-2016-3841). - mremap: Enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma() (bsc#1008645). - sctp: Validate chunk len before actually using it (CVE-2016-9555 bsc#1011685). - sg: Fix double-free when drives detach during SG_IO (CVE-2015-8962 bsc#1010501). - splice: Introduce FMODE_SPLICE_READ and FMODE_SPLICE_WRITE (CVE-2016-9576, bsc#1013604). - tty: Prevent ldisc drivers from re-using stale tty fields (bsc#1010507 CVE-2015-8964). - xfs: Fix two memory leaks in xfs_attr_list.c error paths (bsc#1012832, CVE-2016-9685). - xfs: Propagate dentry down to inode_change_ok() (bsc#914939 CVE-2015-1350). Important SUSE bug 1008645 SUSE bug 1008833 SUSE bug 1010150 SUSE bug 1010208 SUSE bug 1010501 SUSE bug 1010507 SUSE bug 1010711 SUSE bug 1010716 SUSE bug 1011685 SUSE bug 1012471 SUSE bug 1012832 SUSE bug 1013533 SUSE bug 1013604 SUSE bug 914939 SUSE bug 992566 CVE-2015-1350 CVE-2015-8962 CVE-2015-8964 CVE-2016-3841 CVE-2016-7910 CVE-2016-7911 CVE-2016-8633 CVE-2016-8646 CVE-2016-9555 CVE-2016-9576 CVE-2016-9685 CVE-2016-9794 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032). - CVE-2017-5753: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. - CVE-2017-5715: Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753. This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries. Please contact your CPU / hardware vendor for potential microcode or BIOS updates needed for this fix. As this feature can have a performance impact, it can be disabled using the "nospec" kernel commandline option. - CVE-2017-5754: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753. This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called "KAISER". The terms used here are "KAISER" / "Kernel Address Isolation" and "PTI" / "Page Table Isolation". This feature is disabled on unaffected architectures. This feature can be enabled / disabled by the "pti=[on|off|auto]" or "nopti" commandline options. The following security bugs were fixed: - CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel (BlueZ) was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space (bnc#1057389). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1063667). - CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer was fixed. (bnc#1072876). - CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982). - CVE-2017-14140: The move_pages system call in mm/migrate.c in the Linux kernel didn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR (bnc#1057179). - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel did not verify that a filesystem has a realtime device, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory (bnc#1058524). - CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-15274: security/keys/keyctl.c in the Linux kernel did not consider the case of a NULL payload in conjunction with a nonzero length value, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192 (bnc#1045327). - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470). - CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618). - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625). - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650). - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671). - CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693). - CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569). - CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702 1069708). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695 1074033). - CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561). - CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792). - CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874). - CVE-2017-7472: The KEYS subsystem in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The following non-security bugs were fixed: - asm alternatives: remove incorrect alignment notes. - getcwd: Close race with d_move called by lustre (bsc#1052593). - kabi: silence spurious kabi error in net/sctp/socket.c (bsc#1068671). - kaiser: add "nokaiser" boot option, using ALTERNATIVE. - kaiser: fix ldt freeing. - kaiser: Kernel Address Isolation. - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush. - kaiser: work around kABI. - kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032). - kvm: x86: Add speculative control CPUID support for guests (bsc#1068032). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mm/mmu_context, sched/core: Fix mmu_context.h assumption. - nfs: Remove asserts from the NFS XDR code (bsc#1063544). - ptrace: Add a new thread access check (bsc#1068032). - Revert "mac80211: accept key reinstall without changing anything" This reverts commit 1def0d4e1446974356bacd9f4be06eee32b66473. - s390: add ppa to system call and program check path (bsc#1068032). - s390: introduce CPU alternatives (bsc#1068032). - s390/spinlock: add gmb memory barrier (bsc#1068032). - sched/core: Add switch_mm_irqs_off() and use it in the scheduler. - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off(). - scsi: mpt2sas: fix cleanup on controller resource mapping failure (bsc#999245). - tcp: fix inet6_csk_route_req() for link-local addresses (bsc#1010175). - tcp: pass fl6 to inet6_csk_route_req() (bsc#1010175). - tcp: plug dst leak in tcp_v6_conn_request() (bsc#1010175). - tcp: use inet6_csk_route_req() in tcp_v6_send_synack() (bsc#1010175). - temporary fix (bsc#1068032). - usb: uas: fix bug in handling of alternate settings (bsc#1071074). - x86-64: Give vvars their own page. - x86-64: Map the HPET NX. - x86/alternatives: Add instruction padding. - x86/alternatives: Cleanup DPRINTK macro. - x86/alternatives: Make JMPs more robust. - x86/alternatives: Use optimized NOPs for padding. - x86/boot: Add early cmdline parsing for options with arguments. - x86, boot: Carve out early cmdline parsing function. - x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032). - x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032). - x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032). - x86/CPU: Check speculation control CPUID bit (bsc#1068032). - x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032). - x86/entry: Add a function to overwrite the RSB (bsc#1068032). - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032). - x86/entry: Use IBRS on entry to kernel space (bsc#1068032). - x86/feature: Enable the x86 feature to control Speculation (bsc#1068032). - x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032). - x86/idle: Toggle IBRS when going idle (bsc#1068032). - x86/kaiser: Check boottime cmdline params. - x86/kaiser: disable vmstat accounting. - x86/kaiser: Move feature detection up (bsc#1068032). - x86/kaiser: propagate info to /proc/cpuinfo. - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling. - x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032). - x86/kvm: Flush IBP when switching VMs (bsc#1068032). - x86/kvm: Pad RSB on VM transition (bsc#1068032). - x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032). - x86: Make alternative instruction pointers relative. - x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032). - x86/mm/64: Fix reboot interaction with CR4.PCIDE. - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID. - x86/mm: Add INVPCID helpers. - x86/mm: Add the 'nopcid' boot option to turn off PCID. - x86/mm: Build arch/x86/mm/tlb.c even on !SMP. - x86/mm: Disable PCID on 32-bit kernels. - x86/mm: Enable CR4.PCIDE on supported systems. - x86/mm: fix bad backport to disable PCID on Xen. - x86/mm: Fix INVPCID asm constraint. - x86/mm: If INVPCID is available, use it to flush global mappings. - x86/mm/kaiser: re-enable vsyscalls. - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032). - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code. - x86/mm, sched/core: Turn off IRQs in switch_mm(). - x86/mm, sched/core: Uninline switch_mm(). - x86/mm: Set IBPB upon context switch (bsc#1068032). - x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032). - x86/spec: Add IBRS control functions (bsc#1068032). - x86/spec: Add "nospec" chicken bit (bsc#1068032). - x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032). - x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032). - x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032). - x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032). - x86/svm: Add code to clear registers on VM exit (bsc#1068032). - x86/svm: Clobber the RSB on VM exit (bsc#1068032). - x86/svm: Set IBPB when running a different VCPU (bsc#1068032). - x86/svm: Set IBRS value on VM entry and exit (bsc#1068032). - xen/kaiser: add "nokaiser" boot option, using ALTERNATIVE. - xen/KAISER: Kernel Address Isolation. - xen/kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush. - xen/kaiser: work around kABI. - xen/x86-64: Give vvars their own page. - xen/x86-64: Map the HPET NX. - xen/x86/alternatives: Add instruction padding. - xen/x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling. - xen/x86/mm: Enable CR4.PCIDE on supported systems. - xen/x86/mm/kaiser: re-enable vsyscalls. - xen/x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code. - xen: x86/mm, sched/core: Turn off IRQs in switch_mm(). - xen: x86/mm, sched/core: Uninline switch_mm(). Important SUSE bug 1010175 SUSE bug 1034862 SUSE bug 1045327 SUSE bug 1050231 SUSE bug 1052593 SUSE bug 1056982 SUSE bug 1057179 SUSE bug 1057389 SUSE bug 1058524 SUSE bug 1062520 SUSE bug 1063544 SUSE bug 1063667 SUSE bug 1066295 SUSE bug 1066472 SUSE bug 1066569 SUSE bug 1066573 SUSE bug 1066606 SUSE bug 1066618 SUSE bug 1066625 SUSE bug 1066650 SUSE bug 1066671 SUSE bug 1066693 SUSE bug 1066700 SUSE bug 1066705 SUSE bug 1067085 SUSE bug 1068032 SUSE bug 1068671 SUSE bug 1069702 SUSE bug 1069708 SUSE bug 1070771 SUSE bug 1071074 SUSE bug 1071470 SUSE bug 1071695 SUSE bug 1072561 SUSE bug 1072876 SUSE bug 1073792 SUSE bug 1073874 SUSE bug 1074033 SUSE bug 999245 CVE-2017-1000251 CVE-2017-11600 CVE-2017-13080 CVE-2017-13167 CVE-2017-14106 CVE-2017-14140 CVE-2017-14340 CVE-2017-15102 CVE-2017-15115 CVE-2017-15265 CVE-2017-15274 CVE-2017-15868 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16534 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16538 CVE-2017-16649 CVE-2017-16939 CVE-2017-17450 CVE-2017-17558 CVE-2017-17805 CVE-2017-17806 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7472 CVE-2017-8824 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - crypto/lrw: Protect gf128mul from NULL pointers. (bsc#1008374, CVE-2015-8970) - kvm: x86: Drop error recovery in em_jmp_far and em_ret_far. (bsc#1013038, CVE-2016-9756) - net: Avoid signed overflows for SO_{SND|RCV}BUFFORCE. (bsc#1013531, CVE-2016-9793) - net: Cleanups in sock_setsockopt(). (bsc#1013542, CVE-2012-6704) - net/ping: Check minimum size on ICMP header length. (bsc#1014746, CVE-2016-8399) - posix_acl: Clear SGID bit when setting file permissions. (bsc#995968, CVE-2016-7097) - sg_write()/bsg_write() is not fit to be called under KERNEL_DS. (bsc#1017710, CVE-2016-10088) - tmpfs: Clear S_ISGID when setting posix ACLs. (bsc#1021258, CVE-2017-5551) Additionally the following non-security bugs have been fixed: - hv: Define the channel type for Hyper-V PCI Express pass-through. (bsc#1018385) - hv: Export a function that maps Linux CPU num onto Hyper-V proc num. (bsc#1018385) - hv: Export the API to invoke a hypercall on Hyper-V. (bsc#1018385) - hv: Remove code duplication between vmbus_recvpacket()/vmbus_recvpacket_raw(). (bsc#1018385) - hv: vmbus_free_channels(): Remove the redundant free_channel(). (bsc#1018385) - hv/netvsc: Allocate the receive buffer from the correct NUMA node. (bsc#1018385) - hv/netvsc: Allocate the sendbuf in a NUMA aware way. (bsc#1018385) - hv/ring_buffer: Eliminate hv_ringbuffer_peek(). (bsc#1018385) - hv/ring_buffer: Fix comment style. (bsc#1018385) - hv/ring_buffer: Remove code duplication from hv_ringbuffer_peek/read(). (bsc#1018385) - hv/vmbus: Add vendor and device attributes. (bsc#1018385) - hv/vmbus: Allocate ring buffer memory in NUMA aware fashion. (bsc#1018385) - hv/vmbus: Avoid infinite loop in init_vp_index(). (bsc#986337) - hv/vmbus: Base host signaling strictly on the ring state. (bsc#1018385) - hv/vmbus: Briefly comment num_sc and next_oc. (bsc#1018385) - hv/vmbus: Change vmbus_connection.channel_lock to mutex. (bsc#1018385) - hv/vmbus: Cleanup vmbus_set_event(). (bsc#1018385) - hv/vmbus: Consider ND NIC in binding channels to CPUs. (bsc#1018385) - hv/vmbus: Decrease num_sc on subchannel removal. (bsc#1018385) - hv/vmbus: Define a new VMBus message type for hvsock. (bsc#1018385) - hv/vmbus: Define the new offer type for Hyper-V socket (hvsock). (bsc#1018385) - hv/vmbus: Distribute subchannels among all vcpus. (bsc#1018385) - hv/vmbus: Eliminate the spin lock on the read path. (bsc#1018385) - hv/vmbus: Enable explicit signaling policy for NIC channels. (bsc#1018385) - hv/vmbus: Export the vmbus_set_event() API. (bsc#1018385) - hv/vmbus: Finally fix hv_need_to_signal_on_read(). (bsc#1018385) - hv/vmbus: Fix a Host signaling bug. (bsc#1018385) - hv/vmbus: Fix init_vp_index() for reloading hv_netvsc. (bsc#1018385) - hv/vmbus: Fix rescind-offer handling for device without a driver. (bsc#1018385) - hv/vmbus: Fix signaling logic in hv_need_to_signal_on_read(). (bsc#1018385) - hv/vmbus: Fix signal to host condition. (bsc#1018385) - hv/vmbus: Further improve CPU affiliation logic. (bsc#1018385) - hv/vmbus: Give control over how the ring access is serialized. (bsc#1018385) - hv/vmbus: Implement APIs to support "in place" consumption of vmbus packets. (bsc#1018385) - hv/vmbus: Implement NUMA aware CPU affinity for channels. (bsc#1018385) - hv/vmbus: Improve the CPU affiliation for channels. (bsc#1018385) - hv/vmbus: Introduce functions for estimating room in the ring buffer. (bsc#1018385) - hv/vmbus: Move init_vp_index() call to vmbus_process_offer(). (bsc#1018385) - hv/vmbus: Move some ring buffer functions to hyperv.h. (bsc#1018385) - hv/vmbus: On the read path cleanup the logic to interrupt the host. (bsc#1018385) - hv/vmbus: On write cleanup the logic to interrupt the host. (bsc#1018385) - hv/vmbus: Permit sending of packets without payload. (bsc#1018385) - hv/vmbus: Release relid on error in vmbus_process_offer(). (bsc#1018385) - hv/vmbus: Serialize process_chn_event() and vmbus_close_internal(). (bsc#1018385) - hv/vmbus: Support handling messages on multiple CPUs. (bsc#1018385) - hv/vmbus: Suppress some "hv_vmbus: Unknown GUID" warnings. (bsc#1018385) - hv/vmbus: Treat Fibre Channel devices as performance critical. (bsc#1018385) - hv/vmbus: Unify calls to percpu_channel_enq(). (bsc#1018385) - hv/vmbus: Use the vp_index map even for channels bound to CPU 0. (bsc#1018385) - hv/vmbus: Use uuid_le_cmp() for comparing GUIDs. (bsc#1018385) - hv/vmbus: Use uuid_le type consistently. (bsc#1018385) - hv/vmbus: vmbus_sendpacket_ctl: hvsock: Avoid unnecessary signaling. (bsc#1018385) - kexec: Add a kexec_crash_loaded() function. (bsc#973691) - mpi: Fix NULL ptr dereference in mpi_powm(). (bsc#1011820) - netvsc: Fix checksum on UDP IPV6. (bsc#1018385) - netvsc: Fix incorrect receive checksum offloading. (bsc#1018385) - netvsc: Reduce maximum GSO size. (bsc#1018385) - perf/x86/intel: Move NMI clearing to end of PMI handler. (bsc#929142) Important SUSE bug 1003180 SUSE bug 1008374 SUSE bug 1011820 SUSE bug 1012422 SUSE bug 1013038 SUSE bug 1013531 SUSE bug 1013542 SUSE bug 1014746 SUSE bug 1017710 SUSE bug 1018385 SUSE bug 1021258 SUSE bug 821612 SUSE bug 824171 SUSE bug 929142 SUSE bug 973691 SUSE bug 986337 SUSE bug 995968 CVE-2012-6704 CVE-2015-8970 CVE-2016-10088 CVE-2016-7097 CVE-2016-8399 CVE-2016-9756 CVE-2016-9793 CVE-2017-5551 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - mm: Avoid setting up anonymous pages into file mapping. (bsc#979021, CVE-2015-3288) - l2tp: Fix l2tp_ip_bind() return value on SOCK_ZAPPED bailout. (bsc#1028415, CVE-2016-10200) - l2tp: Fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind(). (bsc#1028415, CVE-2016-10200) - list: Introduce list_first_entry_or_null. (bsc#1027565, CVE-2017-2636) - tty/n_hdlc: Get rid of racy n_hdlc.tbuf. (bsc#1027565, CVE-2017-2636) - tipc: Fix an infoleak in tipc_nl_compat_link_dump. (bsc#983212, CVE-2016-5243) - sctp: Deny peeloff operation on asocs with threads sleeping on it. (bsc#1027066, CVE-2017-6353) - tcp: Avoid infinite loop in tcp_splice_read(). (bsc#1026722, CVE-2017-6214) - dccp: Fix freeing skb too early for IPV6_RECVPKTINFO. (bsc#1026024, CVE-2017-6074) - sctp: Avoid BUG_ON on sctp_wait_for_sndbuf. (bsc#1025235, CVE-2017-5986) Additionally the following non-security bugs have been fixed: - sd: Use async_probe cookie to avoid deadlocks. (bsc#997801) - USB/serial/kl5kusb105: Fix line-state error handling. (bsc#1021256) Important SUSE bug 1021256 SUSE bug 1025235 SUSE bug 1026024 SUSE bug 1026722 SUSE bug 1027066 SUSE bug 1027565 SUSE bug 1028415 SUSE bug 979021 SUSE bug 983212 SUSE bug 997801 CVE-2015-3288 CVE-2016-10200 CVE-2016-5243 CVE-2017-2636 CVE-2017-5986 CVE-2017-6074 CVE-2017-6214 CVE-2017-6353 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - char/lp: Fix possible integer overflow in lp_setup(). (bsc#1039456, CVE-2017-1000363) - dccp/tcp: Do not inherit mc_list from parent. (bsc#1038544, CVE-2017-8890) - drm/vmwgfx: Fix integer overflow in vmw_surface_define_ioctl(). (bsc#1031440, CVE-2017-7294) - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl(). (bsc#1031052, CVE-2017-7261) - ipc/shm: Fix shmat mmap nil-page protection. (bsc#1026914, CVE-2017-5669) - ipv4: Keep skb->dst around in presence of IP options. (bsc#1024938, CVE-2017-5970) - ipv6: Check ip6_find_1stfragopt() return value properly. (bsc#1039882, CVE-2017-9074) - ipv6/dccp: Do not inherit ipv6_mc_list from parent. (bsc#1039885, bsc#1040069, CVE-2017-9076, CVE-2017-9077) - ipv6: Fix out of bound writes in __ip6_append_data(). (bsc#1041431, CVE-2017-9242) - ipv6: Prevent overrun when parsing v6 header options. (bsc#1039882, CVE-2017-9074) - ipx: Call ipxitf_put() in ioctl error path. (bsc#1038879, CVE-2017-7487) - irda: Fix lockdep annotations in hashbin_delete(). (bsc#1027178, CVE-2017-6348) - keys: Guard against null match function in keyring_search_aux(). (bsc#1030593, CVE-2017-2647, CVE-2017-6951) - mm: Enlarge stack guard gap. (bsc#1042921, bsc#1039348, CVE-2017-1000364) - mm/mempolicy.c: Fix error handling in set_mempolicy and mbind. (bsc#1033336, CVE-2017-7616) - netfilter/arp_tables: Fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel. (bsc#986362, bsc#986365, CVE-2016-4997, CVE-2016-4998) - net/packet: Fix overflow in check for tp_reserve and tp_frame_nr. (bsc#1031579, CVE-2017-7308) - net/socket: Fix recvmmsg not returning error from sock_error. (bsc#1003077, CVE-2016-7117) - ping: Implement proper locking. (bsc#1031003, CVE-2017-2671) - scsi/sg: Check length passed to SG_NEXT_CMD_LEN. (bsc#1030213, CVE-2017-7187) - sctp: Do not inherit ipv6_{mc|ac|fl}_list from parent. (bsc#1039883, CVE-2017-9075) - usb/iowarrior: Fix NULL-deref at probe. (bsc#970956, CVE-2016-2188) - xfrm_user: Validate XFRM_MSG_NEWAE incoming ESN size harder. (bsc#1030573, CVE-2017-7184) - xfrm_user: Validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window. (bsc#1030573, CVE-2017-7184) Additionally the following non-security bugs have been fixed: - acpi: Disable APEI error injection if securelevel is set. (bsc#972891, bsc#1023051) - firmware: Fix directory creation rule matching with make 3.80 and 3.82. (bsc#1012422) - kernel-binary.spec: Propagate MAKE_ARGS to %build. (bsc#1012422) - keys: Disallow keyrings beginning with '.' to be joined as session keyrings. (bsc#1035576) - mm: Do not collapse stack gap into THP. (bsc#1039348) - nfsd4: Minor NFSv2/v3 write decoding cleanup. (bsc#1034670) - nfsd: Check for oversized NFSv2/v3 arguments. (bsc#1034670) - nfsd: Stricter decoding of write-like NFSv2/v3 ops. (bsc#1034670) - Use make --output-sync feature when available. (bsc#1012422) The messages in make output can interleave making it impossible to extract warnings reliably. Since version 4 GNU Make supports --output-sync flag that prints output of each sub-command atomically preventing this issue. Detect the flag and use it if available. SLE11 has make 3.81 so it is required to include make 4 in the kernel OBS projects to take advantage of this. Important SUSE bug 1003077 SUSE bug 1012422 SUSE bug 1023051 SUSE bug 1024938 SUSE bug 1026914 SUSE bug 1027178 SUSE bug 1030213 SUSE bug 1030573 SUSE bug 1030593 SUSE bug 1031003 SUSE bug 1031052 SUSE bug 1031440 SUSE bug 1031579 SUSE bug 1033336 SUSE bug 1034670 SUSE bug 1035576 SUSE bug 1038544 SUSE bug 1038879 SUSE bug 1039348 SUSE bug 1039456 SUSE bug 1039882 SUSE bug 1039883 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1041431 SUSE bug 1042921 SUSE bug 970956 SUSE bug 972891 SUSE bug 986362 SUSE bug 986365 CVE-2016-2188 CVE-2016-4997 CVE-2016-7117 CVE-2017-1000363 CVE-2017-1000364 CVE-2017-2647 CVE-2017-2671 CVE-2017-5669 CVE-2017-5970 CVE-2017-6348 CVE-2017-6951 CVE-2017-7184 CVE-2017-7187 CVE-2017-7261 CVE-2017-7294 CVE-2017-7308 CVE-2017-7487 CVE-2017-7616 CVE-2017-8890 CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-9242 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied: - mm/mmap: Do not blow on PROT_NONE MAP_FIXED holes in the stack. (bsc#1039348, bsc#1045340, bsc#1045406) - mm: Do not collapse stack gap into THP. (bsc#1039348, CVE-2017-1000364) The following other security issues have been fixed: - usb/serial/io_ti: Fix information leak in completion handler. (bsc#1038982, CVE-2017-8924) - usb/serial/omninet: Fix reference leaks at open. (bsc#1038981, CVE-2017-8925) - alsa/timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT. (bsc#1044125, CVE-2017-1000380) - alsa/timer: Fix race between read and ioctl. (bsc#1044125, CVE-2017-1000380) Additionally the following non-security bug has been fixed: - Remove superfluous make flags. (bsc#1012422) Important SUSE bug 1012422 SUSE bug 1038981 SUSE bug 1038982 SUSE bug 1039348 SUSE bug 1044125 SUSE bug 1045340 SUSE bug 1045406 CVE-2017-1000364 CVE-2017-1000380 CVE-2017-8924 CVE-2017-8925 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-14051: An integer overflow in qla2x00_sysfs_write_optrom_ctl function allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588). - CVE-2017-1000112: Easy to exploit memory corruption in UFO to non-UFO path switch (bsc#1052311). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bnc#1053152). - CVE-2017-12762: A user-controlled buffer wasa copied into a local buffer of constant size using strcpy without a length check which could have caused a buffer overflow (bnc#1053148). - CVE-2017-8831: The saa7164_bus_get function allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability (bnc#1037994). - CVE-2017-7542: The ip6_find_1stfragopt function allowed local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket (bnc#1049882). - CVE-2017-7482: Fixed several cases where a padded len was not 't checked when decoding tickets (bsc#1046107). - CVE-2017-7533: Race condition in the fsnotify implementation allowed local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions (bnc#1049483). - CVE-2017-11176: The mq_notify function did not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allowed attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact (bnc#1048275). - CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function allowed local users to gain privileges via a crafted ACPI table (bnc#1049603). - CVE-2017-1000365: Size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size) did not take the argument and environment pointers into account, which allowed attackers to bypass this limitation (bnc#1039354). - blkback/blktap: Prevent leak of stack data via response ring. This issue allowed malicious unprivileged guest to obtain sensitive information from the host or other guests (bsc#1042863). The following non-security bugs were fixed: - Deleting a gendisk that is not up should not be an error (bsc#1035544). - USB: wusbcore: fix NULL-deref at probe (bsc#1045487). - coredump: ensure that SIGKILL always kills the dumping thread (bnc#1054302). - coredump: only SIGKILL should interrupt the coredumping task (bnc#1054302). - coredump: sanitize the setting of signal->group_exit_code (bnc#1054302). - dentry name snapshots (bsc#1049483). Important SUSE bug 1035544 SUSE bug 1037994 SUSE bug 1039354 SUSE bug 1042863 SUSE bug 1045487 SUSE bug 1046107 SUSE bug 1048275 SUSE bug 1049483 SUSE bug 1049603 SUSE bug 1049882 SUSE bug 1052311 SUSE bug 1053148 SUSE bug 1053152 SUSE bug 1054302 SUSE bug 1056588 CVE-2017-1000112 CVE-2017-1000365 CVE-2017-10661 CVE-2017-11176 CVE-2017-11473 CVE-2017-12762 CVE-2017-14051 CVE-2017-7482 CVE-2017-7533 CVE-2017-7542 CVE-2017-8831 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - CVE-2017-1000251: bluetooth: Properly check L2CAP configuration option output buffer length. (bsc#1057389) - CVE-2017-14340: xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present. (bsc#1058524) - CVE-2017-14140: Sanitize 'move_pages()' permission checks. (bsc#1057179) Additionally, the following non-security issue has been fixed: - Fix crash in nfs4_open_prepare (bsc#1052653). Important SUSE bug 1052653 SUSE bug 1057179 SUSE bug 1057389 SUSE bug 1058524 CVE-2017-1000251 CVE-2017-14140 CVE-2017-14340 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - CVE-2017-13080: mac80211: Accept key reinstall without changing anything. (bsc#1063667) - CVE-2017-15274: keys: Fix dereferencing NULL payload with nonzero length. (bsc#1045327, bsc#1062471) - CVE-2017-15265: alsa: Fix use-after-free at creating a port. (bsc#1062520) - CVE-2017-1000253: fs/binfmt: Fix bug in loading of PIE binaries. (bsc#1059525) Additionally, the following non-security issue has been fixed: - nfs: Remove asserts from the NFS XDR code. (bsc#1063544) - fs/binfmt_elf: Return -EINVAL on zero-length mappings. (bsc#1059525) Important SUSE bug 1045327 SUSE bug 1059525 SUSE bug 1062471 SUSE bug 1062520 SUSE bug 1063544 SUSE bug 1063667 CVE-2017-1000253 CVE-2017-13080 CVE-2017-15265 CVE-2017-15274 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - CVE-2017-16649: net/cdc_ether: Fix divide by 0 on bad descriptors. (bsc#1067085) - CVE-2017-16649: input/gtco: Fix potential out-of-bound access. (bsc#1067085) - CVE-2017-16535: usb/core: Fix out-of-bounds access bug in usb_get_bos_descriptor(). (bsc#1066700) - CVE-2017-15102: usb/misc/legousbtower: Fix NULL pointer dereference. (bsc#1066705) - CVE-2017-16531: usb: Fix out-of-bounds in usb_set_configuration. (bsc#1066671) - CVE-2017-16529: alsa/usb-audio: Check out-of-bounds access by corrupted buffer descriptor. (bsc#1066650) - CVE-2017-16525: usb/serial/console: Fix use-after-free after failed setup. (bsc#1066618) - CVE-2017-16537: media/imon: Fix NULL pointer dereference in imon_probe. (bsc#1066573) - CVE-2017-16536: cx231xx-cards: Fix NULL pointer dereference on missing association descriptor. (bsc#1066606) - CVE-2017-16527: alsa/usb-audio: Kill stray URB at exiting. (bsc#1066625) Additionally, the following non-security issues have been fixed: - kernel/params.c: Fix an overflow in param_attr_show. (bsc#1059240) - mac80211: Don't compare TKIP TX MIC key in reinstall prevention. (bsc#1066472) Important SUSE bug 1059240 SUSE bug 1066472 SUSE bug 1066573 SUSE bug 1066606 SUSE bug 1066618 SUSE bug 1066625 SUSE bug 1066650 SUSE bug 1066671 SUSE bug 1066700 SUSE bug 1066705 SUSE bug 1067085 CVE-2017-15102 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16649 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032). - CVE-2017-5753: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. - CVE-2017-5715: Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753. This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries. This is done with help of Linux Kernel fixes on the Intel/AMD x86_64 architecture. On x86_64, this requires also updates of the CPU microcode packages, delivered in seperate updates. As this feature can have a performance impact, it can be disabled using the "nospec" kernel commandline option. - CVE-2017-5754: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753. This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called "KAISER". The terms used here are "KAISER" / "Kernel Address Isolation" and "PTI" / "Page Table Isolation". This feature can be enabled / disabled by the "pti=[on|off|auto]" or "nopti" commandline options. The following security bugs were fixed: - CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874). - CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable (bnc#1073792). - CVE-2017-15868: The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted application (bnc#1071470). - CVE-2017-13167: An elevation of privilege vulnerability in the kernel sound timer. (bnc#1072876). - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel allowed local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner) (bnc#1066569). - CVE-2017-17558: The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel did not consider the maximum number of configurations and interfaces before attempting to release resources, which allowed local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device (bnc#1072561). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-7472: The KEYS subsystem in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls (bnc#1034862). - CVE-2017-16534: The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066693). The following non-security bugs were fixed: - asm alternatives: remove incorrect alignment notes. - kabi: silence spurious kabi error in net/sctp/socket.c (bsc#1068671). - kaiser: add "nokaiser" boot option, using ALTERNATIVE. - kaiser: fix ldt freeing. - kaiser: Kernel Address Isolation. - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush. - kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032). - kvm: x86: Add speculative control CPUID support for guests (bsc#1068032). - mm/mmu_context, sched/core: Fix mmu_context.h assumption. - ptrace: Add a new thread access check (bsc#1068032). - sched/core: Add switch_mm_irqs_off() and use it in the scheduler. - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off(). - temporary fix (bsc#1068032). - usb: uas: fix bug in handling of alternate settings (bsc#1071074). - x86-64: Give vvars their own page. - x86-64: Map the HPET NX. - x86/alternatives: Add instruction padding. - x86/alternatives: Cleanup DPRINTK macro. - x86/alternatives: Make JMPs more robust. - x86/alternatives: Use optimized NOPs for padding. - x86/boot: Add early cmdline parsing for options with arguments. - x86, boot: Carve out early cmdline parsing function. - x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032). - x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032). - x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032). - x86/CPU: Check speculation control CPUID bit (bsc#1068032). - x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032). - x86/entry: Add a function to overwrite the RSB (bsc#1068032). - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032). - x86/entry: Use IBRS on entry to kernel space (bsc#1068032). - x86/feature: Enable the x86 feature to control Speculation (bsc#1068032). - x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032). - x86/idle: Toggle IBRS when going idle (bsc#1068032). - x86/kaiser: Check boottime cmdline params. - x86/kaiser: disable vmstat accounting. - x86/kaiser: Move feature detection up (bsc#1068032). - x86/kaiser: propagate info to /proc/cpuinfo. - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling. - x86/kvm: Add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD to kvm (bsc#1068032). - x86/kvm: Flush IBP when switching VMs (bsc#1068032). - x86/kvm: Pad RSB on VM transition (bsc#1068032). - x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032). - x86: Make alternative instruction pointers relative. - x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032). - x86/mm/64: Fix reboot interaction with CR4.PCIDE. - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID. - x86/mm: Add INVPCID helpers. - x86/mm: Add the 'nopcid' boot option to turn off PCID. - x86/mm: Build arch/x86/mm/tlb.c even on !SMP. - x86/mm: Disable PCID on 32-bit kernels. - x86/mm: Enable CR4.PCIDE on supported systems. - x86/mm: fix bad backport to disable PCID on Xen. - x86/mm: Fix INVPCID asm constraint. - x86/mm: If INVPCID is available, use it to flush global mappings. - x86/mm/kaiser: re-enable vsyscalls. - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032). - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code. - x86/mm, sched/core: Turn off IRQs in switch_mm(). - x86/mm, sched/core: Uninline switch_mm(). - x86/mm: Set IBPB upon context switch (bsc#1068032). - x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032). - x86/spec: Add IBRS control functions (bsc#1068032). - x86/spec: Add "nospec" chicken bit (bsc#1068032). - x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032). - x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032). - x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032). - x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032). - x86/svm: Add code to clear registers on VM exit (bsc#1068032). - x86/svm: Clobber the RSB on VM exit (bsc#1068032). - x86/svm: Set IBPB when running a different VCPU (bsc#1068032). - x86/svm: Set IBRS value on VM entry and exit (bsc#1068032). - xen/kaiser: add "nokaiser" boot option, using ALTERNATIVE. - xen/KAISER: Kernel Address Isolation. - xen/kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush. - xen/kaiser: work around kABI. - xen/x86-64: Give vvars their own page. - xen/x86-64: Map the HPET NX. - xen/x86/alternatives: Add instruction padding. - xen/x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling. - xen/x86/mm: Enable CR4.PCIDE on supported systems. - xen/x86/mm/kaiser: re-enable vsyscalls. - xen/x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code. - xen: x86/mm, sched/core: Turn off IRQs in switch_mm(). - xen: x86/mm, sched/core: Uninline switch_mm(). Important SUSE bug 1034862 SUSE bug 1050231 SUSE bug 1056982 SUSE bug 1066569 SUSE bug 1066693 SUSE bug 1068032 SUSE bug 1068671 SUSE bug 1069702 SUSE bug 1070771 SUSE bug 1071074 SUSE bug 1071470 SUSE bug 1071695 SUSE bug 1072561 SUSE bug 1072876 SUSE bug 1073792 SUSE bug 1073874 CVE-2017-11600 CVE-2017-13167 CVE-2017-14106 CVE-2017-15115 CVE-2017-15868 CVE-2017-16534 CVE-2017-16538 CVE-2017-16939 CVE-2017-17450 CVE-2017-17558 CVE-2017-17805 CVE-2017-17806 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-7472 CVE-2017-8824 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. The following security issues have been fixed: - CVE-2017-13215: crypto/algif_skcipher: Load TX SG list after waiting. (bsc#1075908) - CVE-2018-1000004: alsa/seq: Make ioctls race-free. (bsc#1076017) - CVE-2017-5754: kaiser: Disabled on Xen PV. (bsc#1012382 bsc#1068032, bsc#1076154). Additionally, the following non-security issues have been fixed: - kaiser: Set _PAGE_NX only if supported. (bnc#1012382, bnc#1076278) - x86/kaiser: Populate shadow PGD with NX bit only if supported by platform. (bsc#1076154, bsc#1076278) - x86/paravirt: Dont patch flush_tlb_single. (bsc#1012382, bsc#1076154) - x86/spec_ctrl: Handle late setting of X86_FEATURE_SPEC_CTRL properly. (bsc#1075994, bsc#1075091) - x86/spectre_v2: Fix ordering in IBRS initialization. (bsc#1075994, bsc#1075091) - x86/microcode: Rescan feature flags upon late loading. (bsc#1075994, bsc#1075091) - x86/CPU: Sync CPU feature flags late. (bsc#1075994, bsc#1075091) - x86/cpu: Factor out application of forced CPU caps. (bsc#1075994, bsc#1075091) - storvsc: Do not assume SG list is continuous when doing bounce buffers. (bsc#1075410) - pti: Unbreak EFI. (bsc#1074709) - x86/acpi: Reduce code duplication in mp_override_legacy_irq(). (bsc#1068984) - x86/acpi: Handle SCI interrupts above legacy space gracefully. (bsc#1068984) - x86/acpi: Reduce code duplication in mp_override_legacy_irq(). (bsc#1068984) - x86/acpi: Handle SCI interrupts above legacy space gracefully. (bsc#1068984) Important SUSE bug 1012382 SUSE bug 1068032 SUSE bug 1068984 SUSE bug 1074709 SUSE bug 1075091 SUSE bug 1075410 SUSE bug 1075908 SUSE bug 1075994 SUSE bug 1076017 SUSE bug 1076154 SUSE bug 1076278 CVE-2017-13215 CVE-2017-5754 CVE-2018-1000004 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / "Spectre Attack": IBM Z fixes were included but not enabled in the previous update. This update enables those fixes. - CVE-2017-5715 / "Spectre Attack": IBM Z fixes were already included in the previous update. A bugfix for the patches has been applied on top. - CVE-2017-5754: The IBM Z architecture is not affected by the "Meltdown" attack. Important SUSE bug 1068032 CVE-2017-5715 CVE-2017-5753 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032). The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka "retpolines". - CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621). - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617). - CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488). - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bnc#1077922). - CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311). - CVE-2017-13215: A elevation of privilege vulnerability in the Upstream kernel skcipher. (bnc#1075908). - CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017). The following non-security bugs were fixed: - cdc-acm: apply quirk for card reader (bsc#1060279). - Enable CPU vulnerabilities reporting via sysfs - fork: clear thread stack upon allocation (bsc#1077560). - kaiser: Set _PAGE_NX only if supported (bnc#1012382, bnc#1076278). - kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032). - Move kABI fixup for retpolines to proper place. - powerpc/vdso64: Use double word compare on pointers (bsc#1070781). - s390: add ppa to the idle loop (bnc#1077406, LTC#163910). - s390/cpuinfo: show facilities as reported by stfle (bnc#1076849, LTC#163741). - storvsc: do not assume SG list is continuous when doing bounce buffers (bsc#1075410). - sysfs/cpu: Add vulnerability folder (bnc#1012382). - sysfs/cpu: Fix typos in vulnerability documentation (bnc#1012382). - sysfs: spectre_v2, handle spec_ctrl (bsc#1075994 bsc#1075091). - x86/acpi: Handle SCI interrupts above legacy space gracefully (bsc#1068984). - x86/acpi: Reduce code duplication in mp_override_legacy_irq() (bsc#1068984). - x86/boot: Fix early command-line parsing when matching at end (bsc#1068032). - x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091). - x86/cpu: Implement CPU vulnerabilites sysfs functions (bnc#1012382). - x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091). - x86/kaiser: Populate shadow PGD with NX bit only if supported by platform (bsc#1076154 bsc#1076278). - x86/kaiser: use trampoline stack for kernel entry. - x86/microcode/intel: Disable late loading on model 79 (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading further with LLC size check (bsc#1054305). - x86/microcode/intel: Extend BDW late-loading with a revision check (bsc#1054305). - x86/microcode: Rescan feature flags upon late loading (bsc#1075994 bsc#1075091). - x86/retpolines/spec_ctrl: disable IBRS on !SKL if retpolines are active (bsc#1068032). - x86/spec_ctrl: handle late setting of X86_FEATURE_SPEC_CTRL properly (bsc#1075994 bsc#1075091). - x86/spectre_v2: fix ordering in IBRS initialization (bsc#1075994 bsc#1075091). - x86/spectre_v2: nospectre_v2 means nospec too (bsc#1075994 bsc#1075091). Important SUSE bug 1012382 SUSE bug 1054305 SUSE bug 1060279 SUSE bug 1068032 SUSE bug 1068984 SUSE bug 1070781 SUSE bug 1073311 SUSE bug 1074488 SUSE bug 1074621 SUSE bug 1075091 SUSE bug 1075410 SUSE bug 1075617 SUSE bug 1075621 SUSE bug 1075908 SUSE bug 1075994 SUSE bug 1076017 SUSE bug 1076154 SUSE bug 1076278 SUSE bug 1076849 SUSE bug 1077406 SUSE bug 1077560 SUSE bug 1077922 CVE-2017-13215 CVE-2017-17741 CVE-2017-18017 CVE-2017-18079 CVE-2017-5715 CVE-2018-1000004 CVE-2018-5332 CVE-2018-5333 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. The following security issues have been fixed: - CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel allowed local users to cause a denial of service by leveraging a race condition with __dm_destroy during creation and removal of DM devices. (bsc#1083242) - CVE-2017-16911: The vhci_hcd driver allowed local attackers to disclose kernel memory addresses. Successful exploitation required that a USB device was attached over IP (bsc#1078674). - CVE-2017-18208: The madvise_willneed function kernel allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bsc#1083494). - CVE-2018-7566: The ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. A user could have reset the pool size manually via ioctl concurrently, which may have lead UAF or out-of-bound access (bsc#1083483). - CVE-2017-16644: The hdpvr_probe function allowed local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device (bsc#1067118). - CVE-2017-5753 / "SpectreAttack": Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets. This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel. - CVE-2018-6927: The futex_requeue function allowed attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value (bsc#1080757). - CVE-2017-16914: The "stub_send_ret_submit()" function allowed attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet (bsc#1078669). - CVE-2016-7915: The hid_input_field function allowed physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device (bsc#1010470). - CVE-2015-5156: The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel attempted to support a FRAGLIST feature without proper memory allocation, which allowed guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets (bsc#940776). - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user functions did unbalanced refcounting when a SCSI I/O vector had small consecutive buffers belonging to the same page. The bio_add_pc_page function merged them into one, but the page reference was never dropped. This caused a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition (bsc#1062568). - CVE-2017-16912: The "get_pipe()" function allowed attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (bsc#1078673). - CVE-2017-16913: The "stub_recv_cmd_submit()" function when handling CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (bsc#1078672). - CVE-2018-5332: The rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bsc#1075621). - CVE-2018-5333: The rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bsc#1075617). - CVE-2017-18017: The tcpmss_mangle_packet function allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bsc#1074488). - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux kernel allowed attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated (bsc#1077922). - CVE-2017-17741: The KVM implementation in the Linux kernel allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bsc#1073311). Additionally, the following non-security issues have been fixed: - x86/retpoline: Don't perform thunk calls in ring3 vsyscall code. (bsc#1085331) - sd: Skip async probing for deleted devices. (bsc#1066051) - x86/espfix: Fix return stack in do_double_fault(). (bsc#1085279) - scsi: Do not spin-up disconnected devices. (bsc#1073379) - sd: Reset async_probe cookie after probing. (bsc#1073379) - sysfs/driver core: Fix glue dir race condition by gdp_mutex. (bsc#1073379) - block: Do not allow updates through sysfs until registration completes. (bsc#1073379) - leds: Do not overflow sysfs buffer in led_trigger_show. (bsc#1080464) - sysfs/spectre_v2: Handle spec_ctrl. (bsc#1075994, bsc#1075091) - x86/spectre_v2: nospectre_v2 means nospec too. (bsc#1075994, bsc#1075091) - sysfs/cpu: Fix typos in vulnerability documentation. (bsc#1012382) - x86/cpu: Implement CPU vulnerabilites sysfs functions. (bsc#1012382) - sysfs/cpu: Add vulnerability folder. (bsc#1012382) - kbuild: Modversions for EXPORT_SYMBOL() for asm. (bsc#1074621, bsc#1068032) - Switch away from trampoline stack to kernel stack in ia32_syscall entry. (bsc#1080579) - x86/kaiser: Use trampoline stack for kernel entry. (bsc#1077560) - powerpc/vdso64: Use double word compare on pointers. (bsc#1070781) - audit: Move the tree pruning to a dedicated thread. (bsc#1075867) Important SUSE bug 1010470 SUSE bug 1012382 SUSE bug 1062568 SUSE bug 1066051 SUSE bug 1067118 SUSE bug 1068032 SUSE bug 1070781 SUSE bug 1073311 SUSE bug 1073379 SUSE bug 1074488 SUSE bug 1074621 SUSE bug 1075091 SUSE bug 1075617 SUSE bug 1075621 SUSE bug 1075867 SUSE bug 1075994 SUSE bug 1077560 SUSE bug 1077922 SUSE bug 1078669 SUSE bug 1078672 SUSE bug 1078673 SUSE bug 1078674 SUSE bug 1080464 SUSE bug 1080579 SUSE bug 1080757 SUSE bug 1083242 SUSE bug 1083483 SUSE bug 1083494 SUSE bug 1085279 SUSE bug 1085331 SUSE bug 940776 CVE-2015-5156 CVE-2016-7915 CVE-2017-12190 CVE-2017-16644 CVE-2017-16911 CVE-2017-16912 CVE-2017-16913 CVE-2017-16914 CVE-2017-17741 CVE-2017-18017 CVE-2017-18079 CVE-2017-18203 CVE-2017-18208 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-5332 CVE-2018-5333 CVE-2018-6927 CVE-2018-7566 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. The following security issues have been fixed: - CVE-2017-13166: An elevation of privilege vulnerability in the v4l2 video driver was fixed (bsc#1072865). - CVE-2017-5715: More improvements and cleanups for retpoline support (bsc#1068032). - CVE-2017-5753: Introduce new memory barrier gmb() (bsc#1068032). - CVE-2017-5754: Fix making LFENCE a serializing instruction (bsc#1068032). Additionally, the following non-security issues have been fixed: - xen/x86/cpu: Factor out application of forced CPU caps (bsc#1075994, bsc#1075091). - xen/x86/CPU: Sync CPU feature flags late (bsc#1075994, bsc#1075091). Important SUSE bug 1068032 SUSE bug 1072865 SUSE bug 1075091 SUSE bug 1075994 SUSE bug 1086827 CVE-2017-13166 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. The following security issues have been fixed: - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-1000199: perf/hwbp: Simplify the perf-hwbp code and fix documentation. (bsc#1089895) - CVE-2018-10675: mm/mempolicy: Fix use after free when calling get_mempolicy. (bsc#1091755) - CVE-2018-10124: The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument (bsc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bsc#1089608). - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bsc#1084536). - CVE-2018-7566: Buffer overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user potentially allowing for code execution (bnc#1083483). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260 1088268). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function could have beenexploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162) Additionally, the following non-security issues have been fixed: - x86, mce: Fix mce_start_timer semantics. (bsc#1090607) - x86/Xen: Disable IBRS around CPU stopper function invocation (none so far). - xen-netfront: Fix req_prod check to avoid RX hang when index wraps. (bsc#1046610) - Integrate fixes resulting from bsc#1088147. More info in the respective commit messages. - kabi/x86/kaiser: Properly align trampoline stack (bsc#1087260). - posix-timers: Protect posix clock array access against speculation (bsc#1081358). - mm/mmap.c: Do not blow on PROT_NONE MAP_FIXED holes in the stack (bsc#1039348). - sd: Check device status after spinup when revalidating the device (bsc#1090366). - sd: Skip probing after sd_revalidate_disk() (bsc#1090366). - Fix wrong function name in 0007-sd-Check-device-status-after-spinup-when-revalidatin.patch - mm: Replace fixes for bsc#1039348, CVE-2017-1000364 with patches from upstream. Important SUSE bug 1039348 SUSE bug 1046610 SUSE bug 1081358 SUSE bug 1083483 SUSE bug 1084536 SUSE bug 1086162 SUSE bug 1087088 SUSE bug 1087260 SUSE bug 1088147 SUSE bug 1088260 SUSE bug 1089608 SUSE bug 1089752 SUSE bug 1089895 SUSE bug 1090366 SUSE bug 1090607 SUSE bug 1091755 CVE-2017-0861 CVE-2017-1000364 CVE-2018-1000199 CVE-2018-10087 CVE-2018-10124 CVE-2018-10675 CVE-2018-7566 CVE-2018-7757 CVE-2018-8822 CVE-2018-8897 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive one security and one bugfix. The following security issue has been fixed: - CVE-2018-3639: Information leaks using "Memory Disambiguation" feature in modern CPUs were mitigated, aka "Spectre Variant 4" (bnc#1087082). A new boot commandline option was introduced, "spec_store_bypass_disable", which can have following values: - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as "prctl" above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is "seccomp", meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing: - "Vulnerable" - "Mitigation: Speculative Store Bypass disabled" - "Mitigation: Speculative Store Bypass disabled via prctl" - "Mitigation: Speculative Store Bypass disabled via prctl and seccomp" Additionally, the following non-security issue has been fixed: - x86/bugs: make intel_rds_mask() honor X86_FEATURE_SSBD (bsc#1094019). Important SUSE bug 1087082 SUSE bug 1094019 CVE-2018-3639 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-3639: Information leaks using "Memory Disambiguation" feature in modern CPUs were mitigated, aka "Spectre Variant 4" (bnc#1087082). A new boot commandline option was introduced, "spec_store_bypass_disable", which can have following values: - auto: Kernel detects whether your CPU model contains an implementation of Speculative Store Bypass and picks the most appropriate mitigation. - on: disable Speculative Store Bypass - off: enable Speculative Store Bypass - prctl: Control Speculative Store Bypass per thread via prctl. Speculative Store Bypass is enabled for a process by default. The state of the control is inherited on fork. - seccomp: Same as "prctl" above, but all seccomp threads will disable SSB unless they explicitly opt out. The default is "seccomp", meaning programs need explicit opt-in into the mitigation. Status can be queried via the /sys/devices/system/cpu/vulnerabilities/spec_store_bypass file, containing: - "Vulnerable" - "Mitigation: Speculative Store Bypass disabled" - "Mitigation: Speculative Store Bypass disabled via prctl" - "Mitigation: Speculative Store Bypass disabled via prctl and seccomp" - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system. (bsc#1089895) - CVE-2018-10675: The do_get_mempolicy function in mm/mempolicy.c allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls (bnc#1091755). - CVE-2017-5715: The retpoline mitigation for Spectre v2 has been enabled also for 32bit x86. - CVE-2017-5753: Spectre v1 mitigations have been improved by the versions merged from the upstream kernel. The following non-security bugs were fixed: - Update config files. Set CONFIG_RETPOLINE=y for i386. - x86/espfix: Fix return stack in do_double_fault() (bsc#1085279). - xen-netfront: fix req_prod check to avoid RX hang when index wraps (bsc#1046610). Important SUSE bug 1046610 SUSE bug 1085279 SUSE bug 1087082 SUSE bug 1089895 SUSE bug 1091755 SUSE bug 1092497 SUSE bug 1094019 CVE-2017-5715 CVE-2017-5753 CVE-2018-1000199 CVE-2018-10675 CVE-2018-3639 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 for Teradata kernel was updated to receive various security and bugfixes. The following security issue has been fixed: - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) Additionally, the following non-security issues have been fixed: - KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281). - Xen counterparts of eager FPU implementation. - x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140). - x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140). - x86: Fix /proc/mtrr with base/size more than 44bits (bnc#1095456). Important SUSE bug 1087086 SUSE bug 1095456 SUSE bug 1096140 SUSE bug 1096242 SUSE bug 1096281 CVE-2018-3665 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following non-security bugs were fixed: - fix a leak in /proc/schedstats (bsc#1094876). - mm: hugetlb: fix softlockup when a large number of hugepages are freed (bsc#1095887). - perf, nmi: Fix unknown NMI warning (bsc#929142).++ kernel-source.spec (revision 4)Release: <RELEASE>.g06db3a5 - perf/x86/intel: Handle Broadwell family processors (bsc#1093183). - sched/sysctl: Check user input value of sysctl_sched_time_avg (bsc#1100089). - signals: avoid unnecessary taking of sighand->siglock (bsc#1096130). - x64/entry: move ENABLE_IBRS after switching from trampoline stack (bsc#1098658). - x86/fpu: fix signal handling with eager FPU switching (bsc#1100091). - x86/traps: add missing kernel CR3 switch in bad_iret path (bsc#1098658). - x86/traps: Fix bad_iret_stack in fixup_bad_iret() (bsc#1098658). Moderate SUSE bug 1093183 SUSE bug 1094876 SUSE bug 1095887 SUSE bug 1096130 SUSE bug 1097948 SUSE bug 1098658 SUSE bug 1100089 SUSE bug 1100091 SUSE bug 929142 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device could lead to a local kernel information leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728). - CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081). - CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343). - CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924). - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418). - CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942). - CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480). - CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234). - CVE-2017-13305: A information disclosure vulnerability was fixed in the kernel encrypted-keys. (bnc#1094353). - CVE-2018-1130: A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c was fixed in that allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904). - CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107). - CVE-2018-5803: An error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900). - CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowed local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962). The following non-security bugs were fixed: - cpu/hotplug: Add sysfs state interface (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Split do_cpu_down() (bsc#1089343). - disable-prot_none_mitigation.patch: disable prot_none native mitigation (bnc#1104684) - fix pgd underflow (bnc#1104475) custom walk_page_range rework was incorrect and could underflow pgd if the given range was below a first vma. - slab: introduce kmalloc_array() (bsc#909361). - x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343). - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343). - x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343). - x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu: Remove the pointless CPU printout (bsc#1089343). - x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (bsc#1089343). - x86/smp: Provide topology_is_primary_thread() (bsc#1089343). - x86/topology: Add topology_max_smt_threads() (bsc#1089343). - x86/topology: Provide topology_smt_supported() (bsc#1089343). - xen/x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - xen/x86/cpu: Remove the pointless CPU printout (bsc#1089343). - xen/x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/mm: Simplify p[g4um]d_page() macros (bnc#1087081, bnc#1104684). Important SUSE bug 1082962 SUSE bug 1083900 SUSE bug 1085107 SUSE bug 1087081 SUSE bug 1089343 SUSE bug 1092904 SUSE bug 1094353 SUSE bug 1096480 SUSE bug 1096728 SUSE bug 1097234 SUSE bug 1098016 SUSE bug 1099924 SUSE bug 1099942 SUSE bug 1100418 SUSE bug 1104475 SUSE bug 1104684 SUSE bug 909361 CVE-2016-8405 CVE-2017-13305 CVE-2018-1000204 CVE-2018-1068 CVE-2018-1130 CVE-2018-12233 CVE-2018-13053 CVE-2018-13406 CVE-2018-3620 CVE-2018-3646 CVE-2018-5803 CVE-2018-5814 CVE-2018-7492 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-8405: An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. (bnc#1099942). - CVE-2017-13305: A information disclosure vulnerability existed in the encrypted-keys handling. (bnc#1094353). - CVE-2018-1000204: A malformed SG_IO ioctl issued for a SCSI device could lead to a local kernel information leak manifesting in up to approximately 1000 memory pages copied to the userspace. The problem has limited scope as non-privileged users usually have no permissions to access SCSI device files. (bnc#1096728). - CVE-2018-1068: A flaw was found in the implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory (bnc#1085107). - CVE-2018-1130: A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c allowed a local user to cause a denial of service by a number of certain crafted system calls (bnc#1092904). - CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr (bnc#1097234). - CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924). - CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c kernel could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418). - CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081). - CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343). - CVE-2018-5803: An error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length could be exploited to cause a kernel crash (bnc#1083900). - CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480). - CVE-2018-7492: A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST (bnc#1082962). The following non-security bugs were fixed: - cpu/hotplug: Add sysfs state interface (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Provide knobs to control SMT (bsc#1089343). - cpu/hotplug: Split do_cpu_down() (bsc#1089343). - disable-prot_none_mitigation.patch: disable prot_none native mitigation (bnc#1104684) - fix pgd underflow (bnc#1104475) custom walk_page_range rework was incorrect and could underflow pgd if the given range was below a first vma. - slab: introduce kmalloc_array() (bsc#909361). - x86/apic: Ignore secondary threads if nosmt=force (bsc#1089343). - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu/AMD: Evaluate smp_num_siblings early (bsc#1089343). - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (bsc#1089343). - x86/cpu/AMD: Remove the pointless detect_ht() call (bsc#1089343). - x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - x86/cpu/intel: Evaluate smp_num_siblings early (bsc#1089343). - x86/cpu: Remove the pointless CPU printout (bsc#1089343). - x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (bsc#1089343). - x86/smp: Provide topology_is_primary_thread() (bsc#1089343). - x86/topology: Add topology_max_smt_threads() (bsc#1089343). - x86/topology: Provide topology_smt_supported() (bsc#1089343). - xen/x86/cpu/common: Provide detect_ht_early() (bsc#1089343). - xen/x86/cpu: Remove the pointless CPU printout (bsc#1089343). - xen/x86/cpu/topology: Provide detect_extended_topology_early() (bsc#1089343). - x86/mm: Simplify p[g4um]d_page() macros (bnc#1087081, bnc#1104684). Important SUSE bug 1082962 SUSE bug 1083900 SUSE bug 1085107 SUSE bug 1087081 SUSE bug 1089343 SUSE bug 1092904 SUSE bug 1094353 SUSE bug 1096480 SUSE bug 1096728 SUSE bug 1097234 SUSE bug 1098016 SUSE bug 1099924 SUSE bug 1099942 SUSE bug 1100418 SUSE bug 1104475 SUSE bug 1104684 SUSE bug 909361 CVE-2016-8405 CVE-2017-13305 CVE-2018-1000204 CVE-2018-1068 CVE-2018-1130 CVE-2018-12233 CVE-2018-13053 CVE-2018-13406 CVE-2018-3620 CVE-2018-3646 CVE-2018-5803 CVE-2018-5814 CVE-2018-7492 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912). - CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903) - CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689) - CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511) - CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509) - CVE-2018-15572: The spectre_v2_select_mitigation function did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517) - CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322). - CVE-2018-14734: ucma_leave_multicast accessed a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bsc#1103119). - CVE-2017-5754: Make indirect call speculation safe. (bsc#1068032) - CVE-2017-5715: Convert entry assembler indirect jumps --ia32. (bsc#1068032) Additionally, the following non-security issues have been fixed: - x86/vdso: Fix vDSO build if a retpoline is emitted. - kvm/vmx: fixes for vmentry_l1d_flush module parameter. (bsc#1106369) - kvm/vmx: Work around kABI breakage in 'enum vmx_l1d_flush_state'. (bsc#1106369) - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit. (bsc#1087081) - kabi/x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+. (bsc#1105536) - xen/x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (bsc#1105536). - xen/x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM. (bsc#1105536) - xen/x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit. (bsc#1087081) - kabi/x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+. (bsc#1105536) - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+. (bsc#1105536) - x86/speculation/l1tf: Suggest what to do on systems with too much RAM. (bsc#1105536) - x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM. (bsc#1105536) - xen/x86/l1tf: Protect PROT_NONE PTEs against speculation fixup. (bsc#1104684, bsc#1104818) - x86/l1tf: Protect PROT_NONE PTEs against speculation fixup. (bsc#1104684, bsc#1104818) - rpm/kernel-docs.spec.in: Make unpack scripts executable. - rpm/kernel-docs.spec.in: Expand kernel tree directly from sources. (bsc#1057199) Important SUSE bug 1012382 SUSE bug 1057199 SUSE bug 1068032 SUSE bug 1087081 SUSE bug 1092903 SUSE bug 1102517 SUSE bug 1103119 SUSE bug 1104684 SUSE bug 1104818 SUSE bug 1105322 SUSE bug 1105536 SUSE bug 1106369 SUSE bug 1106509 SUSE bug 1106511 SUSE bug 1107689 SUSE bug 1108912 CVE-2017-5715 CVE-2017-5754 CVE-2018-10902 CVE-2018-10940 CVE-2018-14634 CVE-2018-14734 CVE-2018-15572 CVE-2018-16658 CVE-2018-6554 CVE-2018-6555 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to fix bugs and security issues. The following security issues have been fixed: - CVE-2018-14633: security flaw in iscsi target code (bsc#1107829) - CVE-2018-18281: mremap: properly flush TLB before releasing the page (bsc#1113769) - CVE-2018-18710: cdrom: fix improper type cast, which can lead to information leak (bsc#1113751) - CVE-2018-18386: n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) (bsc#1094825, bsc#1110711) - CVE-2017-7273: HID: hid-cypress: validate length of report (bsc#1031240) - CVE-2017-16533: HID: usbhid: fix out-of-bounds bug (bsc#1066674) - CVE-2017-1000407: KVM: VMX: remove I/O port 0x80 bypass on Intel hosts (bsc#1071021) - CVE-2018-9516: HID: debug: check length before copy_to_user() (bsc#1108498) The following bugs have been fixed: - st: null pointer dereference panic caused by use after kref_put by st_open (bsc#936875, bsc#1113201) - retpoline: Introduce start/end markers of indirect thunk (bsc#1113337) Important SUSE bug 1031240 SUSE bug 1066674 SUSE bug 1071021 SUSE bug 1094825 SUSE bug 1107829 SUSE bug 1108498 SUSE bug 1110711 SUSE bug 1113201 SUSE bug 1113337 SUSE bug 1113751 SUSE bug 1113769 SUSE bug 936875 CVE-2017-1000407 CVE-2017-16533 CVE-2017-7273 CVE-2018-14633 CVE-2018-18281 CVE-2018-18386 CVE-2018-18710 CVE-2018-9516 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 12 SP3 kernel was updated to 3.0.101 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-9516: In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bnc#1108498). - CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841). - CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743). - CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714). - CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1118319). - CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152). - CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused (bnc#1113769). - CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751). - CVE-2018-18386: drivers/tty/n_tty.c allowed local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ (bnc#1094825). - CVE-2017-7273: The cp_report_fixup function in drivers/hid/hid-cypress.c allowed physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report (bnc#1031240). - CVE-2017-16533: The usbhid_parse function in drivers/hid/usbhid/hid-core.c allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066674). - CVE-2017-1000407: Fixed a denial of service, which was caused by flooding the diagnostic port 0x80 an exception leading to a kernel panic (bnc#1071021). The following non-security bugs were fixed: - ALSA: pcm: Fix potential deadlock in OSS emulation (bsc#968018, bsc#1104366). - cpusets, isolcpus: exclude isolcpus from load balancing in cpusets (bsc#1119255). - Drivers: scsi: storvsc: Change the limits to reflect the values on the host (bug#1107189). - drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure (bug#1107189). - Drivers: scsi: storvsc: Filter commands based on the storage protocol version (bug#1107189). - Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version (bug#1107189). - Drivers: scsi: storvsc: Implement a eh_timed_out handler (bug#1107189). - Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host (bug#1107189). - drivers: scsi: storvsc: Set srb_flags in all cases (bug#1107189). - EHCI: improved logic for isochronous scheduling (bsc#1117515). - ipv4: remove the unnecessary variable in udp_mcast_next (bsc#1104070). - KEYS: prevent creating a different user's keyrings (bnc#1094186). - KVM: x86: Fix the duplicate failure path handling in vmx_init (bsc#1104367). - MM: increase safety margin provided by PF_LESS_THROTTLE (bsc#1116412). - MM/vmscan.c: avoid throttling reclaim for loop-back nfsd threads (bsc#1116412). - net/ipv6/udp: Fix ipv6 multicast socket filter regression (bsc#1104070). - NFS: avoid deadlocks with loop-back mounted NFS filesystems (bsc#1116412). - NFS: avoid waiting at all in nfs_release_page when congested (bsc#1116412). - NFS: Do not write enable new pages while an invalidation is proceeding (bsc#1116412). - NFS: Fix a regression in the read() syscall (bsc#1116412). - NFS: Fix races in nfs_revalidate_mapping (bsc#1116412). - NFS: fix the handling of NFS_INO_INVALID_DATA flag in nfs_revalidate_mapping (bsc#1116412). - NFS: Fix writeback performance issue on cache invalidation (bsc#1116412). - reiserfs: do not preallocate blocks for extended attributes (bsc#990682). - reiserfs: fix race in readdir (bsc#1039803). - sched, isolcpu: make cpu_isolated_map visible outside scheduler (bsc#1119255). - scsi: storvsc: Always send on the selected outgoing channel (bug#1107189). - scsi: storvsc: Do not assume that the scatterlist is not chained (bug#1107189). - scsi: storvsc: Fix a bug in copy_from_bounce_buffer() (bug#1107189). - scsi: storvsc: Increase the ring buffer size (bug#1107189). - scsi: storvsc: Size the queue depth based on the ringbuffer size (bug#1107189). - storvsc: fix a bug in storvsc limits (bug#1107189). - storvsc: force discovery of LUNs that may have been removed (bug#1107189). - storvsc: get rid of overly verbose warning messages (bug#1107189). - storvsc: in responce to a scan event, scan the host (bug#1107189). - storvsc: Set the SRB flags correctly when no data transfer is needed (bug#1107189). - udp: ipv4: Add udp early demux (bsc#1104070). - udp: restore UDPlite many-cast delivery (bsc#1104070). - udp: Simplify __udp*_lib_mcast_deliver (bsc#1104070). - udp: Use hash2 for long hash1 chains in __udp*_lib_mcast_deliver (bsc#1104070). - USB: EHCI: add new root-hub state: STOPPING (bsc#1117515). - USB: EHCI: add pointer to end of async-unlink list (bsc#1117515). - USB: EHCI: add symbolic constants for QHs (bsc#1117515). - USB: EHCI: always scan each interrupt QH (bsc#1117515). - USB: EHCI: do not lose events during a scan (bsc#1117515). - USB: EHCI: do not refcount iso_stream structures (bsc#1117515). - USB: EHCI: do not refcount QHs (bsc#1117515). - USB: EHCI: fix initialization bug in iso_stream_schedule() (bsc#1117515). - USB: EHCI: fix up locking (bsc#1117515). - USB: EHCI: initialize data before resetting hardware (bsc#1117515). - USB: EHCI: introduce high-res timer (bsc#1117515). - USB: EHCI: remove PS3 status polling (bsc#1117515). - USB: EHCI: remove unneeded suspend/resume code (bsc#1117515). - USB: EHCI: rename "reclaim" (bsc#1117515). - USB: EHCI: resolve some unlikely races (bsc#1117515). - USB: EHCI: return void instead of 0 (bsc#1117515). - USB: EHCI: simplify isochronous scanning (bsc#1117515). - USB: EHCI: unlink multiple async QHs together (bsc#1117515). - USB: EHCI: use hrtimer for async schedule (bsc#1117515). - USB: EHCI: use hrtimer for controller death (bsc#1117515). - USB: EHCI: use hrtimer for interrupt QH unlink (bsc#1117515). - USB: EHCI: use hrtimer for (s)iTD deallocation (bsc#1117515). - USB: EHCI: use hrtimer for the IAA watchdog (bsc#1117515). - USB: EHCI: use hrtimer for the I/O watchdog (bsc#1117515). - USB: EHCI: use hrtimer for the periodic schedule (bsc#1117515). - USB: EHCI: use hrtimer for unlinking empty async QHs (bsc#1117515). - XFS: do not BUG() on mixed direct and mapped I/O (bsc#1114920). - XFS: stop searching for free slots in an inode chunk when there are none (bsc#1115007). - XFS: validate sb_logsunit is a multiple of the fs blocksize (bsc#1115038). Important SUSE bug 1031240 SUSE bug 1039803 SUSE bug 1066674 SUSE bug 1071021 SUSE bug 1094186 SUSE bug 1094825 SUSE bug 1104070 SUSE bug 1104366 SUSE bug 1104367 SUSE bug 1107189 SUSE bug 1108498 SUSE bug 1109200 SUSE bug 1113201 SUSE bug 1113751 SUSE bug 1113769 SUSE bug 1114920 SUSE bug 1115007 SUSE bug 1115038 SUSE bug 1116412 SUSE bug 1116841 SUSE bug 1117515 SUSE bug 1118152 SUSE bug 1118319 SUSE bug 1119255 SUSE bug 1119714 SUSE bug 1120743 SUSE bug 905299 SUSE bug 936875 SUSE bug 968018 SUSE bug 990682 CVE-2017-1000407 CVE-2017-16533 CVE-2017-7273 CVE-2018-18281 CVE-2018-18386 CVE-2018-18710 CVE-2018-19407 CVE-2018-19824 CVE-2018-19985 CVE-2018-20169 CVE-2018-9516 CVE-2018-9568 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes. Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel. For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736 The following security bugs were fixed: - CVE-2013-0216: The Xen netback functionality allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption (bnc#800280). - CVE-2012-3430: The rds_recvmsg function in net/rds/recv.c did not initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a recvfrom or recvmsg system call on an RDS socket (bnc#773383). - CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value (bnc#774523). - CVE-2004-0230: TCP, when using a large Window Size, made it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP (bnc#969340). - CVE-2013-0160: The kernel allowed local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device (bnc#797175). - CVE-2013-1979: The scm_set_cred function in include/net/scm.h uses incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application (bnc#816708). - CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051). - CVE-2017-18360: In change_port_settings in drivers/usb/serial/io_ti.c a local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates (bnc#1123706). - CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c did not properly determine the memory locations used for encrypted data, which allowed context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket (bnc#927257). - CVE-2014-9922: The eCryptfs subsystem allowed local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c (bnc#1032340). - CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831). - CVE-2018-15594: arch/x86/kernel/paravirt.c mishandled certain indirect calls, which made it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests (bnc#1105348). - CVE-2016-10741: fs/xfs/xfs_aops.c allowed local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure (bnc#1124010). - CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem allowed guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation (bnc#899192). - CVE-2019-9213: The expand_downwards function in mm/mmap.c lacks a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166). - CVE-2019-7222: The KVM implementation in has an Information Leak (bnc#1124735). - CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841). - CVE-2018-19985: The function hso_get_config_data in drivers/net/usb/hso.c reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allowed arbitrary read in the kernel address space (bnc#1120743). - CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714). - CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319). - CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152). The following non-security bugs were fixed: - copy_mount_string: Limit string length to PATH_MAX (bsc#1082943). - cpu/speculation: Add 'mitigations=' cmdline option (bsc#1112178). - lib: add "on"/"off" support to strtobool (bsc#1125931). - sched/core: Optimize SCHED_SMT (bsc#1111331). - sched/smt: Expose sched_smt_present static key (bsc#1111331). - sched/smt: Make sched_smt_present track topology (bsc#1111331). - sched/smt: Update sched_smt_present at runtime (bsc#1111331). - x86, kvm: Remove incorrect redundant assembly constraint (bnc#931850). - x86/cpu: Sanitize FAM6_ATOM naming (bsc#1111331). - x86/kvm/vmx: Add MDS protection when L1D Flush is not active (bsc#1111331). - x86/speculation/mds: Add 'mitigations=' support for MDS (bsc#1111331). - x86/speculation/mds: Add BUG_MSBDS_ONLY (bsc#1111331). - x86/speculation/mds: Add SMT warning message (bsc#1111331). - x86/speculation/mds: Add basic bug infrastructure for MDS (bsc#1111331). - x86/speculation/mds: Add mds=full,nosmt cmdline option (bsc#1111331). - x86/speculation/mds: Add mds_clear_cpu_buffers() (bsc#1111331). - x86/speculation/mds: Add mitigation control for MDS (bsc#1111331). - x86/speculation/mds: Add mitigation mode VMWERV (bsc#1111331). - x86/speculation/mds: Add sysfs reporting for MDS (bsc#1111331). - x86/speculation/mds: Clear CPU buffers on exit to user (bsc#1111331). - x86/speculation/mds: Conditionally clear CPU buffers on idle entry (bsc#1111331). - x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (bsc#1111331). - x86/speculation: Consolidate CPU whitelists (bsc#1111331). - x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (bsc#1111331). - x86/speculation: Move arch_smt_update() call to after mitigation decisions (bsc#1111331). - x86/speculation: Rework SMT state change (bsc#1111331). - x86/speculation: Support 'mitigations=' cmdline option (bsc#1112178). - x86/mce: Handle "nosmt" offlining properly (bsc#1134729). - x86/mce/intel: Cleanup CMCI storm logic (bsc#929141). Important SUSE bug 1008831 SUSE bug 1032340 SUSE bug 1059051 SUSE bug 1082943 SUSE bug 1103186 SUSE bug 1105348 SUSE bug 1111331 SUSE bug 1112178 SUSE bug 1116841 SUSE bug 1118152 SUSE bug 1118319 SUSE bug 1119714 SUSE bug 1120743 SUSE bug 1123706 SUSE bug 1124010 SUSE bug 1124735 SUSE bug 1125931 SUSE bug 1128166 SUSE bug 1134729 SUSE bug 773383 SUSE bug 774523 SUSE bug 797175 SUSE bug 800280 SUSE bug 816708 SUSE bug 899192 SUSE bug 927257 SUSE bug 929141 SUSE bug 931850 SUSE bug 969340 SUSE bug 989152 CVE-2004-0230 CVE-2012-3412 CVE-2012-3430 CVE-2013-0160 CVE-2013-0216 CVE-2013-1979 CVE-2014-3611 CVE-2014-9922 CVE-2015-3331 CVE-2016-10741 CVE-2016-8632 CVE-2017-14489 CVE-2017-18360 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-15594 CVE-2018-19407 CVE-2018-19824 CVE-2018-19985 CVE-2018-20169 CVE-2018-9568 CVE-2019-11091 CVE-2019-7222 CVE-2019-9213 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues. The following security bugs have been fixed: * CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call (bnc#882804). * CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518). * CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000 (bnc#883724). * CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422). * CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (bnc#887082). * CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction (bnc#889173). * CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. (bnc#892490) * CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. (bnc#892490) * CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) * CVE-2014-4027: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (bnc#882639) * CVE-2014-3153 The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. (bnc#880892) * CVE-2014-6410: Avoid infinite loop when processing indirect ICBs (bnc#896689) The following non-security bugs have been fixed: * ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). * ACPI: Fix bug when ACPI reset register is implemented in system memory (bnc#882900). * ACPI: Limit access to custom_method (bnc#884333). * ALSA: hda - Enabling Realtek ALC 671 codec (bnc#891746). * Add option to automatically enforce module signatures when in Secure Boot mode (bnc#884333). * Add secure_modules() call (bnc#884333). * Add wait_on_atomic_t() and wake_up_atomic_t() (bnc#880344). * Backported new patches of Lock down functions for UEFI secure boot Also updated series.conf and removed old patches. * Btrfs: Return EXDEV for cross file system snapshot. * Btrfs: abort the transaction when we does not find our extent ref. * Btrfs: avoid warning bomb of btrfs_invalidate_inodes. * Btrfs: cancel scrub on transaction abortion. * Btrfs: correctly set profile flags on seqlock retry. * Btrfs: does not check nodes for extent items. * Btrfs: fix a possible deadlock between scrub and transaction committing. * Btrfs: fix corruption after write/fsync failure + fsync + log recovery (bnc#894200). * Btrfs: fix csum tree corruption, duplicate and outdated checksums (bnc#891619). * Btrfs: fix double free in find_lock_delalloc_range. * Btrfs: fix possible memory leak in btrfs_create_tree(). * Btrfs: fix use of uninit "ret" in end_extent_writepage(). * Btrfs: free delayed node outside of root->inode_lock (bnc#866864). * Btrfs: make DEV_INFO ioctl available to anyone. * Btrfs: make FS_INFO ioctl available to anyone. * Btrfs: make device scan less noisy. * Btrfs: make sure there are not any read requests before stopping workers. * Btrfs: more efficient io tree navigation on wait_extent_bit. * Btrfs: output warning instead of error when loading free space cache failed. * Btrfs: retrieve more info from FS_INFO ioctl. * Btrfs: return EPERM when deleting a default subvolume (bnc#869934). * Btrfs: unset DCACHE_DISCONNECTED when mounting default subvol (bnc#866615). * Btrfs: use right type to get real comparison. * Btrfs: wake up @scrub_pause_wait as much as we can. * Btrfs: wake up transaction thread upon remount. * CacheFiles: Add missing retrieval completions (bnc#880344). * CacheFiles: Does not try to dump the index key if the cookie has been cleared (bnc#880344). * CacheFiles: Downgrade the requirements passed to the allocator (bnc#880344). * CacheFiles: Fix the marking of cached pages (bnc#880344). * CacheFiles: Implement invalidation (bnc#880344). * CacheFiles: Make some debugging statements conditional (bnc#880344). * Drivers: hv: util: Fix a bug in the KVP code (bnc#886840). * Drivers: hv: vmbus: Fix a bug in the channel callback dispatch code (bnc#886840). * FS-Cache: Add transition to handle invalidate immediately after lookup (bnc#880344). * FS-Cache: Check that there are no read ops when cookie relinquished (bnc#880344). * FS-Cache: Clear remaining page count on retrieval cancellation (bnc#880344). * FS-Cache: Convert the object event ID #defines into an enum (bnc#880344). * FS-Cache: Does not sleep in page release if __GFP_FS is not set (bnc#880344). * FS-Cache: Does not use spin_is_locked() in assertions (bnc#880344). * FS-Cache: Exclusive op submission can BUG if there is been an I/O error (bnc#880344). * FS-Cache: Fix __wait_on_atomic_t() to call the action func if the counter != 0 (bnc#880344). * FS-Cache: Fix object state machine to have separate work and wait states (bnc#880344). * FS-Cache: Fix operation state management and accounting (bnc#880344). * FS-Cache: Fix signal handling during waits (bnc#880344). * FS-Cache: Initialise the object event mask with the calculated mask (bnc#880344). * FS-Cache: Limit the number of I/O error reports for a cache (bnc#880344). * FS-Cache: Make cookie relinquishment wait for outstanding reads (bnc#880344). * FS-Cache: Mark cancellation of in-progress operation (bnc#880344). * FS-Cache: One of the write operation paths doeses not set the object state (bnc#880344). * FS-Cache: Provide proper invalidation (bnc#880344). * FS-Cache: Simplify cookie retention for fscache_objects, fixing oops (bnc#880344). * FS-Cache: The retrieval remaining-pages counter needs to be atomic_t (bnc#880344). * FS-Cache: Uninline fscache_object_init() (bnc#880344). * FS-Cache: Wrap checks on object state (bnc#880344). * HID: usbhid: add always-poll quirk (bnc#888607). * HID: usbhid: enable always-poll quirk for Elan Touchscreen (bnc#888607). * IB/iser: Add TIMEWAIT_EXIT event handling (bnc#890297). * Ignore "flags" change to event_constraint (bnc#876114). * Ignore data_src/weight changes to perf_sample_data (bnc#876114). * NFS: Allow more operations in an NFSv4.1 request (bnc#890513). * NFS: Clean up helper function nfs4_select_rw_stateid() (bnc#888968). * NFS: Does not copy read delegation stateids in setattr (bnc#888968). * NFS: Does not use a delegation to open a file when returning that delegation (bnc#888968, bnc#892200, bnc#893596, bnc#893496) * NFS: Fixes for NFS RCU-walk support in line with code going upstream * NFS: Use FS-Cache invalidation (bnc#880344). * NFS: allow lockless access to access_cache (bnc#866130). * NFS: avoid mountpoint being displayed as " (deleted)" in /proc/mounts (bnc#888591). * NFS: nfs4_do_open should add negative results to the dcache (bnc#866130). * NFS: nfs_migrate_page() does not wait for FS-Cache to finish with a page (bnc#880344). * NFS: nfs_open_revalidate: only evaluate parent if it will be used (bnc#866130). * NFS: prepare for RCU-walk support but pushing tests later in code (bnc#866130). * NFS: support RCU_WALK in nfs_permission() (bnc#866130). * NFS: teach nfs_lookup_verify_inode to handle LOOKUP_RCU (bnc#866130). * NFS: teach nfs_neg_need_reval to understand LOOKUP_RCU (bnc#866130). * NFSD: Does not hand out delegations for 30 seconds after recalling them (bnc#880370). * NFSv4 set open access operation call flag in nfs4_init_opendata_res (bnc#888968, bnc#892200, bnc#893596, bnc#893496). * NFSv4: Add a helper for encoding opaque data (bnc#888968). * NFSv4: Add a helper for encoding stateids (bnc#888968). * NFSv4: Add helpers for basic copying of stateids (bnc#888968). * NFSv4: Clean up nfs4_select_rw_stateid() (bnc#888968). * NFSv4: Fix the return value of nfs4_select_rw_stateid (bnc#888968). * NFSv4: Rename nfs4_copy_stateid() (bnc#888968). * NFSv4: Resend the READ/WRITE RPC call if a stateid change causes an error (bnc#888968). * NFSv4: Simplify the struct nfs4_stateid (bnc#888968). * NFSv4: The stateid must remain the same for replayed RPC calls (bnc#888968). * NFSv4: nfs4_stateid_is_current should return "true" for an invalid stateid (bnc#888968). * One more fix for kABI breakage. * PCI: Lock down BAR access when module security is enabled (bnc#884333). * PCI: enable MPS "performance" setting to properly handle bridge MPS (bnc#883376). * PM / Hibernate: Add memory_rtree_find_bit function (bnc#860441). * PM / Hibernate: Create a Radix-Tree to store memory bitmap (bnc#860441). * PM / Hibernate: Implement position keeping in radix tree (bnc#860441). * PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free() (bnc#860441). * PM / Hibernate: Remove the old memory-bitmap implementation (bnc#860441). * PM / Hibernate: Touch Soft Lockup Watchdog in rtree_next_node (bnc#860441). * Restrict /dev/mem and /dev/kmem when module loading is restricted (bnc#884333). * Reuse existing "state" field to indicate PERF_X86_EVENT_PEBS_LDLAT (bnc#876114). * USB: handle LPM errors during device suspend correctly (bnc#849123). * Update kabi files to reflect fscache change (bnc#880344) * Update x86_64 config files: re-enable SENSORS_W83627EHF (bnc#891281) * VFS: Make more complete truncate operation available to CacheFiles (bnc#880344). * [FEAT NET1222] ib_uverbs: Allow explicit mmio trigger (FATE#83366, ltc#83367). * acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted (bnc#884333). * af_iucv: correct cleanup if listen backlog is full (bnc#885262, LTC#111728). * asus-wmi: Restrict debugfs interface when module loading is restricted (bnc#884333). * autofs4: allow RCU-walk to walk through autofs4 (bnc#866130). * autofs4: avoid taking fs_lock during rcu-walk (bnc#866130). * autofs4: does not take spinlock when not needed in autofs4_lookup_expiring (bnc#866130). * autofs4: factor should_expire() out of autofs4_expire_indirect (bnc#866130). * autofs4: make "autofs4_can_expire" idempotent (bnc#866130). * autofs4: remove a redundant assignment (bnc#866130). * autofs: fix lockref lookup (bnc#888591). * be2net: add dma_mapping_error() check for dma_map_page() (bnc#881759). * block: add cond_resched() to potentially long running ioctl discard loop (bnc#884725). * block: fix race between request completion and timeout handling (bnc#881051). * cdc-ether: clean packet filter upon probe (bnc#876017). * cpuset: Fix memory allocator deadlock (bnc#876590). * crypto: Allow CRYPTO_FIPS without MODULE_SIGNATURES. Not all archs have them, but some are FIPS certified, with some kernel support. * crypto: fips - only panic on bad/missing crypto mod signatures (bnc#887503). * crypto: testmgr - allow aesni-intel and ghash_clmulni-intel in fips mode (bnc#889451). * dasd: validate request size before building CCW/TCW (bnc#891087, LTC#114068). * dm mpath: fix race condition between multipath_dtr and pg_init_done (bnc#826486). * dm-mpath: fix panic on deleting sg device (bnc#870161). * drm/ast: AST2000 cannot be detected correctly (bnc#895983). * drm/ast: Actually load DP501 firmware when required (bnc#895608 bnc#871134). * drm/ast: Add missing entry to dclk_table[]. * drm/ast: Add reduced non reduced mode parsing for wide screen mode (bnc#892723). * drm/ast: initial DP501 support (v0.2) (bnc#871134). * drm/ast: open key before detect chips (bnc#895983). * drm/i915: Fix up cpt pixel multiplier enable sequence (bnc#879304). * drm/i915: Only apply DPMS to the encoder if enabled (bnc#893064). * drm/i915: clear the FPGA_DBG_RM_NOCLAIM bit at driver init (bnc#869055). * drm/i915: create functions for the "unclaimed register" checks (bnc#869055). * drm/i915: use FPGA_DBG for the "unclaimed register" checks (bnc#869055). * drm/mgag200: Initialize data needed to map fbdev memory (bnc #806990). * e1000e: enable support for new device IDs (bnc#885509). * fs/fscache: remove spin_lock() from the condition in while() (bnc#880344). * hibernate: Disable in a signed modules environment (bnc#884333). * hugetlb: does not use ERR_PTR with VM_FAULT* values * ibmvscsi: Abort init sequence during error recovery (bnc#885382). * ibmvscsi: Add memory barriers for send / receive (bnc#885382). * inet: add a redirect generation id in inetpeer (bnc#860593). * inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). * ipv6: tcp: fix tcp_v6_conn_request() (bnc#887645). * kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). * kernel: 3215 tty hang (bnc#891087, LTC#114562). * kernel: fix data corruption when reading /proc/sysinfo (bnc#891087, LTC#114480). * kernel: fix kernel oops with load of fpc register (bnc#889061, LTC#113596). * kernel: sclp console tty reference counting (bnc#891087, LTC#115466). * kexec: Disable at runtime if the kernel enforces module loading restrictions (bnc#884333). * md/raid6: avoid data corruption during recovery of double-degraded RAID6. * memcg, vmscan: Fix forced scan of anonymous pages (memory reclaim fix). * memcg: do not expose uninitialized mem_cgroup_per_node to world (bnc#883096). * mm, hugetlb: add VM_NORESERVE check in vma_has_reserves() * mm, hugetlb: change variable name reservations to resv * mm, hugetlb: decrement reserve count if VM_NORESERVE alloc page cache * mm, hugetlb: defer freeing pages when gathering surplus pages * mm, hugetlb: do not use a page in page cache for cow optimization * mm, hugetlb: fix and clean-up node iteration code to alloc or free * mm, hugetlb: fix race in region tracking * mm, hugetlb: fix subpool accounting handling * mm, hugetlb: improve page-fault scalability * mm, hugetlb: improve, cleanup resv_map parameters * mm, hugetlb: move up the code which check availability of free huge page * mm, hugetlb: protect reserved pages when soft offlining a hugepage * mm, hugetlb: remove decrement_hugepage_resv_vma() * mm, hugetlb: remove redundant list_empty check in gather_surplus_pages() * mm, hugetlb: remove resv_map_put * mm, hugetlb: remove useless check about mapping type * mm, hugetlb: return a reserved page to a reserved pool if failed * mm, hugetlb: trivial commenting fix * mm, hugetlb: unify region structure handling * mm, hugetlb: unify region structure handling kabi * mm, hugetlb: use long vars instead of int in region_count() (Hugetlb Fault Scalability). * mm, hugetlb: use vma_resv_map() map types * mm, oom: fix badness score underflow (bnc#884582, bnc#884767). * mm, oom: normalize oom scores to oom_score_adj scale only for userspace (bnc#884582, bnc#884767). * mm, thp: do not allow thp faults to avoid cpuset restrictions (bnc#888849). * net/mlx4_core: Load higher level modules according to ports type (bnc#887680). * net/mlx4_core: Load the IB driver when the device supports IBoE (bnc#887680). * net/mlx4_en: Fix a race between napi poll function and RX ring cleanup (bnc#863586). * net/mlx4_en: Fix selftest failing on non 10G link speed (bnc#888058). * net: fix checksumming features handling in output path (bnc#891259). * pagecache_limit: batch large nr_to_scan targets (bnc#895221). * pagecachelimit: reduce lru_lock congestion for heavy parallel reclaim fix (bnc#895680). * perf/core: Add weighted samples (bnc#876114). * perf/x86: Add flags to event constraints (bnc#876114). * perf/x86: Add memory profiling via PEBS Load Latency (bnc#876114). * perf: Add generic memory sampling interface (bnc#876114). * qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (bnc#859840). * qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (bnc#859840). * qla2xxx: Does not check for firmware hung during the reset context for ISP82XX (bnc#859840). * qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (bnc#859840). * qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (bnc#859840). * qla2xxx: Set host can_queue value based on available resources (bnc#859840). * restore smp_mb() in unlock_new_inode() (bnc#890526). * s390/pci: introduce lazy IOTLB flushing for DMA unmap (bnc#889061, LTC#113725). * sched: fix the theoretical signal_wake_up() vs schedule() race (bnc#876055). * sclp_vt220: Enable integrated ASCII console per default (bnc#885262, LTC#112035). * scsi_dh: use missing accessor "scsi_device_from_queue" (bnc#889614). * scsi_transport_fc: Cap dev_loss_tmo by fast_io_fail (bnc#887608). * scsiback: correct grant page unmapping. * scsiback: fix retry handling in __report_luns(). * scsiback: free resources after error. * sunrpc/auth: allow lockless (rcu) lookup of credential cache (bnc#866130). * supported.conf: remove external from drivers/net/veth (bnc#889727) * supported.conf: support net/sched/act_police.ko (bnc#890426) * tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). * tg3: Change nvram command timeout value to 50ms (bnc#855657). * tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#855657). * tg3: Set the MAC clock to the fastest speed during boot code load (bnc#855657). * usb: Does not enable LPM if the exit latency is zero (bnc#832309). * usbcore: Does not log on consecutive debounce failures of the same port (bnc#888105). * usbhid: fix PIXART optical mouse (bnc#888607). * uswsusp: Disable when module loading is restricted (bnc#884333). * vscsi: support larger transfer sizes (bnc#774818). * writeback: Do not sync data dirtied after sync start (bnc#833820). * x86 thermal: Delete power-limit-notification console messages (bnc#882317). * x86 thermal: Disable power limit notification interrupt by default (bnc#882317). * x86 thermal: Re-enable power limit notification interrupt by default (bnc#882317). * x86, cpu hotplug: Fix stack frame warning in check_irq_vectors_for_cpu_disable() (bnc#887418). * x86/UV: Add call to KGDB/KDB from NMI handler (bnc#888847). * x86/UV: Add kdump to UV NMI handler (bnc#888847). * x86/UV: Add summary of cpu activity to UV NMI handler (bnc#888847). * x86/UV: Move NMI support (bnc#888847). * x86/UV: Update UV support for external NMI signals (bnc#888847). * x86/uv/nmi: Fix Sparse warnings (bnc#888847). * x86: Add check for number of available vectors before CPU down (bnc#887418). * x86: Lock down IO port access when module security is enabled (bnc#884333). * x86: Restrict MSR access when module loading is restricted (bnc#884333). Security Issues: * CVE-2013-1979 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1979> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-4027 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027> * CVE-2014-4171 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4171> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4943 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077> * CVE-2014-5471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5471> * CVE-2014-5472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5472> * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> * CVE-2014-6410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6410> The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues. Following security bugs were fixed: CVE-2013-1979: The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application (bnc#816708). CVE-2014-1739: The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call (bnc#882804). CVE-2014-4171: mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call (bnc#883518). CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000 (bnc#883724). CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet (bnc#885422). CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket (bnc#887082). CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction (bnc#889173). CVE-2014-5471: Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry. (bnc#892490) CVE-2014-5472: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. (bnc#892490) CVE-2014-2706: Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c. (bnc#871797) CVE-2014-4027: The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (bnc#882639) The following non-security bugs were fixed: - ACPI / PAD: call schedule() when need_resched() is true (bnc#866911). - ACPI: Fix bug when ACPI reset register is implemented in system memory (bnc#882900). - ACPI: Limit access to custom_method (bnc#884333). - Add option to automatically enforce module signatures when in Secure Boot mode (bnc#884333). - Add secure_modules() call (bnc#884333). - Add wait_on_atomic_t() and wake_up_atomic_t() (bnc#880344). - Backported new patches of Lock down functions for UEFI secure boot Also updated series.conf and removed old patches. - Btrfs: Return EXDEV for cross file system snapshot. - Btrfs: abort the transaction when we does not find our extent ref. - Btrfs: avoid warning bomb of btrfs_invalidate_inodes. - Btrfs: cancel scrub on transaction abortion. - Btrfs: correctly set profile flags on seqlock retry. - Btrfs: does not check nodes for extent items. - Btrfs: fix a possible deadlock between scrub and transaction committing. - Btrfs: fix corruption after write/fsync failure + fsync + log recovery (bnc#894200). - Btrfs: fix csum tree corruption, duplicate and outdated checksums (bnc#891619). - Btrfs: fix double free in find_lock_delalloc_range. - Btrfs: fix possible memory leak in btrfs_create_tree(). - Btrfs: fix use of uninit "ret" in end_extent_writepage(). - Btrfs: free delayed node outside of root->inode_lock (bnc#866864). - Btrfs: make DEV_INFO ioctl available to anyone. - Btrfs: make FS_INFO ioctl available to anyone. - Btrfs: make device scan less noisy. - Btrfs: make sure there are not any read requests before stopping workers. - Btrfs: more efficient io tree navigation on wait_extent_bit. - Btrfs: output warning instead of error when loading free space cache failed. - Btrfs: retrieve more info from FS_INFO ioctl. - Btrfs: return EPERM when deleting a default subvolume (bnc#869934). - Btrfs: unset DCACHE_DISCONNECTED when mounting default subvol (bnc#866615). - Btrfs: use right type to get real comparison. - Btrfs: wake up @scrub_pause_wait as much as we can. - Btrfs: wake up transaction thread upon remount. - CacheFiles: Add missing retrieval completions (bnc#880344). - CacheFiles: Does not try to dump the index key if the cookie has been cleared (bnc#880344). - CacheFiles: Downgrade the requirements passed to the allocator (bnc#880344). - CacheFiles: Fix the marking of cached pages (bnc#880344). - CacheFiles: Implement invalidation (bnc#880344). - CacheFiles: Make some debugging statements conditional (bnc#880344). - Drivers: hv: util: Fix a bug in the KVP code (bnc#886840). - Drivers: hv: vmbus: Fix a bug in the channel callback dispatch code (bnc#886840). - FS-Cache: Add transition to handle invalidate immediately after lookup (bnc#880344). - FS-Cache: Check that there are no read ops when cookie relinquished (bnc#880344). - FS-Cache: Clear remaining page count on retrieval cancellation (bnc#880344). - FS-Cache: Convert the object event ID #defines into an enum (bnc#880344). - FS-Cache: Does not sleep in page release if __GFP_FS is not set (bnc#880344). - FS-Cache: Does not use spin_is_locked() in assertions (bnc#880344). - FS-Cache: Exclusive op submission can BUG if there is been an I/O error (bnc#880344). - FS-Cache: Fix __wait_on_atomic_t() to call the action func if the counter != 0 (bnc#880344). - FS-Cache: Fix object state machine to have separate work and wait states (bnc#880344). - FS-Cache: Fix operation state management and accounting (bnc#880344). - FS-Cache: Fix signal handling during waits (bnc#880344). - FS-Cache: Initialise the object event mask with the calculated mask (bnc#880344). - FS-Cache: Limit the number of I/O error reports for a cache (bnc#880344). - FS-Cache: Make cookie relinquishment wait for outstanding reads (bnc#880344). - FS-Cache: Mark cancellation of in-progress operation (bnc#880344). - FS-Cache: One of the write operation paths doeses not set the object state (bnc#880344). - FS-Cache: Provide proper invalidation (bnc#880344). - FS-Cache: Simplify cookie retention for fscache_objects, fixing oops (bnc#880344). - FS-Cache: The retrieval remaining-pages counter needs to be atomic_t (bnc#880344). - FS-Cache: Uninline fscache_object_init() (bnc#880344). - FS-Cache: Wrap checks on object state (bnc#880344). - HID: usbhid: add always-poll quirk (bnc#888607). - HID: usbhid: enable always-poll quirk for Elan Touchscreen (bnc#888607). - IB/iser: Add TIMEWAIT_EXIT event handling (bnc#890297). - Ignore "flags" change to event_constraint (bnc#876114). - Ignore data_src/weight changes to perf_sample_data (bnc#876114). - NFS: Allow more operations in an NFSv4.1 request (bnc#890513). - NFS: Clean up helper function nfs4_select_rw_stateid() (bnc#888968). - NFS: Does not copy read delegation stateids in setattr (bnc#888968). - NFS: Does not use a delegation to open a file when returning that delegation (bnc#888968, bnc#892200, bnc#893596, bnc#893496) - NFS: Fixes for NFS RCU-walk support in line with code going upstream - NFS: Use FS-Cache invalidation (bnc#880344). - NFS: allow lockless access to access_cache (bnc#866130). - NFS: avoid mountpoint being displayed as " (deleted)" in /proc/mounts (bnc#888591). - NFS: nfs4_do_open should add negative results to the dcache (bnc#866130). - NFS: nfs_migrate_page() does not wait for FS-Cache to finish with a page (bnc#880344). - NFS: nfs_open_revalidate: only evaluate parent if it will be used (bnc#866130). - NFS: prepare for RCU-walk support but pushing tests later in code (bnc#866130). - NFS: support RCU_WALK in nfs_permission() (bnc#866130). - NFS: teach nfs_lookup_verify_inode to handle LOOKUP_RCU (bnc#866130). - NFS: teach nfs_neg_need_reval to understand LOOKUP_RCU (bnc#866130). - NFSD: Does not hand out delegations for 30 seconds after recalling them (bnc#880370). - NFSv4 set open access operation call flag in nfs4_init_opendata_res (bnc#888968, bnc#892200, bnc#893596, bnc#893496). - NFSv4: Add a helper for encoding opaque data (bnc#888968). - NFSv4: Add a helper for encoding stateids (bnc#888968). - NFSv4: Add helpers for basic copying of stateids (bnc#888968). - NFSv4: Clean up nfs4_select_rw_stateid() (bnc#888968). - NFSv4: Fix the return value of nfs4_select_rw_stateid (bnc#888968). - NFSv4: Rename nfs4_copy_stateid() (bnc#888968). - NFSv4: Resend the READ/WRITE RPC call if a stateid change causes an error (bnc#888968). - NFSv4: Simplify the struct nfs4_stateid (bnc#888968). - NFSv4: The stateid must remain the same for replayed RPC calls (bnc#888968). - NFSv4: nfs4_stateid_is_current should return "true" for an invalid stateid (bnc#888968). - One more fix for kABI breakage. - PCI: Lock down BAR access when module security is enabled (bnc#884333). - PCI: enable MPS "performance" setting to properly handle bridge MPS (bnc#883376). - PM / Hibernate: Add memory_rtree_find_bit function (bnc#860441). - PM / Hibernate: Create a Radix-Tree to store memory bitmap (bnc#860441). - PM / Hibernate: Implement position keeping in radix tree (bnc#860441). - PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free() (bnc#860441). - PM / Hibernate: Remove the old memory-bitmap implementation (bnc#860441). - PM / Hibernate: Touch Soft Lockup Watchdog in rtree_next_node (bnc#860441). - Restrict /dev/mem and /dev/kmem when module loading is restricted (bnc#884333). - Reuse existing "state" field to indicate PERF_X86_EVENT_PEBS_LDLAT (bnc#876114). - USB: handle LPM errors during device suspend correctly (bnc#849123). - Update kabi files to reflect fscache change (bnc#880344) - VFS: Make more complete truncate operation available to CacheFiles (bnc#880344). - [FEAT NET1222] ib_uverbs: Allow explicit mmio trigger (FATE#83366, ltc#83367). - acpi: Ignore acpi_rsdp kernel parameter when module loading is restricted (bnc#884333). - af_iucv: correct cleanup if listen backlog is full (bnc#885262, LTC#111728). - asus-wmi: Restrict debugfs interface when module loading is restricted (bnc#884333). - autofs4: allow RCU-walk to walk through autofs4 (bnc#866130). - autofs4: avoid taking fs_lock during rcu-walk (bnc#866130). - autofs4: does not take spinlock when not needed in autofs4_lookup_expiring (bnc#866130). - autofs4: factor should_expire() out of autofs4_expire_indirect (bnc#866130). - autofs4: make "autofs4_can_expire" idempotent (bnc#866130). - autofs4: remove a redundant assignment (bnc#866130). - autofs: fix lockref lookup (bnc#888591). - be2net: add dma_mapping_error() check for dma_map_page() (bnc#881759). - block: add cond_resched() to potentially long running ioctl discard loop (bnc#884725). - block: fix race between request completion and timeout handling (bnc#881051). - cdc-ether: clean packet filter upon probe (bnc#876017). - cpuset: Fix memory allocator deadlock (bnc#876590). - crypto: Allow CRYPTO_FIPS without MODULE_SIGNATURES. Not all archs have them, but some are FIPS certified, with some kernel support. - crypto: fips - only panic on bad/missing crypto mod signatures (bnc#887503). - crypto: testmgr - allow aesni-intel and ghash_clmulni-intel in fips mode (bnc#889451). - dasd: validate request size before building CCW/TCW (bnc#891087, LTC#114068). - dm mpath: fix race condition between multipath_dtr and pg_init_done (bnc#826486). - dm-mpath: fix panic on deleting sg device (bnc#870161). - drm/ast: Add missing entry to dclk_table[]. - drm/ast: Add reduced non reduced mode parsing for wide screen mode (bnc#892723). - drm/i915: Only apply DPMS to the encoder if enabled (bnc#893064). - drm/i915: clear the FPGA_DBG_RM_NOCLAIM bit at driver init (bnc#869055). - drm/i915: create functions for the "unclaimed register" checks (bnc#869055). - drm/i915: use FPGA_DBG for the "unclaimed register" checks (bnc#869055). - drm/mgag200: Initialize data needed to map fbdev memory (bnc #806990). - e1000e: enable support for new device IDs (bnc#885509). - fs/fscache: remove spin_lock() from the condition in while() (bnc#880344). - hibernate: Disable in a signed modules environment (bnc#884333). - hugetlb: does not use ERR_PTR with VM_FAULT* values - ibmvscsi: Abort init sequence during error recovery (bnc#885382). - ibmvscsi: Add memory barriers for send / receive (bnc#885382). - inet: add a redirect generation id in inetpeer (bnc#860593). - inetpeer: initialize ->redirect_genid in inet_getpeer() (bnc#860593). - ipv6: tcp: fix tcp_v6_conn_request() (bnc#887645). - kabi: hide bnc#860593 changes of struct inetpeer_addr_base (bnc#860593). - kernel: 3215 tty hang (bnc#891087, LTC#114562). - kernel: fix data corruption when reading /proc/sysinfo (bnc#891087, LTC#114480). - kernel: fix kernel oops with load of fpc register (bnc#889061, LTC#113596). - kernel: sclp console tty reference counting (bnc#891087, LTC#115466). - kexec: Disable at runtime if the kernel enforces module loading restrictions (bnc#884333). - md/raid6: avoid data corruption during recovery of double-degraded RAID6. - memcg, vmscan: Fix forced scan of anonymous pages (memory reclaim fix). - mm, hugetlb: add VM_NORESERVE check in vma_has_reserves() - mm, hugetlb: change variable name reservations to resv - mm, hugetlb: decrement reserve count if VM_NORESERVE alloc page cache - mm, hugetlb: defer freeing pages when gathering surplus pages - mm, hugetlb: do not use a page in page cache for cow optimization - mm, hugetlb: fix and clean-up node iteration code to alloc or free - mm, hugetlb: fix race in region tracking - mm, hugetlb: fix subpool accounting handling - mm, hugetlb: improve page-fault scalability - mm, hugetlb: improve, cleanup resv_map parameters - mm, hugetlb: move up the code which check availability of free huge page - mm, hugetlb: protect reserved pages when soft offlining a hugepage - mm, hugetlb: remove decrement_hugepage_resv_vma() - mm, hugetlb: remove redundant list_empty check in gather_surplus_pages() - mm, hugetlb: remove resv_map_put - mm, hugetlb: remove useless check about mapping type - mm, hugetlb: return a reserved page to a reserved pool if failed - mm, hugetlb: trivial commenting fix - mm, hugetlb: unify region structure handling - mm, hugetlb: unify region structure handling kabi - mm, hugetlb: use long vars instead of int in region_count() (Hugetlb Fault Scalability). - mm, hugetlb: use vma_resv_map() map types - mm, oom: fix badness score underflow (bnc#884582, bnc#884767). - mm, oom: normalize oom scores to oom_score_adj scale only for userspace (bnc#884582, bnc#884767). - mm, thp: do not allow thp faults to avoid cpuset restrictions (bnc#888849). - net/mlx4_core: Load higher level modules according to ports type (bnc#887680). - net/mlx4_core: Load the IB driver when the device supports IBoE (bnc#887680). - net/mlx4_en: Fix a race between napi poll function and RX ring cleanup (bnc#863586). - net/mlx4_en: Fix selftest failing on non 10G link speed (bnc#888058). - net: fix checksumming features handling in output path (bnc#891259). - perf/core: Add weighted samples (bnc#876114). - perf/x86: Add flags to event constraints (bnc#876114). - perf/x86: Add memory profiling via PEBS Load Latency (bnc#876114). - perf: Add generic memory sampling interface (bnc#876114). - qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (bnc#859840). - qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (bnc#859840). - qla2xxx: Does not check for firmware hung during the reset context for ISP82XX (bnc#859840). - qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (bnc#859840). - qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (bnc#859840). - qla2xxx: Set host can_queue value based on available resources (bnc#859840). - restore smp_mb() in unlock_new_inode() (bnc#890526). - s390/pci: introduce lazy IOTLB flushing for DMA unmap (bnc#889061, LTC#113725). - sched: fix the theoretical signal_wake_up() vs schedule() race (bnc#876055). - sclp_vt220: Enable integrated ASCII console per default (bnc#885262, LTC#112035). - scsi_dh: use missing accessor "scsi_device_from_queue" (bnc#889614). - scsi_transport_fc: Cap dev_loss_tmo by fast_io_fail (bnc#887608). - scsiback: correct grant page unmapping. - scsiback: fix retry handling in __report_luns(). - scsiback: free resources after error. - sunrpc/auth: allow lockless (rcu) lookup of credential cache (bnc#866130). - supported.conf: remove external from drivers/net/veth (bnc#889727) - supported.conf: support net/sched/act_police.ko (bnc#890426) - tcp: adapt selected parts of RFC 5682 and PRR logic (bnc#879921). - tg3: Change nvram command timeout value to 50ms (bnc#855657). - tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#855657). - tg3: Set the MAC clock to the fastest speed during boot code load (bnc#855657). - usb: Does not enable LPM if the exit latency is zero (bnc#832309). - usbcore: Does not log on consecutive debounce failures of the same port (bnc#888105). - usbhid: fix PIXART optical mouse (bnc#888607). - uswsusp: Disable when module loading is restricted (bnc#884333). - vscsi: support larger transfer sizes (bnc#774818). - x86 thermal: Delete power-limit-notification console messages (bnc#882317). - x86 thermal: Disable power limit notification interrupt by default (bnc#882317). - x86 thermal: Re-enable power limit notification interrupt by default (bnc#882317). - x86/UV: Add call to KGDB/KDB from NMI handler (bnc#888847). - x86/UV: Add kdump to UV NMI handler (bnc#888847). - x86/UV: Add summary of cpu activity to UV NMI handler (bnc#888847). - x86/UV: Move NMI support (bnc#888847). - x86/UV: Update UV support for external NMI signals (bnc#888847). - x86/uv/nmi: Fix Sparse warnings (bnc#888847). - x86: Lock down IO port access when module security is enabled (bnc#884333). - x86: Restrict MSR access when module loading is restricted (bnc#884333). Security Issues: * CVE-2013-1979 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1979> * CVE-2014-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1739> * CVE-2014-2706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2706> * CVE-2014-4027 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4027> * CVE-2014-4171 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4171> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4943 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077> * CVE-2014-5471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5471> * CVE-2014-5472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5472> SUSE bug 774818 SUSE bug 806990 SUSE bug 816708 SUSE bug 826486 SUSE bug 832309 SUSE bug 849123 SUSE bug 855657 SUSE bug 859840 SUSE bug 860441 SUSE bug 860593 SUSE bug 863586 SUSE bug 866130 SUSE bug 866615 SUSE bug 866864 SUSE bug 866911 SUSE bug 869055 SUSE bug 869934 SUSE bug 870161 SUSE bug 871797 SUSE bug 876017 SUSE bug 876055 SUSE bug 876114 SUSE bug 876590 SUSE bug 879921 SUSE bug 880344 SUSE bug 880370 SUSE bug 881051 SUSE bug 881759 SUSE bug 882317 SUSE bug 882639 SUSE bug 882804 SUSE bug 882900 SUSE bug 883376 SUSE bug 883518 SUSE bug 883724 SUSE bug 884333 SUSE bug 884582 SUSE bug 884725 SUSE bug 884767 SUSE bug 885262 SUSE bug 885382 SUSE bug 885422 SUSE bug 885509 SUSE bug 886840 SUSE bug 887082 SUSE bug 887503 SUSE bug 887608 SUSE bug 887645 SUSE bug 887680 SUSE bug 888058 SUSE bug 888105 SUSE bug 888591 SUSE bug 888607 SUSE bug 888847 SUSE bug 888849 SUSE bug 888968 SUSE bug 889061 SUSE bug 889173 SUSE bug 889451 SUSE bug 889614 SUSE bug 889727 SUSE bug 890297 SUSE bug 890426 SUSE bug 890513 SUSE bug 890526 SUSE bug 891087 SUSE bug 891259 SUSE bug 891619 SUSE bug 892200 SUSE bug 892490 SUSE bug 892723 SUSE bug 893064 SUSE bug 893496 SUSE bug 893596 SUSE bug 894200 CVE-2013-1979 CVE-2014-1739 CVE-2014-2706 CVE-2014-4027 CVE-2014-4171 CVE-2014-4508 CVE-2014-4667 CVE-2014-4943 CVE-2014-5077 CVE-2014-5471 CVE-2014-5472 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bug was fixed: - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) The following non-security bugs were fixed: - KVM: x86: Sync back MSR_IA32_SPEC_CTRL to VCPU data structure (bsc#1096242, bsc#1096281). - Xen counterparts of eager FPU implementation. - x86/boot: Fix early command-line parsing when partial word matches (bsc#1096140). - x86/bugs: spec_ctrl must be cleared from cpu_caps_set when being disabled (bsc#1096140). - xen/x86/CPU: Check speculation control CPUID bit (bsc#1068032). - xen/x86/CPU: Sync CPU feature flags late (bsc#1075994 bsc#1075091). - xen/x86/cpu: Factor out application of forced CPU caps (bsc#1075994 bsc#1075091). - xen/x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option (bsc#1065600). - xen/x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088). - xen/x86/entry: Use IBRS on entry to kernel space (bsc#1068032). - xen/x86/idle: Toggle IBRS when going idle (bsc#1068032). - xen/x86/kaiser: Move feature detection up (bsc#1068032). Important SUSE bug 1065600 SUSE bug 1068032 SUSE bug 1075091 SUSE bug 1075994 SUSE bug 1087086 SUSE bug 1087088 SUSE bug 1096140 SUSE bug 1096242 SUSE bug 1096281 CVE-2018-3665 SUSE Linux Enterprise Server 11 SP3 The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to receive various security and bugfixes. Following security bugs were fixed: - CVE-2015-8104: Prevent guest to host DoS caused by infinite loop in microcode via #DB exception (bsc#954404). - CVE-2015-5307: Prevent guest to host DoS caused by infinite loop in microcode via #AC exception (bsc#953527). - CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#952384). - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux kernel on the x86_64 platform mishandled IRET faults in processing NMIs that occurred during userspace execution, which might have allowed local users to gain privileges by triggering an NMI (bsc#938706). - CVE-2015-7872: Possible crash when trying to garbage collect an uninstantiated keyring (bsc#951440). - CVE-2015-0272: Prevent remote DoS using IPv6 RA with bogus MTU by validating before applying it (bsc#944296). - CVE-2015-6937: The __rds_conn_create function in net/rds/connection.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound (bsc#945825). - CVE-2015-6252: The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggered permanent file-descriptor allocation (bsc#942367). The following non-security bugs were fixed: - alsa: hda - Disable 64bit address for Creative HDA controllers (bsc#814440). - btrfs: fix hang when failing to submit bio of directIO (bsc#942688). - btrfs: fix memory corruption on failure to submit bio for direct IO (bsc#942688). - btrfs: fix put dio bio twice when we submit dio bio fail (bsc#942688). - dm sysfs: introduce ability to add writable attributes (bsc#904348). - dm-snap: avoid deadock on s->lock when a read is split (bsc#939826). - dm: do not start current request if it would have merged with the previous (bsc#904348). - dm: impose configurable deadline for dm_request_fn merge heuristic (bsc#904348). - drm/i915: (re)init HPD interrupt storm statistics (bsc#942938). - drm/i915: Add HPD IRQ storm detection (v5) (bsc#942938). - drm/i915: Add Reenable Timer to turn Hotplug Detection back on (v4) (bsc#942938). - drm/i915: Add bit field to record which pins have received HPD events (v3) (bsc#942938). - drm/i915: Add enum hpd_pin to intel_encoder (bsc#942938). - drm/i915: Add messages useful for HPD storm detection debugging (v2) (bsc#942938). - drm/i915: Avoid race of intel_crt_detect_hotplug() with HPD interrupt (bsc#942938). - drm/i915: Convert HPD interrupts to make use of HPD pin assignment in encoders (v2) (bsc#942938). - drm/i915: Disable HPD interrupt on pin when irq storm is detected (v3) (bsc#942938). - drm/i915: Do not WARN nor handle unexpected hpd interrupts on gmch platforms (bsc#942938). - drm/i915: Enable hotplug interrupts after querying hw capabilities (bsc#942938). - drm/i915: Fix DDC probe for passive adapters (bsc#900610, fdo#85924). - drm/i915: Fix hotplug interrupt enabling for SDVOC (bsc#942938). - drm/i915: Fix up sdvo hpd pins for i965g/gm (bsc#942938). - drm/i915: Get rid if the "^A" in struct drm_i915_private (bsc#942938). - drm/i915: Make hpd arrays big enough to avoid out of bounds access (bsc#942938). - drm/i915: Mask out the HPD irq bits before setting them individually (bsc#942938). - drm/i915: Only print hotplug event message when hotplug bit is set (bsc#942938). - drm/i915: Only reprobe display on encoder which has received an HPD event (v2) (bsc#942938). - drm/i915: Queue reenable timer also when enable_hotplug_processing is false (bsc#942938). - drm/i915: Remove i965_hpd_irq_setup (bsc#942938). - drm/i915: Remove pch_rq_mask from struct drm_i915_private (bsc#942938). - drm/i915: Remove valleyview_hpd_irq_setup (bsc#942938). - drm/i915: Use an interrupt save spinlock in intel_hpd_irq_handler() (bsc#942938). - drm/i915: WARN_ONCE() about unexpected interrupts for all chipsets (bsc#942938). - drm/i915: add hotplug activation period to hotplug update mask (bsc#953980). - drm/i915: assert_spin_locked for pipestat interrupt enable/disable (bsc#942938). - drm/i915: clear crt hotplug compare voltage field before setting (bsc#942938). - drm/i915: close tiny race in the ilk pcu even interrupt setup (bsc#942938). - drm/i915: fix hotplug event bit tracking (bsc#942938). - drm/i915: fix hpd interrupt register locking (bsc#942938). - drm/i915: fix hpd work vs. flush_work in the pageflip code deadlock (bsc#942938). - drm/i915: fix locking around ironlake_enable|disable_display_irq (bsc#942938). - drm/i915: fold the hpd_irq_setup call into intel_hpd_irq_handler (bsc#942938). - drm/i915: fold the no-irq check into intel_hpd_irq_handler (bsc#942938). - drm/i915: fold the queue_work into intel_hpd_irq_handler (bsc#942938). - drm/i915: implement ibx_hpd_irq_setup (bsc#942938). - drm/i915: s/hotplug_irq_storm_detect/intel_hpd_irq_handler/ (bsc#942938). - ehci-pci: enable interrupt on BayTrail (bnc926007). - fix lpfc_send_rscn_event allocation size claims bsc#935757 - hugetlb: simplify migrate_huge_page() (bsc#947957, VM Functionality). - hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage (bsc#947957). - ib/iser: Add Discovery support (bsc#923002). - ib/iser: Move informational messages from error to info level (bsc#923002). - ib/srp: Avoid skipping srp_reset_host() after a transport error (bsc#904965). - ib/srp: Fix a sporadic crash triggered by cable pulling (bsc#904965). - inotify: Fix nested sleeps in inotify_read() (bsc#940925). - ipv6: fix tunnel error handling (bsc#952579). - ipv6: probe routes asynchronous in rt6_probe (bsc#936118). - ipvs: Fix reuse connection if real server is dead (bsc#945827). - ipvs: drop first packet to dead server (bsc#946078). - keys: Fix race between key destruction and finding a keyring by name (bsc#951440). - ktime: add ktime_after and ktime_before helpe (bsc#904348). - lib/string.c: introduce memchr_inv() (bsc#930788). - libiscsi: Exporting new attrs for iscsi session and connection in sysfs (bsc#923002). - macvlan: Support bonding events bsc#948521 - make sure XPRT_CONNECTING gets cleared when needed (bsc#946309). - memory-failure: do code refactor of soft_offline_page() (bsc#947957). - memory-failure: fix an error of mce_bad_pages statistics (bsc#947957). - memory-failure: use num_poisoned_pages instead of mce_bad_pages (bsc#947957). - memory-hotplug: update mce_bad_pages when removing the memory (bsc#947957). - mm/memory-failure.c: fix wrong num_poisoned_pages in handling memory error on thp (bsc#947957). - mm/memory-failure.c: recheck PageHuge() after hugetlb page migrate successfully (bsc#947957). - mm/migrate.c: pair unlock_page() and lock_page() when migrating huge pages (bsc#947957). - mm: exclude reserved pages from dirtyable memory 32b fix (bsc#940017, bsc#949298). - mm: make page pfmemalloc check more robust (bsc#920016). - netfilter: nf_conntrack_proto_sctp: minimal multihoming support (bsc#932350). - pci: Add VPD function 0 quirk for Intel Ethernet devices (bsc#943786). - pci: Add dev_flags bit to access VPD through function 0 (bsc#943786). - pci: Add flag indicating device has been assigned by KVM (bsc#777565). - pci: Clear NumVFs when disabling SR-IOV in sriov_init() (bsc#952084). - pci: Refresh First VF Offset and VF Stride when updating NumVFs (bsc#952084). - pci: Update NumVFs register when disabling SR-IOV (bsc#952084). - pci: delay configuration of SRIOV capability (bsc#952084). - pci: set pci sriov page size before reading SRIOV BAR (bsc#952084). - pktgen: clean up ktime_t helpers (bsc#904348). - qla2xxx: Do not reset adapter if SRB handle is in range (bsc#944993). - qla2xxx: Remove decrement of sp reference count in abort handler (bsc#944993). - qla2xxx: do not clear slot in outstanding cmd array (bsc#944993). - r8169: remember WOL preferences on driver load (bsc#942305). - rcu: Eliminate deadlock between CPU hotplug and expedited grace periods (bsc#949706). - rtc: cmos: Cancel alarm timer if alarm time is equal to now+1 seconds (bsc#930145). - sched/core: Fix task and run queue sched_info::run_delay inconsistencies (bsc#949100). - scsi: fix scsi_error_handler vs. scsi_host_dev_release race (bsc#942204). - scsi: hosts: update to use ida_simple for host_no (bsc#939926) - scsi: kabi: allow iscsi disocvery session support (bsc#923002). - scsi_transport_iscsi: Exporting new attrs for iscsi session and connection in sysfs (bsc#923002). - sg: fix read() error reporting (bsc#926774). - usb: xhci: Prefer endpoint context dequeue pointer over stopped_trb (bsc#933721). - usb: xhci: Reset a halted endpoint immediately when we encounter a stall (bsc#933721). - usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers (bsc#944989). - usb: xhci: do not start a halted endpoint before its new dequeue is set (bsc#933721). - usb: xhci: handle Config Error Change (CEC) in xhci driver (bsc#933721). - x86/tsc: Change Fast TSC calibration failed from error to info (bsc#942605). - x86: mm: drop TLB flush from ptep_set_access_flags (bsc#948330). - x86: mm: only do a local tlb flush in ptep_set_access_flags() (bsc#948330). - xfs: Fix lost direct IO write in the last block (bsc#949744). - xfs: Fix softlockup in xfs_inode_ag_walk() (bsc#948347). - xfs: add EOFBLOCKS inode tagging/untagging (bsc#930788). - xfs: add XFS_IOC_FREE_EOFBLOCKS ioctl (bsc#930788). - xfs: add background scanning to clear eofblocks inodes (bsc#930788). - xfs: add inode id filtering to eofblocks scan (bsc#930788). - xfs: add minimum file size filtering to eofblocks scan (bsc#930788). - xfs: create function to scan and clear EOFBLOCKS inodes (bsc#930788). - xfs: create helper to check whether to free eofblocks on inode (bsc#930788). - xfs: introduce a common helper xfs_icluster_size_fsb (bsc#932805). - xfs: make xfs_free_eofblocks() non-static, return EAGAIN on trylock failure (bsc#930788). - xfs: support a tag-based inode_ag_iterator (bsc#930788). - xfs: support multiple inode id filtering in eofblocks scan (bsc#930788). - xfs: use xfs_icluster_size_fsb in xfs_bulkstat (bsc#932805). - xfs: use xfs_icluster_size_fsb in xfs_ialloc_inode_init (bsc#932805). - xfs: use xfs_icluster_size_fsb in xfs_ifree_cluster (bsc#932805). - xfs: use xfs_icluster_size_fsb in xfs_imap (bsc#932805). - xhci: Add spurious wakeup quirk for LynxPoint-LP controllers (bsc#949981). - xhci: Allocate correct amount of scratchpad buffers (bsc#933721). - xhci: Calculate old endpoints correctly on device reset (bsc#944831). - xhci: Do not enable/disable RWE on bus suspend/resume (bsc#933721). - xhci: For streams the css flag most be read from the stream-ctx on ep stop (bsc#945691). - xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 (bsc#933721). - xhci: Treat not finding the event_seg on COMP_STOP the same as COMP_STOP_INVAL (bsc#933721). - xhci: Workaround for PME stuck issues in Intel xhci (bsc#933721). - xhci: change xhci 1.0 only restrictions to support xhci 1.1 (bsc#949502). - xhci: do not report PLC when link is in internal resume state (bsc#933721). - xhci: fix isoc endpoint dequeue from advancing too far on transaction error (bsc#944837). - xhci: fix reporting of 0-sized URBs in control endpoint (bsc#933721). - xhci: report U3 when link is in resume state (bsc#933721). - xhci: rework cycle bit checking for new dequeue pointers (bsc#933721). - xhci: use uninterruptible sleep for waiting for internal operations (bsc#939955). Important SUSE bug 777565 SUSE bug 814440 SUSE bug 900610 SUSE bug 904348 SUSE bug 904965 SUSE bug 920016 SUSE bug 923002 SUSE bug 926007 SUSE bug 926709 SUSE bug 926774 SUSE bug 930145 SUSE bug 930788 SUSE bug 932350 SUSE bug 932805 SUSE bug 933721 SUSE bug 935053 SUSE bug 935757 SUSE bug 936118 SUSE bug 938706 SUSE bug 939826 SUSE bug 939926 SUSE bug 939955 SUSE bug 940017 SUSE bug 940925 SUSE bug 941202 SUSE bug 942204 SUSE bug 942305 SUSE bug 942367 SUSE bug 942605 SUSE bug 942688 SUSE bug 942938 SUSE bug 943786 SUSE bug 944296 SUSE bug 944831 SUSE bug 944837 SUSE bug 944989 SUSE bug 944993 SUSE bug 945691 SUSE bug 945825 SUSE bug 945827 SUSE bug 946078 SUSE bug 946309 SUSE bug 947957 SUSE bug 948330 SUSE bug 948347 SUSE bug 948521 SUSE bug 949100 SUSE bug 949298 SUSE bug 949502 SUSE bug 949706 SUSE bug 949744 SUSE bug 949981 SUSE bug 951440 SUSE bug 952084 SUSE bug 952384 SUSE bug 952579 SUSE bug 953527 SUSE bug 953980 SUSE bug 954404 CVE-2015-0272 CVE-2015-5157 CVE-2015-5307 CVE-2015-6252 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 CVE-2015-8104 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to fix one security issue. This security bug was fixed: - CVE-2016-5195: Local privilege escalation using MAP_PRIVATE. It is reportedly exploited in the wild (bsc#1004418). Important SUSE bug 1004418 CVE-2016-5195 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212) - CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415) - CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c (bsc#1030593). - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003) - CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914) - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bsc#1024938) - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235) - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024) - CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722) - CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178) - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066) - CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type (bsc#1029850). - CVE-2017-7184: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel did not validate certain size data after an XFRM_MSG_NEWAE update, which allowed local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability (bsc#1030573) - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213) - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052) - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440) - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579) - CVE-2017-7482: Several missing length checks ticket decode allowing for information leak or potentially code execution (bsc#1046107). - CVE-2017-7487: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel mishandled reference counts, which allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface (bsc#1038879). - CVE-2017-7533: Race condition in the fsnotify implementation in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions (bnc#1049483 1050677 ). - CVE-2017-7542: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket (bnc#1049882). - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bsc#1033336) - CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability. This requires a malicious PCI Card. (bnc#1037994). - CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038544). - CVE-2017-8924: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow (bnc#1037182). - CVE-2017-8925: The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel allowed local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling (bnc#1038981). - CVE-2017-9074: The IPv6 fragmentation implementation in the Linux kernel did not consider that the nexthdr field may be associated with an invalid option, which allowed local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls (bnc#1039882). - CVE-2017-9075: The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bsc#1039883). - CVE-2017-9076: The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bnc#1039885). - CVE-2017-9077: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890 (bsc#1040069). - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bnc#1041431). - CVE-2017-10661: Race condition in fs/timerfd.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bnc#1053152). - CVE-2017-11176: The mq_notify function in the Linux kernel did not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allowed attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact (bnc#1048275). - CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users to gain privileges via a crafted ACPI table (bnc#1049603). - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. (bnc#1053148). - CVE-2017-14051: An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588). - CVE-2017-1000112: Fixed a race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311). - CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary could have overflowed the parport_nr array in the following code (bnc#1039456). - CVE-2017-1000365: The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but did not take the argument and environment pointers into account, which allowed attackers to bypass this limitation (bnc#1039354). - CVE-2017-1000380: sound/core/timer.c in the Linux kernel was vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time (bnc#1044125). The following non-security bugs were fixed: - acpi: Disable APEI error injection if securelevel is set (bsc#972891, bsc#1023051). - blkback/blktap: do not leak stack data via response ring (bsc#1042863 XSA-216). - btrfs: cleanup code of btrfs_balance_delayed_items() (bsc#1034838). - btrfs: do not run delayed nodes again after all nodes flush (bsc#1034838). - btrfs: remove btrfs_end_transaction_dmeta() (bsc#1034838). - btrfs: remove residual code in delayed inode async helper (bsc#1034838). - btrfs: use flags instead of the bool variants in delayed node (bsc#1034838). - cifs: cifs_get_root shouldn't use path with tree name, alternate fix (bsc#963655, bsc#979681, bsc#1027406). - dentry name snapshots (bsc#1049483). - firmware: fix directory creation rule matching with make 3.80 (bsc#1012422). - firmware: fix directory creation rule matching with make 3.82 (bsc#1012422). - Fix vmalloc_fault oops during lazy MMU updates (bsc#948562) (bsc#948562). - hv: do not lose pending heartbeat vmbus packets (bnc#1006919, bnc#1053760). - jbd: do not wait (forever) for stale tid caused by wraparound (bsc#1020229). - jbd: Fix oops in journal_remove_journal_head() (bsc#1017143). - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422) - keys: Disallow keyrings beginning with '.' to be joined as session keyrings (bnc#1035576). - nfs: Avoid getting confused by confused server (bsc#1045416). - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670). - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670). - nfsd: do not risk using duplicate owner/file/delegation ids (bsc#1029212). - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670). - nfs: Make nfs_readdir revalidate less often (bsc#1048232). - pciback: check PF instead of VF for PCI_COMMAND_MEMORY (bsc#957990). - pciback: only check PF if actually dealing with a VF (bsc#999245). - pciback: Save the number of MSI-X entries to be copied later (bsc#957988). - Remove superfluous make flags (bsc#1012422) - Return short read or 0 at end of a raw device, not EIO (bsc#1039594). - Revert "fs/cifs: fix wrongly prefixed path to root (bsc#963655, bsc#979681) - scsi: lpfc: avoid double free of resource identifiers (bsc#989896). - scsi: virtio_scsi: fix memory leak on full queue condition (bsc#1028880). - sunrpc: Clean up the slot table allocation (bsc#1013862). - sunrpc: Initalise the struct xprt upon allocation (bsc#1013862). - usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256). - usb: wusbcore: fix NULL-deref at probe (bsc#1045487). - Use make --output-sync feature when available (bsc#1012422). - Use PF_LESS_THROTTLE in loop device thread (bsc#1027101). - xen/PCI-MSI: fix sysfs teardown in DomU (bsc#986924). Important SUSE bug 1006919 SUSE bug 1012422 SUSE bug 1013862 SUSE bug 1017143 SUSE bug 1020229 SUSE bug 1021256 SUSE bug 1023051 SUSE bug 1024938 SUSE bug 1025013 SUSE bug 1025235 SUSE bug 1026024 SUSE bug 1026722 SUSE bug 1026914 SUSE bug 1027066 SUSE bug 1027101 SUSE bug 1027178 SUSE bug 1027179 SUSE bug 1027406 SUSE bug 1028415 SUSE bug 1028880 SUSE bug 1029212 SUSE bug 1029850 SUSE bug 1030213 SUSE bug 1030573 SUSE bug 1030575 SUSE bug 1030593 SUSE bug 1031003 SUSE bug 1031052 SUSE bug 1031440 SUSE bug 1031481 SUSE bug 1031579 SUSE bug 1031660 SUSE bug 1033287 SUSE bug 1033336 SUSE bug 1034670 SUSE bug 1034838 SUSE bug 1035576 SUSE bug 1037182 SUSE bug 1037183 SUSE bug 1037994 SUSE bug 1038544 SUSE bug 1038564 SUSE bug 1038879 SUSE bug 1038883 SUSE bug 1038981 SUSE bug 1038982 SUSE bug 1039349 SUSE bug 1039354 SUSE bug 1039456 SUSE bug 1039594 SUSE bug 1039882 SUSE bug 1039883 SUSE bug 1039885 SUSE bug 1040069 SUSE bug 1041431 SUSE bug 1042364 SUSE bug 1042863 SUSE bug 1042892 SUSE bug 1044125 SUSE bug 1045416 SUSE bug 1045487 SUSE bug 1046107 SUSE bug 1048232 SUSE bug 1048275 SUSE bug 1049483 SUSE bug 1049603 SUSE bug 1049882 SUSE bug 1050677 SUSE bug 1052311 SUSE bug 1053148 SUSE bug 1053152 SUSE bug 1053760 SUSE bug 1056588 SUSE bug 870618 SUSE bug 948562 SUSE bug 957988 SUSE bug 957990 SUSE bug 963655 SUSE bug 972891 SUSE bug 979681 SUSE bug 983212 SUSE bug 986924 SUSE bug 989896 SUSE bug 999245 CVE-2016-10200 CVE-2016-5243 CVE-2017-1000112 CVE-2017-1000363 CVE-2017-1000365 CVE-2017-1000380 CVE-2017-10661 CVE-2017-11176 CVE-2017-11473 CVE-2017-12762 CVE-2017-14051 CVE-2017-2647 CVE-2017-2671 CVE-2017-5669 CVE-2017-5970 CVE-2017-5986 CVE-2017-6074 CVE-2017-6214 CVE-2017-6348 CVE-2017-6353 CVE-2017-6951 CVE-2017-7184 CVE-2017-7187 CVE-2017-7261 CVE-2017-7294 CVE-2017-7308 CVE-2017-7482 CVE-2017-7487 CVE-2017-7533 CVE-2017-7542 CVE-2017-7616 CVE-2017-8831 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925 CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-9242 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. (bnc#1107829). - CVE-2018-14617: There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bnc#1102870). - CVE-2018-16276: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c where local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges (bnc#1106095). - CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922). The following non-security bugs were fixed: - net: fix neighbours after MAC change (bnc#905299). - powerpc: Fix smp_mb__before_spinlock() (bsc#1110247). - x86/fpu: Do not do __thread_fpu_end() if use_eager_fpu() (bnc#1109967). - x86/fpu: fix signal handling with eager FPU switching (ia32) (bsc#1108227). - retpoline: Introduce start/end markers of indirect thunk (bsc#1113337). Important SUSE bug 1099922 SUSE bug 1102870 SUSE bug 1106095 SUSE bug 1107829 SUSE bug 1108227 SUSE bug 1109967 SUSE bug 1110247 SUSE bug 1113337 SUSE bug 905299 CVE-2018-12896 CVE-2018-14617 CVE-2018-14633 CVE-2018-16276 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise Server 11 SP3 Kernel for Teradata was updated to fix security issues and bugs: The following security bugs have been fixed: - CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server (bsc#1120843) - CVE-2019-11190: The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat (bsc#1132472) - CVE-2018-17972: An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents (bsc#1110785) - CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848) - CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions (bsc#1133188) The following bugs have been fixed: - Updated broken kabi files (bsc#1132268) Important SUSE bug 1110785 SUSE bug 1120843 SUSE bug 1132268 SUSE bug 1132472 SUSE bug 1133188 SUSE bug 1134848 SUSE bug 800280 SUSE bug 801178 CVE-2013-0216 CVE-2013-0231 CVE-2018-17972 CVE-2019-11190 CVE-2019-11486 CVE-2019-11884 CVE-2019-5489 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 kernel version 3.0.101 was updated to 3.12.31 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic. (bsc#1137586) - CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. - CVE-2019-11479: It was possible to send a crafted sequence of SACKs which would fragment the RACK send map. A remote attacker may have been able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection. This would have resulted in excess resource consumption due to low mss values. The following non-security bugs were fixed: - kabi: drop LINUX_MIB_TCPWQUEUETOOBIG snmp counter (bsc#1137586). - mm/fs: fix soft lockup in __shrink_dcache_sb (bsc#1128201). - tcp: add tcp_min_snd_mss sysctl (bsc#1137586). - tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (bsc#1137586). - tcp: limit payload size of sacked skbs (bsc#1137586). - tcp: tcp_fragment() should apply sane memory limits (bsc#1137586). Important SUSE bug 1128201 SUSE bug 1137586 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Kernel for Teradata was updated to receive the following fixes: - CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bsc#1102340) - CVE-2019-11478: The TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service (bsc#1137586, bsc#1139751) - CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bsc#1068032, bsc#1112824) - Added Intel feature bits for Speculation Control (bsc#1130209) - Added definitions for new speculation control MSRs (bsc#1130209) Important SUSE bug 1068032 SUSE bug 1090078 SUSE bug 1102340 SUSE bug 1112824 SUSE bug 1130209 SUSE bug 1137586 SUSE bug 1139751 CVE-2017-5753 CVE-2018-5390 CVE-2019-11478 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for the SUSE Linux Enterprise Server 11 SP3 Kernel for Teradata fixes the following issues: Security issues fixed: - CVE-2019-11478: The TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service (bsc#1137586) - CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358) - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136424) - CVE-2019-3459, CVE-2019-3460: A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1 (bsc#1120758) - CVE-2019-3896: A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS) (bsc#1138943) - CVE-2018-20836: An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bsc#1134395) - CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bsc#1137194) Regular bugs fixed: - Fixed an issue where the error message "Hyper-V eth0: unable to send receive completion pkt" was shown (bsc#1136795) Important SUSE bug 1120758 SUSE bug 1134395 SUSE bug 1136424 SUSE bug 1136795 SUSE bug 1137194 SUSE bug 1137586 SUSE bug 1138943 SUSE bug 1139358 CVE-2018-20836 CVE-2019-1125 CVE-2019-11478 CVE-2019-12614 CVE-2019-3459 CVE-2019-3460 CVE-2019-3846 CVE-2019-3896 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Kernel for Teradata was updated to receive the following fixes: The following security issues have been fixed: - CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network (bsc#1136424) - CVE-2015-9289: In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23 (bsc#1143179) - CVE-2019-14283: In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143191) - CVE-2019-14284: In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default (bsc#1143189) - CVE-2019-11810: An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free (bsc#1134399) - CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages (bsc#1142023) The following bugs have been fixed: - Fixes an issue in add_disk flow (bsc#1104843) Important SUSE bug 1104843 SUSE bug 1134399 SUSE bug 1136424 SUSE bug 1142023 SUSE bug 1143179 SUSE bug 1143189 SUSE bug 1143191 CVE-2015-9289 CVE-2019-11810 CVE-2019-13631 CVE-2019-14283 CVE-2019-14284 CVE-2019-3846 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for the SUSE Linux Enterprise 11 SP3 Kernel for Teradata fixes the following issues: Security issues: - CVE-2019-14835: A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host (bsc#1150112) - CVE-2019-15216: An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver (bsc#1146361) - CVE-2019-9456: In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation (bsc#1150025) - CVE-2019-15927: An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c (bsc#1149522) - CVE-2019-15902: A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bsc#1149376) - CVE-2019-11477: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service (bsc#1137586, bsc#1139751) - CVE-2019-15219: An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver (bsc#1146524) - CVE-2017-18509: An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions (bsc#1145477) - CVE-2019-15212: An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver (bsc#1146391) - CVE-2019-15292: An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c (bsc#1146678) - CVE-2019-15217: An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver (bsc#1146547) - CVE-2018-20976: An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure (bsc#1146285) - CVE-2017-18551: An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated (bsc#1146163) - CVE-2019-15118: check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion (bsc#1145922) Important SUSE bug 1137586 SUSE bug 1139751 SUSE bug 1145477 SUSE bug 1145922 SUSE bug 1146163 SUSE bug 1146285 SUSE bug 1146361 SUSE bug 1146391 SUSE bug 1146524 SUSE bug 1146547 SUSE bug 1146678 SUSE bug 1149376 SUSE bug 1149522 SUSE bug 1150025 SUSE bug 1150112 CVE-2017-18509 CVE-2017-18551 CVE-2018-20976 CVE-2019-11477 CVE-2019-14835 CVE-2019-15118 CVE-2019-15212 CVE-2019-15216 CVE-2019-15217 CVE-2019-15219 CVE-2019-15292 CVE-2019-15902 CVE-2019-15927 CVE-2019-9456 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088) - CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue. (bsc#1087088) - CVE-2018-10124: The kill_something_info function in kernel/signal.c might allow local users to cause a denial of service via an INT_MIN argument (bnc#1089752). - CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608). - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536 1087209). - CVE-2018-7566: A Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user was fixed (bnc#1083483). - CVE-2017-0861: Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem allowed attackers to gain privileges via unspecified vectors (bnc#1088260). - CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162). - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver. (bnc#1072865). - CVE-2017-18203: The dm_get_from_kobject function in drivers/md/dm.c allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices (bnc#1083242). - CVE-2017-16911: The vhci_hcd driver allowed allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP (bnc#1078674). - CVE-2017-18208: The madvise_willneed function in mm/madvise.c allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bnc#1083494). - CVE-2017-16644: The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c allowed local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067118). - CVE-2018-6927: The futex_requeue function in kernel/futex.c might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value (bnc#1080757). - CVE-2017-16914: The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) allowed attackers to cause a denial of service (NULL pointer dereference) via a specially crafted USB over IP packet (bnc#1078669). - CVE-2016-7915: The hid_input_field function in drivers/hid/hid-core.c allowed physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device, as demonstrated by a Logitech DJ receiver (bnc#1010470). - CVE-2015-5156: The virtnet_probe function in drivers/net/virtio_net.c attempted to support a FRAGLIST feature without proper memory allocation, which allowed guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets (bnc#940776). - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user functions in block/bio.c did unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition (bnc#1062568). - CVE-2017-16912: The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) allowed attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (bnc#1078673). - CVE-2017-16913: The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (bnc#1078672). The following non-security bugs were fixed: - Integrate fixes resulting from bsc#1088147 More info in the respective commit messages. - KABI: x86/kaiser: properly align trampoline stack. - KEYS: do not let add_key() update an uninstantiated key (bnc#1063416). - ipc/msg: introduce msgctl(MSG_STAT_ANY) (bsc#1072689). - ipc/sem: introduce semctl(SEM_STAT_ANY) (bsc#1072689). - ipc/shm: introduce shmctl(SHM_STAT_ANY) (bsc#1072689). - kvm/x86: fix icebp instruction handling (bsc#1087088). - leds: do not overflow sysfs buffer in led_trigger_show (bsc#1080464). - mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack (bnc#1039348). - x86-64: Move the "user" vsyscall segment out of the data segment (bsc#1082424). - x86/entry/64: Do not use IST entry for #BP stack (bsc#1087088). - x86/kaiser: properly align trampoline stack (bsc#1087260). - x86/retpoline: do not perform thunk calls in ring3 vsyscall code (bsc#1085331). - xfs: check for buffer errors before waiting (bsc#1052943). - xfs: fix allocbt cursor leak in xfs_alloc_ag_vextent_near (bsc#1087762). - xfs: really fix the cursor leak in xfs_alloc_ag_vextent_near (bsc#1087762). Important SUSE bug 1010470 SUSE bug 1039348 SUSE bug 1052943 SUSE bug 1062568 SUSE bug 1062840 SUSE bug 1063416 SUSE bug 1067118 SUSE bug 1072689 SUSE bug 1072865 SUSE bug 1078669 SUSE bug 1078672 SUSE bug 1078673 SUSE bug 1078674 SUSE bug 1080464 SUSE bug 1080757 SUSE bug 1082424 SUSE bug 1083242 SUSE bug 1083483 SUSE bug 1083494 SUSE bug 1084536 SUSE bug 1085331 SUSE bug 1086162 SUSE bug 1087088 SUSE bug 1087209 SUSE bug 1087260 SUSE bug 1087762 SUSE bug 1088147 SUSE bug 1088260 SUSE bug 1089608 SUSE bug 1089752 SUSE bug 940776 CVE-2015-5156 CVE-2016-7915 CVE-2017-0861 CVE-2017-12190 CVE-2017-13166 CVE-2017-16644 CVE-2017-16911 CVE-2017-16912 CVE-2017-16913 CVE-2017-16914 CVE-2017-18203 CVE-2017-18208 CVE-2018-10087 CVE-2018-10124 CVE-2018-1087 CVE-2018-6927 CVE-2018-7566 CVE-2018-7757 CVE-2018-8822 CVE-2018-8897 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 SP3 Teradata kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-14617: There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bnc#1102870). - CVE-2018-16276: An issue was discovered in yurex_read in drivers/usb/misc/yurex.c where local attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to crash the kernel or potentially escalate privileges (bnc#1106095). - CVE-2018-12896: An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922). The following non-security bugs were fixed: - x86/fpu: Do not do __thread_fpu_end() if use_eager_fpu() (bnc#1109967). - x86/fpu: fix signal handling with eager FPU switching (ia32) (bsc#1108227). Important SUSE bug 1099922 SUSE bug 1102870 SUSE bug 1106095 SUSE bug 1108227 SUSE bug 1109967 CVE-2018-12896 CVE-2018-14617 CVE-2018-16276 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This MIT krb5 update fixes a buffer overrun problem in kadmind: * bnc#891082: buffer overrun in kadmind with LDAP back end (MITKRB5-SA-2014-001) (CVE-2014-4345) MIT krb5 Security Advisory 2014-001 * http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt Security Issues: * CVE-2014-4345 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345> SUSE bug 891082 CVE-2014-4345 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA krb5 was updated to fix one security issue. This security issue was fixed: - CVE-2015-2695: Applications which call gss_inquire_context() on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process crash (bsc#952188). Important SUSE bug 952188 CVE-2015-2695 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The krb5 package was updated to fix the following security and non security issues: - CVE-2015-2695: Fixed missing functions that were still vulnerable (bsc#954270). - Fixed a memory leak in the handling of error messages (bsc#954470). Moderate SUSE bug 954270 SUSE bug 954470 CVE-2015-2695 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following issues: - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database (bsc#963968) - CVE-2015-8631: An authenticated attacker could have caused a memory leak in auditd by supplying a null principal name in request (bsc#963975) Moderate SUSE bug 963968 SUSE bug 963975 CVE-2015-8629 CVE-2015-8631 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following security issue: - CVE-2016-3119: An authenticated attacker with permission to modify a principal entry could have caused kadmind to dereference a null pointer by supplying an empty DB argument to the modify_principal command, if kadmind is configured to use the LDAP KDB module. (bsc#971942) Moderate SUSE bug 971942 CVE-2016-3119 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following issues: - Incorrect string handling in build_principal_va can lead to DOS. (bsc#952190, CVE-2015-2697) - Fix potential heap corruption and crash vulnerability described in MIT krb5 Security Advisory 2012-001. (bsc#770172, CVE-2012-1015) - Fix prep_reprocess_req NULL pointer deref. (bsc#816413, CVE-2013-1416) - Fix Denial of service in krb5_read_message. (bsc#918595, CVE-2014-5355) Moderate SUSE bug 770172 SUSE bug 816413 SUSE bug 918595 SUSE bug 952190 CVE-2012-1015 CVE-2013-1416 CVE-2014-5355 CVE-2015-2697 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following issues: Security issues fixed: - CVE-2017-11368: Fix an unintended assertion failure in KDC (bsc#1049819) Also the openssl1 LDAP library build is now used for the LDAP plugin components. (bsc#1025126). Moderate SUSE bug 1025126 SUSE bug 1049819 CVE-2017-11368 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following security issues: - CVE-2017-15088: A buffer overflow in get_matching_data() was fixed that could under specific circumstances be used to execute code (bsc#1065274) - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free (bsc#1056995) Important SUSE bug 1056995 SUSE bug 1065274 CVE-2017-11462 CVE-2017-15088 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following issues: Security issues fixed: - CVE-2018-5729: Null pointer dereference in kadmind or DN container check bypass by supplying special crafted data (bsc#1083926). - CVE-2018-5730: DN container check bypass by supplying special crafted data (bsc#1083927). Moderate SUSE bug 1083926 SUSE bug 1083927 CVE-2018-5729 CVE-2018-5730 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for krb5 fixes the following issues: * When randomizing the keys for a service principal, current keys could be returned. (CVE-2014-5351) * klist -s crashes when handling multiple referral entries. (bnc#890623) Security Issues: * CVE-2014-5351 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5351> SUSE bug 890623 SUSE bug 897874 CVE-2014-5351 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA krb5 has been updated to fix four security issues: * CVE-2014-5352: gss_process_context_token() incorrectly frees context (bsc#912002) * CVE-2014-9421: kadmind doubly frees partial deserialization results (bsc#912002) * CVE-2014-9422: kadmind incorrectly validates server principal name (bsc#912002) * CVE-2014-9423: libgssrpc server applications leak uninitialized bytes (bsc#912002) Additionally, these non-security issues have been fixed: * Winbind process hangs indefinitely without DC. (bsc#872912) * Hanging winbind processes. (bsc#906557) Security Issues: * CVE-2014-5352 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352> * CVE-2014-9421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421> * CVE-2014-9422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422> * CVE-2014-9423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423> SUSE bug 872912 SUSE bug 906557 SUSE bug 912002 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA krb5 was updated to fix three security issues. Remote authenticated users could cause denial of service. These security issues were fixed: - CVE-2014-5353: NULL pointer dereference when using a ticket policy name as password name (bsc#910457). - CVE-2014-5354: NULL pointer dereference when using keyless entries (bsc#910458). - CVE-2014-5355: Denial of service in krb5_read_message (bsc#918595). Moderate SUSE bug 910457 SUSE bug 910458 SUSE bug 918595 CVE-2014-5353 CVE-2014-5354 CVE-2014-5355 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA kvm has been updated to fix issues in the embedded qemu: * CVE-2014-0223: An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could have used this flaw to corrupt QEMU process memory on the host, which could potentially have resulted in arbitrary code execution on the host with the privileges of the QEMU process. * CVE-2014-3461: A user able to alter the savevm data (either on the disk or over the wire during migration) could have used this flaw to to corrupt QEMU process memory on the (destination) host, which could have potentially resulted in arbitrary code execution on the host with the privileges of the QEMU process. * CVE-2014-0222: An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could have used this flaw to corrupt QEMU process memory on the host, which could have potentially resulted in arbitrary code execution on the host with the privileges of the QEMU process. Non-security bugs fixed: * Fix exceeding IRQ routes that could have caused freezes of guests. (bnc#876842) * Fix CPUID emulation bugs that may have broken Windows guests with newer -cpu types (bnc#886535) Security Issues: * CVE-2014-0222 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222> * CVE-2014-0223 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223> * CVE-2014-3461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461> SUSE bug 876842 SUSE bug 877642 SUSE bug 877645 SUSE bug 878541 SUSE bug 886535 CVE-2014-0222 CVE-2014-0223 CVE-2014-3461 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA kvm was updated to fix one security issue. This security issue was fixed: - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). Important SUSE bug 938344 CVE-2015-5154 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: Security issues fixed: - CVE-2015-7512: The receive packet size is now checked in the emulated pcnet driver, eliminating buffer overflow and potential security issue by malicious guest systems. (bsc#957162) - CVE-2015-8345: A infinite loop in processing command block list was fixed that could be exploit by malicious guest systems (bsc#956829). Bugs fixed: - Fix cases of wrong clock values in kvmclock timekeeping (bsc#947164 and bsc#953187) - Enforce pxe rom sizes to ensure migration compatibility. (bsc#950590) Important SUSE bug 947164 SUSE bug 950590 SUSE bug 953187 SUSE bug 956829 SUSE bug 957162 CVE-2015-7512 CVE-2015-8345 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA kvm was updated to fix 33 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711) - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723) - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158) - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160) - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109) - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969) - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350) - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036) - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037) - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128) - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136) - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700) - CVE-2015-3214: Fixed OOB read in i8254 PIC (bsc#934069) - CVE-2014-9718: Fixed the handling of malformed or short ide PRDTs to avoid any opportunity for guest to cause DoS by abusing that interface (bsc#928393) - CVE-2014-3689: Fixed insufficient parameter validation in rectangle functions (bsc#901508) - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528). - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989). - CVE-2015-5279: Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets (bsc#945987). - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929). - CVE-2015-6855: hw/ide/core.c in QEMU did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404). - CVE-2015-7295: hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU, when big or mergeable receive buffers are not supported, allowed remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface (bsc#947159). - CVE-2015-7549: PCI null pointer dereferences (bsc#958917). - CVE-2015-8504: VNC floating point exception (bsc#958491). - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005). - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358). - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334). - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725). - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332). - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691). - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320). - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782). - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413). This non-security issue was fixed: - Fix case of IDE interface needing busy status set before flush (bsc#936132) Important SUSE bug 895528 SUSE bug 901508 SUSE bug 928393 SUSE bug 934069 SUSE bug 936132 SUSE bug 940929 SUSE bug 944463 SUSE bug 945404 SUSE bug 945987 SUSE bug 945989 SUSE bug 947159 SUSE bug 958491 SUSE bug 958917 SUSE bug 959005 SUSE bug 960334 SUSE bug 960725 SUSE bug 961332 SUSE bug 961333 SUSE bug 961358 SUSE bug 961556 SUSE bug 961691 SUSE bug 962320 SUSE bug 963782 SUSE bug 964413 SUSE bug 967969 SUSE bug 969350 SUSE bug 970036 SUSE bug 970037 SUSE bug 975128 SUSE bug 975136 SUSE bug 975700 SUSE bug 976109 SUSE bug 978158 SUSE bug 978160 SUSE bug 980711 SUSE bug 980723 CVE-2014-3615 CVE-2014-3689 CVE-2014-9718 CVE-2015-3214 CVE-2015-5239 CVE-2015-5278 CVE-2015-5279 CVE-2015-5745 CVE-2015-6855 CVE-2015-7295 CVE-2015-7549 CVE-2015-8504 CVE-2015-8558 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922 CVE-2016-1981 CVE-2016-2198 CVE-2016-2538 CVE-2016-2841 CVE-2016-2857 CVE-2016-2858 CVE-2016-3710 CVE-2016-3712 CVE-2016-4001 CVE-2016-4002 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441 SUSE Linux Enterprise Server 11 SP3-TERADATA kvm was updated to fix 16 security issues. These security issues were fixed: - CVE-2015-6815: e1000 NIC emulation support was vulnerable to an infinite loop issue. A privileged user inside guest could have used this flaw to crash the Qemu instance resulting in DoS. (bsc#944697). - CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers (bsc#967013). - CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU did not properly validate USB configuration descriptor objects, which allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet (bsc#967012). - CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982223). - CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982222). - CVE-2016-5105: The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, used an uninitialized variable, which allowed local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982017). - CVE-2016-5106: The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command (bsc#982018). - CVE-2016-5107: The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors (bsc#982019). - CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982285). - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982959). - CVE-2016-5337: The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983961). - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983982). - CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (bsc#991080). - CVE-2016-6490: Infinite loop in the virtio framework. A privileged user inside the guest could have used this flaw to crash the Qemu instance on the host resulting in DoS (bsc#991466). - CVE-2016-7116: Host directory sharing via Plan 9 File System(9pfs) was vulnerable to a directory/path traversal issue. A privileged user inside guest could have used this flaw to access undue files on the host (bsc#996441). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c in QEMU allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737). Moderate SUSE bug 902737 SUSE bug 944697 SUSE bug 967012 SUSE bug 967013 SUSE bug 982017 SUSE bug 982018 SUSE bug 982019 SUSE bug 982222 SUSE bug 982223 SUSE bug 982285 SUSE bug 982959 SUSE bug 983961 SUSE bug 983982 SUSE bug 991080 SUSE bug 991466 SUSE bug 996441 CVE-2014-7815 CVE-2015-6815 CVE-2016-2391 CVE-2016-2392 CVE-2016-4453 CVE-2016-4454 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 CVE-2016-5126 CVE-2016-5238 CVE-2016-5337 CVE-2016-5338 CVE-2016-5403 CVE-2016-6490 CVE-2016-7116 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: - Address various security/stability issues * Fix OOB access in xlnx.xpx-ethernetlite emulation (CVE-2016-7161 bsc#1001151) * Fix OOB access in VMware SVGA emulation (CVE-2016-7170 bsc#998516) * Fix DOS in ColdFire Fast Ethernet Controller emulation (CVE-2016-7908 bsc#1002550) * Fix DOS in USB xHCI emulation (CVE-2016-8576 bsc#1003878) * Fix DOS in virtio-9pfs (CVE-2016-8578 bsc#1003894) * Fix DOS in virtio-9pfs (CVE-2016-9105 bsc#1007494) * Fix DOS in virtio-9pfs (CVE-2016-8577 bsc#1003893) * Plug data leak in virtio-9pfs interface (CVE-2016-9103 bsc#1007454) * Fix DOS in virtio-9pfs interface (CVE-2016-9102 bsc#1007450) * Fix DOS in virtio-9pfs (CVE-2016-9106 bsc#1007495) * Fix DOS in 16550A UART emulation (CVE-2016-8669 bsc#1004707) * Fix DOS in PC-Net II emulation (CVE-2016-7909 bsc#1002557) * Fix DOS in PRO100 emulation (CVE-2016-9101 bsc#1007391) * Fix DOS in RTL8139 emulation (CVE-2016-8910 bsc#1006538) * Fix DOS in Intel HDA controller emulation (CVE-2016-8909 bsc#1006536) * Fix DOS in virtio-9pfs (CVE-2016-9104 bsc#1007493) * Fix DOS in JAZZ RC4030 emulation (CVE-2016-8667 bsc#1004702) - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE11-SP3 Important SUSE bug 1001151 SUSE bug 1002550 SUSE bug 1002557 SUSE bug 1003878 SUSE bug 1003893 SUSE bug 1003894 SUSE bug 1004702 SUSE bug 1004707 SUSE bug 1006536 SUSE bug 1006538 SUSE bug 1007391 SUSE bug 1007450 SUSE bug 1007454 SUSE bug 1007493 SUSE bug 1007494 SUSE bug 1007495 SUSE bug 998516 CVE-2016-7161 CVE-2016-7170 CVE-2016-7908 CVE-2016-7909 CVE-2016-8576 CVE-2016-8577 CVE-2016-8578 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes several issues. These security issues were fixed: - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9602: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper link following issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1020427) - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028656) - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046636) - CVE-2017-10806: Stack-based buffer overflow allowed local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages (bsc#1047674) - CVE-2017-11334: The address_space_write_continue function allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048902) - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049381) - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056334) - CVE-2017-14167: Integer overflow in the load_multiboot function allowed local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write (bsc#1057585) - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes (bsc#1062069) - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063122) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021741) - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025109) - CVE-2017-6505: The ohci_service_ed_list function allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028184) - CVE-2017-7471: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper access control issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1034866) - CVE-2017-7493: The VirtFS, host directory sharing via Plan 9 File System(9pfs) support, was vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could have used this flaw to escalate their privileges inside guest (bsc#1039495) - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034908) - CVE-2017-7980: An out-of-bounds r/w access issues in the Cirrus CLGD 54xx VGA Emulator support allowed privileged user inside guest to use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on a host with privileges of Qemu process on the host (bsc#1035406) - CVE-2017-8086: A memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c allowed local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable (bsc#1035950) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037242) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042159) - CVE-2017-9373: The IDE AHCI Emulation support was vulnerable to a host memory leakage issue, which allowed a privileged user inside guest to leak host memory resulting in DoS (bsc#1042801) - CVE-2017-9375: The USB xHCI controller emulator support was vulnerable to an infinite recursive call loop issue, which allowed a privileged user inside guest to crash the Qemu process resulting in DoS (bsc#1042800) - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a null pointer dereference issue which allowed a privileged user inside guest to crash the Qemu process on the host resulting in DoS (bsc#1043296) * Fix privilege escalation in TCG mode (bsc#1030624) These non-security issues were fixed: - bsc#1045035: Fixed regression introduced by previous virtfs security fixes - bsc#1038396: Fixed 12 tempest tests - bsc#1034044: Prevent KVM guests stuck when waiting for sg_io() completion - bsc#1031051: Prevent I/O errors when using pvmove with disk device=lun - bsc#1049785: Make virsh dump output readable by crash - bsc#1015048: Fixed virtio interface failure - bsc#1016779: Fixed graphical update errors introduced by previous security fix - Fixed various inaccuracies in cirrus vga device emulation Important SUSE bug 1013285 SUSE bug 1014109 SUSE bug 1014111 SUSE bug 1014702 SUSE bug 1015048 SUSE bug 1016779 SUSE bug 1020427 SUSE bug 1021129 SUSE bug 1021741 SUSE bug 1023004 SUSE bug 1023053 SUSE bug 1023907 SUSE bug 1024972 SUSE bug 1025109 SUSE bug 1028184 SUSE bug 1028656 SUSE bug 1030624 SUSE bug 1031051 SUSE bug 1034044 SUSE bug 1034866 SUSE bug 1034908 SUSE bug 1035406 SUSE bug 1035950 SUSE bug 1037242 SUSE bug 1038396 SUSE bug 1039495 SUSE bug 1042159 SUSE bug 1042800 SUSE bug 1042801 SUSE bug 1043296 SUSE bug 1045035 SUSE bug 1046636 SUSE bug 1047674 SUSE bug 1048902 SUSE bug 1049381 SUSE bug 1049785 SUSE bug 1056334 SUSE bug 1057585 SUSE bug 1062069 SUSE bug 1063122 CVE-2016-10155 CVE-2016-9602 CVE-2016-9603 CVE-2016-9776 CVE-2016-9907 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2017-10664 CVE-2017-10806 CVE-2017-11334 CVE-2017-11434 CVE-2017-13672 CVE-2017-14167 CVE-2017-15038 CVE-2017-15289 CVE-2017-2615 CVE-2017-2620 CVE-2017-5579 CVE-2017-5856 CVE-2017-5898 CVE-2017-5973 CVE-2017-6505 CVE-2017-7471 CVE-2017-7493 CVE-2017-7718 CVE-2017-7980 CVE-2017-8086 CVE-2017-8309 CVE-2017-9330 CVE-2017-9373 CVE-2017-9375 CVE-2017-9503 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: A security flaw mitigation has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to allow enabling/disabling branch prediction features in the Intel CPU. (bsc#1068032) Also a security fix has been applied: - CVE-2017-2633: Fix various out of bounds access issues in the QEMU vnc infrastructure (bsc#1026612) Important SUSE bug 1026612 SUSE bug 1068032 CVE-2017-2633 CVE-2017-5715 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrates with corresponding changes in libvirt. A January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution. We remove that initial patch and now rely on patches from upstream. This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either -IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used. Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient. A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see: https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/ (CVE-2017-5715 bsc#1068032) A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276) Additional security fixes: - CVE-2018-5683: An out-of-bounds read in vga_draw_text routine was fixed which could lead to crashes or information leakage. (bsc#1076114) - CVE-2018-7550: multiboot OOB access while loading kernel image was fixed that could lead to crashes (bsc#1083291) - CVE-2017-18030: An out-of-bounds access in cirrus_invalidate_region routine could lead to crashes or information leakage (bsc#1076179) - Eliminate bogus use of CPUID_7_0_EDX_PRED_CMD which we've carried since the initial Spectre v2 patch was added. EDX bit 27 of CPUID Leaf 07H, Sub-leaf 0 provides status on STIBP, and not the PRED_CMD MSR. Exposing the STIBP CPUID feature bit to the guest is wrong in general, since the VM doesn't directly control the scheduling of physical hyperthreads. This is left strictly to the L0 hypervisor. Important SUSE bug 1068032 SUSE bug 1076114 SUSE bug 1076179 SUSE bug 1082276 SUSE bug 1083291 CVE-2017-18030 CVE-2017-5715 CVE-2018-5683 CVE-2018-7550 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: This security issue was fixed: - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests (bsc#1092885). Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. This patch permits the new x86 cpu feature flag named "ssbd" to be presented to the guest, given that the host has this feature, and KVM exposes it to the guest as well. For this feature to be enabled please use the qemu commandline -cpu $MODEL,+spec-ctrl,+ssbd so the guest OS can take advantage of the feature. spec-ctrl and ssbd support is also required in the host. Important SUSE bug 1092885 CVE-2018-3639 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following security issues: - CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735) - CVE-2018-11806: Prevent heap-based buffer overflow via incoming fragmented datagrams (bsc#1096223) With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885). Moderate SUSE bug 1092885 SUSE bug 1096223 SUSE bug 1098735 CVE-2018-11806 CVE-2018-12617 CVE-2018-3639 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: Security issues fixed: - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS (bsc#1110910). - CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread (bsc#1106222). - CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used (bsc#1111006). - CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used (bsc#1111010). - CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact. (bsc#1111013) - CVE-2018-18849: Fixed an out of bounds memory access issue that was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value. A user/process could use this flaw to crash the Qemu process resulting in DoS (bsc#1114422). - CVE-2018-18438: Fixed integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value (bnc#1112185). Moderate SUSE bug 1106222 SUSE bug 1110910 SUSE bug 1111006 SUSE bug 1111010 SUSE bug 1111013 SUSE bug 1112185 SUSE bug 1114422 CVE-2018-10839 CVE-2018-15746 CVE-2018-17958 CVE-2018-17962 CVE-2018-17963 CVE-2018-18438 CVE-2018-18849 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: Security issues fixed: - CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156). - CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275). - CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717). Non-security issue fixed: - Fixed LAPIC TSC deadline timer save/restore (bsc#1109544) Important SUSE bug 1109544 SUSE bug 1116717 SUSE bug 1117275 SUSE bug 1123156 CVE-2018-19364 CVE-2018-19489 CVE-2019-6778 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: - CVE-2019-9824: Fixed an information leak in slirp (bsc#1129622) - CVE-2018-20815: Fix DOS possibility in device tree processing (bsc#1130675) - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091: Added x86 cpu feature "md-clear" (bsc#1111331) Important SUSE bug 1111331 SUSE bug 1129622 SUSE bug 1130675 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-20815 CVE-2019-11091 CVE-2019-9824 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for kvm fixes the following issues: Security issues fixed: - CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794). - CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902). - CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402). Important SUSE bug 1135902 SUSE bug 1140402 SUSE bug 1143794 CVE-2019-12155 CVE-2019-13164 CVE-2019-14378 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This collective update for KVM and libvirt provides fixes for security and non-security issues. kvm: * Fix NULL pointer dereference because of uninitialized UDP socket. (bsc#897654, CVE-2014-3640) * Fix performance degradation after migration. (bsc#878350) * Fix potential image corruption due to missing FIEMAP_FLAG_SYNC flag in FS_IOC_FIEMAP ioctl. (bsc#908381) * Add validate hex properties for qdev. (bsc#852397) * Add boot option to do strict boot (bsc#900084) * Add query-command-line-options QMP command. (bsc#899144) * Fix incorrect return value of migrate_cancel. (bsc#843074) * Fix insufficient parameter validation during ram load. (bsc#905097, CVE-2014-7840) * Fix insufficient blit region checks in qemu/cirrus. (bsc#907805, CVE-2014-8106) libvirt: * Fix security hole with migratable flag in dumpxml. (bsc#904176, CVE-2014-7823) * Fix domain deadlock. (bsc#899484, CVE-2014-3657) * Use correct definition when looking up disk in qemu blkiotune. (bsc#897783, CVE-2014-3633) * Fix undefined symbol when starting virtlockd. (bsc#910145) * Add "-boot strict" to qemu's commandline whenever possible. (bsc#900084) * Add support for "reboot-timeout" in qemu. (bsc#899144) * Increase QEMU's monitor timeout to 30sec. (bsc#911742) * Allow setting QEMU's migration max downtime any time. (bsc#879665) Security Issues: * CVE-2014-7823 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7823> * CVE-2014-3657 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3657> * CVE-2014-3633 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3633> * CVE-2014-3640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640> * CVE-2014-7840 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7840> * CVE-2014-8106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8106> SUSE bug 843074 SUSE bug 852397 SUSE bug 878350 SUSE bug 879665 SUSE bug 897654 SUSE bug 897783 SUSE bug 899144 SUSE bug 899484 SUSE bug 900084 SUSE bug 904176 SUSE bug 905097 SUSE bug 907805 SUSE bug 908381 SUSE bug 910145 SUSE bug 911742 CVE-2014-3633 CVE-2014-3640 CVE-2014-3657 CVE-2014-7823 CVE-2014-7840 CVE-2014-8106 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The lcms userland utilities were updated to fix stack overflows. * CVE-2013-4276: Multiple stack-based buffer overflows in LittleCMS allowed remote attackers to cause a denial of service (crash) via a crafted (1) ICC color profile to the icctrans utility or (2) TIFF image to the tiffdiff utility. Security Issues: * CVE-2013-4276 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4276> SUSE bug 843716 CVE-2013-4276 SUSE Linux Enterprise Server 11 SP3-TERADATA lha was updated to fix one security issue. This security issue was fixed: - CVE-2016-1925: Buffer Overflow while parsing level0 and level1 headers (bsc#962528). Moderate SUSE bug 962528 CVE-2016-1925 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The Qt library was updated to fix a XML entity expansion attack (XXE). (CVE-2013-4549) Security Issue reference: * CVE-2013-4549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4549> SUSE bug 856832 SUSE bug 859158 CVE-2013-4549 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libapr-util1 fixes the following issues: Security issue fixed: - CVE-2017-12618: DoS via crafted SDBM database files in apr_sdbm*() functions (bsc#1064990) Moderate SUSE bug 1064990 CVE-2017-12618 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following issues: - CVE-2017-12613: DoS or information disclosure in pr_exp_time*() or apr_os_exp_time*() functions (bsc#1064982). Moderate SUSE bug 1064982 CVE-2017-12613 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA util-linux has been updated to fix one security issue: * CVE-2014-9114: command injection flaw in blkid (bnc#907434). Additionally, these non-security issues have been fixed: * Fix possible script hang (bnc#888678) * Enable build of libmount / findmnt (bnc#900965) * Don't stop trying filesystem when mounting fails with EACCESS (bnc#918041) * Fix possible loop in findmnt (bsc#917164) * Recognize Unisys s-Par as hypervisor (FATE#318231) * Include the utmpdump.1 manpage (bsc#901549). Security Issues: * CVE-2014-9114 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114> SUSE bug 888678 SUSE bug 900965 SUSE bug 901549 SUSE bug 907434 SUSE bug 917164 SUSE bug 918041 CVE-2014-9114 SUSE Linux Enterprise Server 11 SP3-TERADATA libcap-ng was updated to fix one security issue. This security issue was fixed: - CVE-2014-3215: seunshare in policycoreutils (which uses libcap-ng) is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which made it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges (bsc#876832). Moderate SUSE bug 876832 CVE-2014-3215 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libcares2 fixes the following issues: - Add patch to fix single byte out of buffer write (CVE-2016-5180, bsc#1007728) Low SUSE bug 1007728 CVE-2016-5180 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libcgroup1 fixes the following issues: Security issue fixed: - CVE-2018-14348: Fix daemon that creates /var/log/cgred with mode 0666 (bsc#1100365). Bug fixes: - bsc#1030747: Unable to use freezer sub system via libcgroup API when both freezer and cpuset subsystems are used. Moderate SUSE bug 1030747 SUSE bug 1100365 CVE-2018-14348 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libcroco fixes the following issues: Security issues fixed: - CVE-2017-7960: Fixed heap overflow (input: check end of input before reading a byte) (bsc#1034481). - CVE-2017-7961: Fixed undefined behavior (tknzr: support only max long rgb values) (bsc#1034482). - CVE-2017-8834: Fixed denial of service (memory allocation error) via a crafted CSS file (bsc#1043898). - CVE-2017-8871: Fixed denial of service (infinite loop and CPU consumption) via a crafted CSS file (bsc#1043899). Moderate SUSE bug 1034481 SUSE bug 1034482 SUSE bug 1043898 SUSE bug 1043899 CVE-2017-7960 CVE-2017-7961 CVE-2017-8834 CVE-2017-8871 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libdb-4_5 fixes the following issues: - A DB_CONFIG file in the current working directory allowed local users to obtain sensitive information via a symlink attack involving a setgid or setuid application using libdb-4_8. (bsc#1043886) Moderate SUSE bug 1043886 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The PostgreSQL database server was updated to version 9.1.12 to fix various security issues: * Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. (CVE-2014-0060) * The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. (CVE-2014-0061) * If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. (CVE-2014-0062) * The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. (CVE-2014-0063) * Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. (CVE-2014-0064) * Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. (CVE-2014-0065) * There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., "FIPS mode"). (CVE-2014-0066) * Since the temporary server started by make check uses "trust" authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine. (CVE-2014-0067) The complete list of bugs and more information can be found at: http://www.postgresql.org/docs/9.1/static/release-9-1-12.html <http://www.postgresql.org/docs/9.1/static/release-9-1-12.html> Security Issues references: * CVE-2014-0060 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0060> * CVE-2014-0061 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0061> * CVE-2014-0062 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0062> * CVE-2014-0063 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0063> * CVE-2014-0064 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0064> * CVE-2014-0065 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0065> * CVE-2014-0066 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0066> SUSE bug 864845 SUSE bug 864846 SUSE bug 864847 SUSE bug 864850 SUSE bug 864851 SUSE bug 864852 SUSE bug 864853 CVE-2014-0060 CVE-2014-0061 CVE-2014-0062 CVE-2014-0063 CVE-2014-0064 CVE-2014-0065 CVE-2014-0066 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a buffer overflow in the buffered event handling in libevent. (CVE-2014-6272) Security Issues: * CVE-2014-6272 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272> SUSE bug 897243 CVE-2014-6272 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libevent fixes the following issues: - CVE-2016-10195: DNS remote stack overread vulnerability (bsc#1022917) - CVE-2016-10196: stack/buffer overflow in evutil_parse_sockaddr_port() (bsc#1022918) (backport for 2.0.21) - CVE-2016-10197: out-of-bounds read in search_make_new() (bsc#1022919) Moderate SUSE bug 1022917 SUSE bug 1022918 SUSE bug 1022919 CVE-2016-10195 CVE-2016-10196 CVE-2016-10197 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libexif fixes the following security issue: - CVE-2017-7544: Fixed out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure (bsc#1059893) Moderate SUSE bug 1059893 CVE-2017-7544 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> SUSE bug 897890 CVE-2014-1568 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of libgcrypt mitigates the Yarom/Falkner flush+reload side-channel attack on RSA secret keys (CVE-2013-4242). Security Issue reference: * CVE-2013-4242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4242> SUSE bug 831359 CVE-2013-4242 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following issues: * Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. (bsc#920057) * Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical] Moderate SUSE bug 920057 CVE-2014-3591 CVE-2015-0837 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libgcrypt fixes the following issues: - RNG prediction vulnerability (bsc#994157, CVE-2016-6313) Moderate SUSE bug 994157 CVE-2016-6313 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libgcrypt fixes the following issues: - CVE-2017-7526: Hardening a against local side-channel attack in RSA key handling has been added (bsc#1046607) Moderate SUSE bug 1046607 CVE-2017-7526 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libgcrypt fixes the following issues: Security issue fixed: - CVE-2019-13627: Mitigated against an ECDSA timing attack. (bsc#1148987) Moderate SUSE bug 1148987 CVE-2019-13627 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This libgcrypt update fixes the following security issue: * bnc#892464: Side-channel attack on Elgamal encryption subkeys. (CVE-2014-5270) Security Issues: * CVE-2014-5270 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270> SUSE bug 892464 CVE-2014-5270 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libical fixes the following issues: Security issues fixed: - CVE-2016-5823: The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. (bnc#986632) - CVE-2016-5824: libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. (bsc#986639) - CVE-2016-5825: The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file. (bsc#986642) - CVE-2016-5826: The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function. (bsc#986658) - CVE-2016-5827: The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function. (bsc#986631) - CVE-2016-9584: libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. (bnc#1015964) Bug fixes: - libical crashes while parsing timezones (bsc#1044995) Moderate SUSE bug 1015964 SUSE bug 1044995 SUSE bug 986631 SUSE bug 986632 SUSE bug 986639 SUSE bug 986642 SUSE bug 986658 CVE-2016-5823 CVE-2016-5824 CVE-2016-5825 CVE-2016-5826 CVE-2016-5827 CVE-2016-9584 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libidn fixes the following issues: - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when reading one zero byte as input (bsc#990189) - CVE-2016-6261: Out-of-bounds stack read in idna_to_ascii_4i (bsc#990190) - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject invalid UTF-8 (bsc#990191) - CVE-2015-2059: out-of-bounds read with stringprep on invalid UTF-8 (bsc#923241) Moderate SUSE bug 923241 SUSE bug 990189 SUSE bug 990190 SUSE bug 990191 CVE-2015-2059 CVE-2015-8948 CVE-2016-6261 CVE-2016-6262 CVE-2016-6263 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libidn fixes one issues. This security issue was fixed: - CVE-2017-14062: Prevent integer overflow in the decode_digit function that allowed remote attackers to cause a denial of service or possibly have unspecified other impact (bsc#1056450). Moderate SUSE bug 1056450 CVE-2017-14062 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libjasper fixes multiple off-by-one errors which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow triggered by a crafted jp2 (JPEG 2000) file. (bsc#906364, CVE-2014-9029) Security Issues: * CVE-2014-9029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9029> SUSE bug 906364 CVE-2014-9029 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This libksba update fixes the following security issue: * bnc#907074: buffer overflow in ksba_oid_to_str (CVE-2014-9087) Security Issues: * CVE-2014-9087 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9087> SUSE bug 907074 CVE-2014-9087 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libksba fixes the following issues: - CVE-2016-4579: Out-of-bounds read in _ksba_ber_parse_tl() - CVE-2016-4574: two OOB read access bugs (remote DoS) (bsc#979261) Also adding reliability fixes from v1.3.4. Moderate SUSE bug 979261 SUSE bug 979906 CVE-2016-4574 CVE-2016-4579 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The libksba package was updated to fix the following security issues: - Fixed an integer overflow, an out of bounds read and a stack overflow issues (bsc#926826). Moderate SUSE bug 926826 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for liblouis fixes several issues. These security issues were fixed: - CVE-2017-13739: Prevent heap-based buffer overflow in the function resolveSubtable() that could have caused DoS or remote code execution (bsc#1056101) - CVE-2017-13740: Prevent stack-based buffer overflow in the function parseChars() that could have caused DoS or possibly unspecified other impact (bsc#1056097) () - CVE-2017-13741: Prevent use-after-free in function compileBrailleIndicator() that allowed to cause remote DoS (bsc#1056095) - CVE_2017-13742: Prevent stack-based buffer overflow in function includeFile that allowed to cause remote DoS (bsc#1056093). - CVE-2017-13743: Prevent buffer overflow triggered in the function _lou_showString() that allowed to cause remote DoS (bsc#1056090) Moderate SUSE bug 1056090 SUSE bug 1056093 SUSE bug 1056095 SUSE bug 1056097 SUSE bug 1056101 CVE-2017-13739 CVE-2017-13740 CVE-2017-13741 CVE-2017-13743 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for liblouis fixes the following issues: Security issues fixed: - CVE-2017-15101: Buffer overflow in findTable (bsc#1067336). - CVE-2014-8184: stack-based buffer overflow in findTable() (bsc#1062458). Moderate SUSE bug 1062458 SUSE bug 1067336 CVE-2014-8184 CVE-2017-15101 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for liblouis, python-louis fixes the following issues: Security issues fixed: - CVE-2018-11684: Fixed stack-based buffer overflow in the function includeFile() in compileTranslationTable.c (bsc#1095826) - CVE-2018-11685: Fixed a stack-based buffer overflow in the function compileHyphenation() in compileTranslationTable.c (bsc#1095825) - CVE-2018-11683: Fix a stack-based buffer overflow in the function parseChars() in compileTranslationTable.c (bsc#1095827) Moderate SUSE bug 1095825 SUSE bug 1095826 SUSE bug 1095827 CVE-2018-11683 CVE-2018-11684 CVE-2018-11685 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for liblouis and python-louis fixes the following issue: Security issue fixed: - CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function which could allow a remote attacker to cause Denail of Service (bsc#1109319). Low SUSE bug 1109319 CVE-2018-17294 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA lzo was updated to fix a potential denial of service issue or possible remote code execution by allowing an attacker, if the LZO decompression algorithm is used in a threaded or kernel context, to corrupt memory structures that control the flow of execution in other contexts. (CVE-2014-4607) Security Issue reference: * CVE-2014-4607 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607> SUSE bug 883947 CVE-2014-4607 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libmpfr fixes a buffer overflow in mpfr_strtofr. (CVE-2014-9474) Security Issues: * CVE-2014-9474 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9474> SUSE bug 911812 CVE-2014-9474 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue: * CVE-2014-9556: An integer overflow in the function qtmd_decompress() could have been exploited causing a denial of service (endless loop) (bnc##912214) Security Issues: * CVE-2014-9556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556> SUSE bug 912214 CVE-2014-9556 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA libmspack was updated to fix several security vulnerabilities. - Fix null pointer dereference on a crafted CAB. (bsc#934524, CVE-2014-9732) - Fix denial of service while processing crafted CHM file. (bsc#934525, CVE-2015-4467) - Fix denial of service while processing crafted CHM file. (bsc#934529, CVE-2015-4472) - Fix pointer arithmetic overflow during CHM decompression. (bsc#934526, CVE-2015-4469) - Fix off-by-one buffer over-read in mspack/mszipd.c. (bsc#934527, CVE-2015-4470) - Fix off-by-one buffer under-read in mspack/lzxd.c. (bsc#934528, CVE-2015-4471) Moderate SUSE bug 934524 SUSE bug 934525 SUSE bug 934526 SUSE bug 934527 SUSE bug 934528 SUSE bug 934529 CVE-2014-9732 CVE-2015-4467 CVE-2015-4469 CVE-2015-4470 CVE-2015-4471 CVE-2015-4472 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libmspack fixes the following issues: Security issues fixed: - CVE-2018-18584: The CAB block input buffer was one byte too small for the maximal Quantum block, leading to an out-of-bounds write. (bsc#1113038) - CVE-2018-18585: chmd_read_headers accepted a filename that has '\0' as its first or second character (such as the "/\0" name). (bsc#1113039) Moderate SUSE bug 1113038 SUSE bug 1113039 CVE-2018-18584 CVE-2018-18585 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This MySQL update provides the following: * upgrade to version 5.5.39, [bnc#887580] * CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260, CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233, CVE-2014-4240, CVE-2014-4214, CVE-2014-4243 See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html <http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html> Security Issues: * CVE-2014-2484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484> * CVE-2014-4258 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258> * CVE-2014-4260 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260> * CVE-2014-2494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494> * CVE-2014-4238 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238> * CVE-2014-4207 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207> * CVE-2014-4233 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233> * CVE-2014-4240 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240> * CVE-2014-4214 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214> * CVE-2014-4243 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243> SUSE bug 887580 CVE-2014-2484 CVE-2014-2494 CVE-2014-4207 CVE-2014-4214 CVE-2014-4233 CVE-2014-4238 CVE-2014-4240 CVE-2014-4243 CVE-2014-4258 CVE-2014-4260 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This OpenSSL update fixes the following issues: * Session Ticket Memory Leak (CVE-2014-3567) * Build option no-ssl3 is incomplete (CVE-2014-3568) * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE) Security Issues: * CVE-2014-3567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-3568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568> SUSE bug 892403 SUSE bug 901223 SUSE bug 901277 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libotr fixes the following issues: - Apply "libotr-CVE-2016-2851.patch" to fix integer overflows that used to occur on 64-bit architectures when receiving 4GB messages. This flaw could potentially have been exploited by an attacker to remotely execute arbitrary code on the user's machine. (CVE-2016-2851, bsc#969785) Moderate SUSE bug 969785 CVE-2016-2851 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue with pixman: * Integer underflow when handling trapezoids. (bnc#853824, CVE-2013-6425) Security Issues: * CVE-2013-6425 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6425> SUSE bug 853824 CVE-2013-6425 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This libpng update fixes the following two overflow security issues. * bnc#873123: Fixed integer overflow that could have lead to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2() (CVE-2013-7354). * bnc#873124: Fixed integer overflow that could have lead to a heap-based buffer overflow in png_set_unknown_chunks() (CVE-2013-7353). Security Issue references: * CVE-2013-7353 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7353> * CVE-2013-7354 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7354> SUSE bug 873123 SUSE bug 873124 CVE-2013-7353 CVE-2013-7354 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The libpng12-0 package was updated to fix the following security issues: - CVE-2015-8126: Fixed a buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions (bsc#954980). - CVE-2015-7981: Fixed an out-of-bound read (bsc#952051). Moderate SUSE bug 952051 SUSE bug 954980 CVE-2015-7981 CVE-2015-8126 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA - security update: This update fixes the following securit issue: * CVE-2015-8126 Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact [bsc#954980] Moderate SUSE bug 954980 CVE-2015-8126 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libpng12-0 fixes the following issues: Security issues fixed: - CVE-2015-8540: read underflow in libpng (bsc#958791) - CVE-2016-10087: NULL pointer dereference in png_set_text_2() (bsc#1017646) Moderate SUSE bug 1017646 SUSE bug 958791 CVE-2015-8540 CVE-2016-10087 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes problems in DCTStream error handling in poppler. Security Issue reference: * CVE-2010-5110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5110> SUSE bug 845765 CVE-2010-5110 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The following security issue is fixed in this update: * CVE-2014-3970: Fixed a remote denial of service attack in module-rtp-recv. Security Issues: * CVE-2014-3970 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3970> SUSE bug 881524 CVE-2014-3970 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of the QT4 QSSL interface makes it select a set of default ciphers that is recommended for current usage. This update is needed for Konqueror to restrict its cipher set when using https. SUSE bug 865241 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The libqt4 library was updated to fix several security issues: * CVE-2015-0295: Division by zero when processing malformed BMP files. (bsc#921999) * CVE-2015-1858: Segmentation fault in BMP Qt Image Format Handling. (bsc#927806) * CVE-2015-1859: Segmentation fault in ICO Qt Image Format Handling. (bsc#927807) * CVE-2015-1860: Segmentation fault in GIF Qt Image Format Handling. (bsc#927808) Security Issues: * CVE-2015-1858 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1858> * CVE-2015-1859 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1859> * CVE-2015-1860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1860> * CVE-2015-0295 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0295> SUSE bug 921999 SUSE bug 927806 SUSE bug 927807 SUSE bug 927808 CVE-2015-0295 CVE-2015-1858 CVE-2015-1859 CVE-2015-1860 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA librsvg was updated to fix one security issue. This security issue was fixed: - CVE-2013-1881: GNOME libsvg allowed remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (bsc#840753). Important SUSE bug 840753 CVE-2013-1881 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libsamplerate fixes the following issues: - CVE-2017-7697: Fixed a buffer overflow in calc_output_single. (bsc#1033564) Moderate SUSE bug 1033564 CVE-2017-7697 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libsndfile fixes two buffer read overflows in sd2_parse_rsrc_fork(). (CVE-2014-9496, bsc#911796) Security Issues: * CVE-2014-9496 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9496> SUSE bug 911796 CVE-2014-9496 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The libsndfile package was updated to fix the following security issue: - CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service (DoS) (bsc#953521). - CVE-2015-7805: Fixed heap overflow issue (bsc#953516). Moderate SUSE bug 953516 SUSE bug 953521 CVE-2014-9756 CVE-2015-7805 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libsndfile fixes the following issues: - CVE-2017-7585,CVE-2017-7741,CVE-2017-7742: Some stack-based buffer overflows via a specially crafted FLAC file were fixed (error in the "flac_buffer_copy()" function) (bsc#1033054, bsc#1033914, bsc#1033915). Moderate SUSE bug 1033054 SUSE bug 1033914 SUSE bug 1033915 CVE-2017-7585 CVE-2017-7741 CVE-2017-7742 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libsndfile fixes the following issues: - CVE-2017-8362: invalid memory read in flac_buffer_copy (flac.c) (bsc#1036943) - CVE-2017-8365: global buffer overflow in i2les_array (pcm.c) (bsc#1036946) - CVE-2017-8361: global buffer overflow in flac_buffer_copy (flac.c) (bsc#1036944) - CVE-2017-8363: heap-based buffer overflow in flac_buffer_copy (flac.c) (bsc#1036945) - CVE-2017-7585: stack-based buffer overflow via a specially crafted FLAC file (bsc#1033054) Moderate SUSE bug 1033054 SUSE bug 1033914 SUSE bug 1033915 SUSE bug 1036943 SUSE bug 1036944 SUSE bug 1036945 SUSE bug 1036946 CVE-2017-7585 CVE-2017-7741 CVE-2017-7742 CVE-2017-8361 CVE-2017-8362 CVE-2017-8363 CVE-2017-8365 SUSE Linux Enterprise Server 11 SP3-TERADATA - This update for libsndfile fixes a memory leak in an error path.(bsc#1038856) - CVE-2017-16942: A divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file. (bsc#1069874) - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the function double64_init() in double64.c, which may lead to DoS when playing a crafted audio file. (bsc#1059911) - CVE-2017-14245: An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. (bsc#1059912) - CVE-2017-14246: An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.(bsc#1059913) Moderate SUSE bug 1038856 SUSE bug 1059911 SUSE bug 1059912 SUSE bug 1059913 SUSE bug 1069874 CVE-2017-14245 CVE-2017-14246 CVE-2017-14634 CVE-2017-16942 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libsndfile fixes the following issues: Security issues fixed: - CVE-2017-17456: Prevent segmentation fault in the function d2alaw_array() that may have lead to a remote DoS (bsc#1071777). - CVE-2017-17457: Prevent segmentation fault in the function d2ulaw_array() that may have lead to a remote DoS, a different vulnerability than CVE-2017-14246 (bsc#1071767). - CVE-2018-19758: Fixed a heap-based buffer over-read at wav.c in wav_write_header that could have been used for a denial of service attack (bsc#1117954). Moderate SUSE bug 1071767 SUSE bug 1071777 SUSE bug 1117954 CVE-2017-17456 CVE-2017-17457 CVE-2018-19758 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for net-snmp fixes a remote denial of service problem inside snmptrapd when it is started with the "-OQ" option. (CVE-2014-3565, bnc#894361) Additionally, a timeout issue during SNMP MIB walk on OID 1.3.6.1.2.1.4.24 when using newer (v5.5+) versions of snmpwalk has been fixed. (bnc#865222) Security Issues: * CVE-2014-3565 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3565> SUSE bug 865222 SUSE bug 894361 CVE-2014-3565 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The ssh client library libssh2_org was updated to fix a security issue: * CVE-2015-1782: A malicious server could send a crafted SSH_MSG_KEXINIT packet, that could lead to a buffer overread and to a crash of the application using libssh2_org. Security Issues: * CVE-2015-1782 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1782> SUSE bug 921070 CVE-2015-1782 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libssh2_org fixes the following issues: - Add SHA256 support for DH group exchange (fate#320343, bsc#961964) - fix CVE-2016-0787 (bsc#967026) * Weakness in diffie-hellman secret key generation lead to much shorter DH groups then needed, which could be used to retrieve server keys. Moderate SUSE bug 961964 SUSE bug 967026 CVE-2016-0787 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libssh2_org fixes the following issues: Security issues fixed: - CVE-2019-3861: Fixed Out-of-bounds reads with specially crafted SSH packets (bsc#1128490). - CVE-2019-3862: Fixed Out-of-bounds memory comparison with specially crafted message channel request packet (bsc#1128492). - CVE-2019-3860: Fixed Out-of-bounds reads with specially crafted SFTP packets (bsc#1128481). - CVE-2019-3863: Fixed an Integer overflow in user authenticate keyboard interactive which could allow out-of-bounds writes with specially crafted keyboard responses (bsc#1128493). - CVE-2019-3856: Fixed a potential Integer overflow in keyboard interactive handling which could allow out-of-bounds write with specially crafted payload (bsc#1128472). - CVE-2019-3859: Fixed Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev (bsc#1128480). - CVE-2019-3855: Fixed a potential Integer overflow in transport read which could allow out-of-bounds write with specially crafted payload (bsc#1128471). - CVE-2019-3858: Fixed a potential zero-byte allocation which could lead to an out-of-bounds read with a specially crafted SFTP packet (bsc#1128476). - CVE-2019-3857: Fixed a potential Integer overflow which could lead to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet (bsc#1128474). Other issue addressed: - Fixed an issue where libssh2 stops parsing known_hosts (bsc#1091236). Moderate SUSE bug 1091236 SUSE bug 1128471 SUSE bug 1128472 SUSE bug 1128474 SUSE bug 1128476 SUSE bug 1128480 SUSE bug 1128481 SUSE bug 1128490 SUSE bug 1128492 SUSE bug 1128493 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libssh2_org fixes the following issues: - Incorrect upstream fix for CVE-2019-3859 broke public key authentication [bsc#1133528, bsc#1130103] Important SUSE bug 1130103 SUSE bug 1133528 CVE-2019-3859 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libssh2_org fixes the following issues: - Fix the previous fix for CVE-2019-3860 (bsc#1136570, bsc#1128481) (Out-of-bounds reads with specially crafted SFTP packets) Moderate SUSE bug 1128481 SUSE bug 1136570 CVE-2019-3860 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA libtasn1 has been updated to fix three security issues: * asn1_get_bit_der() could have returned negative bit length (CVE-2014-3468) * Multiple boundary check issues could have allowed DoS (CVE-2014-3467) * Possible DoS by NULL pointer dereference in asn1_read_value_type (CVE-2014-3469) Security Issues: * CVE-2014-3468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468> * CVE-2014-3467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467> * CVE-2014-3469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469> SUSE bug 880735 SUSE bug 880737 SUSE bug 880738 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtasn1 fixes the following issues: Security issues fixed: - CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). - CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621). Moderate SUSE bug 1040621 SUSE bug 1105435 CVE-2017-6891 CVE-2018-1000654 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtcnative-1-0 fixes the following issues: - CVE-2015-4000: Disable 512-bit export-grade cryptography to prevent Logjam vulnerability (bsc#938945) Moderate SUSE bug 938945 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtcnative-1-0 to version 1.1.34 fixes the following issues: - CVE-2017-15698: Fixed an improper handling of fields with more than 127 bytes which could allow invalid client certificates to be accepted (bsc#1078679). - CVE-2018-8019: When using an OCSP responder did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS (bsc#1103348). - CVE-2018-8020: Did not properly check OCSP pre-produced responses. Revoked client certificates may have not been properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS (bsc#1103347). For a complete list of changes please see http://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html Important SUSE bug 1078679 SUSE bug 1103347 SUSE bug 1103348 CVE-2017-15698 CVE-2018-8019 CVE-2018-8020 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This tiff update fixes several security issues. * bnc#834477: CVE-2013-4232 CVE-2013-4231: tiff: buffer overflows/use after free problem * bnc#834779: CVE-2013-4243: libtiff (gif2tiff): heap-based buffer overflow in readgifimage() * bnc#834788: CVE-2013-4244: libtiff (gif2tiff): OOB Write in LZW decompressor Security Issue references: * CVE-2013-4232 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4232> * CVE-2013-4231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4231> * CVE-2013-4243 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4243> * CVE-2013-4244 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4244> SUSE bug 834477 SUSE bug 834779 SUSE bug 834788 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtirpc and rpcbind fixes the following issues: - CVE-2017-8779: A crafted UDP package could lead rpcbind to remote denial-of-service. (bsc#1037559) Important SUSE bug 1037559 CVE-2017-8779 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtirpc fixes the following issues: - Prevent remote crash of RPC services (bsc#968175) Moderate SUSE bug 968175 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtirpc fixes the following issues: Security issues fixed: - CVE-2018-14621: libtirpc: Infinite loop in EMFILE case in svc_vc.c (bsc#1106519) - CVE-2018-14622: libtirpc: Segmentation fault in makefd_xprt return value in svc_vc.c (bsc#1106517) Moderate SUSE bug 1106517 SUSE bug 1106519 SUSE bug 968175 CVE-2018-14621 CVE-2018-14622 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA libvirt has been patched to fix two security issues. Further information is available at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0179 <http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0179> and http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6456 <http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6456> These security issues have been fixed: * Unsafe parsing of XML documents allows arbitrary file read or denial of service (CVE-2014-0179) * Ability to delete or create arbitrary host devices (CVE-2013-6456) Security Issue references: * CVE-2014-0179 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0179> * CVE-2013-6456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6456> SUSE bug 857490 SUSE bug 873705 CVE-2013-6456 CVE-2014-0179 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: Security issues fixed: - CVE-2017-5715: Spectre fixes for libvirt (bsc#1079869, bsc#1088147, bsc#1087887). - CVE-2018-1064: Avoid denial of service reading from QEMU guest agent (bsc#1083625). - CVE-2018-5748: Avoid denial of service reading from QEMU monitor (bsc#1076500). Bug fixes: - bsc#1025340: Use xend for nodeGetFreeMemory API. - bsc#960742: Allow read access to script directories in libvirtd AppArmor profile. - bsc#936233: Introduce qemuDomainDefCheckABIStability. Important SUSE bug 1025340 SUSE bug 1076500 SUSE bug 1079869 SUSE bug 1083625 SUSE bug 1087887 SUSE bug 1088147 SUSE bug 936233 SUSE bug 960742 CVE-2017-5715 CVE-2018-1064 CVE-2018-5748 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: - CVE-2018-3639: cpu: add support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Important SUSE bug 1092885 CVE-2018-3639 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: Security issue fixed: - CVE-2019-3886: Fixed a information exposure which allowed to retrieve the guest hostname under readonly mode (bsc#1131595). Moderate SUSE bug 1131595 CVE-2019-3886 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273). For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Important SUSE bug 1111331 SUSE bug 1135273 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: Security issue fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301). Important SUSE bug 1138301 CVE-2019-10161 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvirt fixes the following issues: Security issue fixed: - CVE-2016-5008: Fixed an issue where an empty VNC password would disables authentication (bsc#987527). Non-security issue fixed: - Fixed an issue where increasing the RAM or CPUs over a certain threshold would lead to soft lockups (bsc#952889). Moderate SUSE bug 952889 SUSE bug 987527 CVE-2016-5008 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The libvncserver package was updated to fix the following security issues: - bsc#897031: fix several security issues: * CVE-2014-6051: Integer overflow in MallocFrameBuffer() on client side. * CVE-2014-6052: Lack of malloc() return value checking on client side. * CVE-2014-6053: Server crash on a very large ClientCutText message. * CVE-2014-6054: Server crash when scaling factor is set to zero. * CVE-2014-6055: Multiple stack overflows in File Transfer feature. Moderate SUSE bug 897031 CVE-2014-6051 CVE-2014-6052 CVE-2014-6053 CVE-2014-6054 CVE-2014-6055 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvorbis fixes the following issues: - CVE-2017-14633: out-of-bounds array read vulnerability exists in function mapping0_forward() could lead to remote denial of service (bsc#1059811) - CVE-2017-14632: Remote Code Execution upon freeing uninitialized memory in function vorbis_analysis_headerout(bsc#1059809) Moderate SUSE bug 1059809 SUSE bug 1059811 CVE-2017-14632 CVE-2017-14633 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvorbis fixes the following issues: - CVE-2018-5146: Fixed out of bounds memory write while processing Vorbis audio data (bsc#1085687). Moderate SUSE bug 1085687 CVE-2018-5146 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvorbis fixes the following issues: Security issues fixed: - CVE-2018-10393: Fixed stack-based buffer over-read in bark_noise_hybridm (bsc#1091072). - CVE-2017-14160: Fixed out-of-bounds access inside bark_noise_hybridmp function (bsc#1059812). Moderate SUSE bug 1059812 SUSE bug 1091072 CVE-2017-14160 CVE-2018-10393 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libvorbis fixes the following issues: The following security issue was fixed: - Fixed the validation of channels in mapping0_forward(), which previously allowed remote attackers to cause a denial of service via specially crafted files (CVE-2018-10392, bsc#1091070) Moderate SUSE bug 1091070 CVE-2018-10392 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update adds a configuration option to disable SSLv2 and SSLv3 in openwsman. This is required to mitigate CVE-2014-3566. To use the new option, edit /etc/openwsman/openwsman.conf and add the following line to the [server] section: ssl_disabled_protocols = SSLv2 SSLv3 Security Issues: * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> SUSE bug 901882 CVE-2014-3566 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a denial of service via recursive entity expansion. (CVE-2014-3660) Security Issues: * CVE-2014-3660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3660> SUSE bug 901546 CVE-2014-3660 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes two security issues: - libxml2 limits the number of recursions an XML document can contain so to protect against the "Billion Laughs" denial-of-service attack. Unfortunately, the underlying counter was not incremented properly in all necessary locations. Therefore, specially crafted XML documents could exhaust all available stack space and crash the XML parser without running into the recursion limit. This vulnerability has been fixed. (bsc#975947) - When running in recovery mode, certain invalid XML documents would trigger an infinite recursion in libxml2 that ran until all stack space was exhausted. This vulnerability could have been used to facilitate a denial-of-sevice attack. (CVE-2016-3627, bsc#972335) Moderate SUSE bug 972335 SUSE bug 975947 CVE-2016-3627 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114]. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings [bsc#978395]. - CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040]. - CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041]. - CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108]. - CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109]. - CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral [bsc#981111]. - CVE-2016-1838: Fixed a heap-based buffer overread in xmlParserPrintFileContextInternal [bsc#981112]. - CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115]. - CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548]. - CVE-2016-4448: Fixed some format string warnings with possible format string vulnerability [bsc#981549], - CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550]. - CVE-2016-3705: Fixed missing increment of recursion counter. Important SUSE bug 963963 SUSE bug 965283 SUSE bug 978395 SUSE bug 981040 SUSE bug 981041 SUSE bug 981108 SUSE bug 981109 SUSE bug 981111 SUSE bug 981112 SUSE bug 981114 SUSE bug 981115 SUSE bug 981548 SUSE bug 981549 SUSE bug 981550 CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 CVE-2016-4483 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: - CVE-2016-4658: Use after free via namespace node in XPointer ranges (bsc#1005544). Moderate SUSE bug 1005544 CVE-2016-4658 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: * CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document (bsc#1010675). * Prevent NULL dereference in xpointer.c and xmlDumpElementContent, and infinite recursion in xmlParseConditionalSections when in recovery mode(bnc#1014873) Moderate SUSE bug 1010675 SUSE bug 1014873 CVE-2016-9318 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: Security issues fixed: - CVE-2017-9050: heap-based buffer overflow (xmlDictAddString func) [bsc#1039069, bsc#1039661] - CVE-2017-9049: heap-based buffer overflow (xmlDictComputeFastKey func) [bsc#1039066] - CVE-2017-9048: stack overflow vulnerability (xmlSnprintfElementContent func) [bsc#1039063] - CVE-2017-9047: stack overflow vulnerability (xmlSnprintfElementContent func) [bsc#1039064] A clarification for the previously released update: For CVE-2016-9318 we decided not to ship a fix since it can break existing setups. Please take appropriate actions if you parse untrusted XML files and use the new -noxxe flag if possible (bnc#1010675, bnc#1013930). Moderate SUSE bug 1010675 SUSE bug 1013930 SUSE bug 1039063 SUSE bug 1039064 SUSE bug 1039066 SUSE bug 1039069 SUSE bug 1039661 CVE-2016-9318 CVE-2017-9047 CVE-2017-9048 CVE-2017-9049 CVE-2017-9050 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: Security issues fixed: * CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID (bsc#1044337) * CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent (bsc#1024989) * CVE-2017-7375: Prevented an unwanted external entity reference (bsc#1044894) * CVE-2017-7376: Increase buffer space for port in HTTP redirect support (bsc#1044887) Moderate SUSE bug 1024989 SUSE bug 1044337 SUSE bug 1044887 SUSE bug 1044894 CVE-2017-0663 CVE-2017-5969 CVE-2017-7375 CVE-2017-7376 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: - CVE-2017-8872: Out-of-bounds read could lead to application crash (bsc#1038444) Moderate SUSE bug 1038444 CVE-2017-8872 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes several issues. Theses security issues were fixed: - CVE-2017-16932: Fixed infinite recursion could lead to an infinite loop or memory exhaustion when expanding a parameter entity in a DTD (bsc#1069689). - CVE-2017-15412: Prevent use after free when calling XPath extension functions that allowed remote attackers to cause DoS or potentially RCE (bsc#1077993) - CVE-2016-5131: Use-after-free vulnerability in libxml2 allowed remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. (bsc#1078813) - CVE-2017-5130: Fixed a potential remote buffer overflow in function xmlMemoryStrdup() (bsc#1078806) Moderate SUSE bug 1069689 SUSE bug 1077993 SUSE bug 1078806 SUSE bug 1078813 CVE-2016-5131 CVE-2017-15412 CVE-2017-16932 CVE-2017-5130 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following issues: Security issue fixed: - CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval() function when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service attack (bsc#1102046) Other Issue fixed: - Fixed a bug related to the fix for CVE-2016-9318 which allowed xsltproc to access the internet even when --nonet was given and also was making docbook-xsl-stylesheets to have incomplete xml catalog file (bsc#1010675, bsc#1126613 and bsc#1110146). Moderate SUSE bug 1010675 SUSE bug 1102046 SUSE bug 1110146 SUSE bug 1126613 CVE-2016-9318 CVE-2018-14404 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 doesn't fix any additional security issues, but correct its rpm changelog to reflect all CVEs that have been fixed over the past. Low SUSE bug 1123919 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues: * CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] * CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] * CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] * CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] * CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] * CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] * CVE-2015-5312 Fix another entity expansion issue [bnc#957105] * CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] * CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] * CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] * CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] Moderate SUSE bug 928193 SUSE bug 951734 SUSE bug 951735 SUSE bug 956018 SUSE bug 956021 SUSE bug 956260 SUSE bug 957105 SUSE bug 957106 SUSE bug 957107 SUSE bug 957109 SUSE bug 957110 CVE-2015-1819 CVE-2015-5312 CVE-2015-7497 CVE-2015-7498 CVE-2015-7499 CVE-2015-7500 CVE-2015-7941 CVE-2015-7942 CVE-2015-8241 CVE-2015-8242 CVE-2015-8317 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxml2 fixes the following security issue: - CVE-2015-8710: Parsing short unclosed HTML comment could cause uninitialized memory access, which allowed remote attackers to read contents from previous HTTP requests depending on the application (bsc#960674) Moderate SUSE bug 960674 CVE-2015-8710 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA libxslt received a security update to fix a security issue: * CVE-2013-4520: The XSL implementation in libxslt allowed remote attackers to cause a denial of service (crash) via an invalid DTD. (addendum due to incomplete fix for CVE-2012-2825) Security Issue references: * CVE-2012-6139 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6139> * CVE-2012-2825 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2825> * CVE-2011-3970 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3970> SUSE bug 849019 CVE-2011-3970 CVE-2012-2825 CVE-2012-6139 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxslt fixes the following issues: - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page (bsc#1035905). - CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator could cause a heap overread. This can be exploited to leak a couple of bytes after the buffer that holds the pattern string (bsc#1005591). - CVE-2015-9019: Properly initialize random generator (bsc#934119). - CVE-2015-7995: Vulnerability in function xsltStylePreCompute" in preproc.c could cause a type confusion leading to DoS. (bsc#952474) Moderate SUSE bug 1005591 SUSE bug 1035905 SUSE bug 934119 SUSE bug 952474 CVE-2015-7995 CVE-2015-9019 CVE-2016-4738 CVE-2017-5029 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libxslt fixes the following issues: Security issue fixed: - CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160). Moderate SUSE bug 1132160 CVE-2019-11068 SUSE Linux Enterprise Server 11 SP3-LTSS The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2015-8970: crypto/algif_skcipher.c in the Linux kernel did not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that did not supply a key, related to the lrw_crypt function in crypto/lrw.c (bnc#1008374). - CVE-2017-5551: Clear S_ISGID on tmpfs when setting posix ACLs (bsc#1021258). - CVE-2016-7097: The filesystem implementation in the Linux kernel preserves the setgid bit during a setxattr call, which allowed local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (bnc#995968). - CVE-2016-10088: The sg implementation in the Linux kernel did not properly restrict write operations in situations where the KERNEL_DS option is set, which allowed local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576 (bnc#1017710). - CVE-2004-0230: TCP, when using a large Window Size, made it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP (bnc#969340). - CVE-2016-8632: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel did not validate the relationship between the minimum fragment length and the maximum packet size, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability (bnc#1008831). - CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could have enabled a local malicious application to execute arbitrary code within the context of the kernel bnc#1014746). - CVE-2016-9793: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option (bnc#1013531). - CVE-2012-6704: The sock_setsockopt function in net/core/sock.c in the Linux kernel mishandled negative values of sk_sndbuf and sk_rcvbuf, which allowed local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option (bnc#1013542). - CVE-2016-9756: arch/x86/kvm/emulate.c in the Linux kernel did not properly initialize Code Segment (CS) in certain error cases, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application (bnc#1013038). - CVE-2016-3841: The IPv6 stack in the Linux kernel mishandled options data, which allowed local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call (bnc#992566). - CVE-2016-9685: Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations (bnc#1012832). - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939). - CVE-2015-8962: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call (bnc#1010501). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacked chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bnc#1011685). - CVE-2016-7910: Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel allowed local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed (bnc#1010716). - CVE-2016-7911: Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call (bnc#1010711). - CVE-2015-8964: The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a tty data structure (bnc#1010507). - CVE-2016-7916: Race condition in the environ_read function in fs/proc/base.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete (bnc#1010467). - CVE-2016-8646: The hash_accept function in crypto/algif_hash.c in the Linux kernel allowed local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data (bnc#1010150). - CVE-2016-8633: drivers/firewire/net.c in the Linux kernel in certain unusual hardware configurations allowed remote attackers to execute arbitrary code via crafted fragmented packets (bnc#1008833). - CVE-2016-7042: The proc_keys_show function in security/keys/proc.c in the Linux, when the GNU Compiler Collection (gcc) stack protector is enabled, used an incorrect buffer size for certain timeout data, which allowed local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file (bnc#1004517). - CVE-2015-8956: The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel allowed local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket (bnc#1003925). - CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077). - CVE-2016-0823: The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel allowed local users to obtain sensitive physical-address information by reading a pagemap file (bnc#994759). - CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did not restrict a certain length field, which allowed local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932). - CVE-2016-6828: The tcp_check_send_head function in include/net/tcp.h in the Linux kernel did not properly maintain certain SACK state after a failed data copy, which allowed local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option (bnc#994296). The following non-security bugs were fixed: - Always include the git commit in KOTD builds. This allows us not to set it explicitly in builds submitted to the official distribution (bnc#821612, bnc#824171). - KVM: x86: SYSENTER emulation is broken (bsc#994618). - NFS: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261). - NFS: Refresh open-owner id when server says SEQID is bad (bsc#989261). - NFSv4: Ensure that we do not drop a state owner more than once (bsc#979595). - NFSv4: add flock_owner to open context (bnc#998689). - NFSv4: change nfs4_do_setattr to take an open_context instead of a nfs4_state (bnc#998689). - NFSv4: change nfs4_select_rw_stateid to take a lock_context inplace of lock_owner (bnc#998689). - NFSv4: enhance nfs4_copy_lock_stateid to use a flock stateid if there is one (bnc#998689). - NFSv4: fix broken patch relating to v4 read delegations (bsc#956514, bsc#989261, bsc#979595). - SELinux: Fix possible NULL pointer dereference in selinux_inode_permission() (bsc#1012895). - USB: fix typo in wMaxPacketSize validation (bsc#991665). - USB: validate wMaxPacketValue entries in endpoint descriptors (bnc#991665). - Update patches.xen/xen3-auto-arch-x86.diff (bsc#929141, among others). - __ptrace_may_access() should not deny sub-threads (bsc#1012851). - apparmor: fix IRQ stack overflow during free_profile (bsc#1009875). - arch/powerpc: Remove duplicate/redundant Altivec entries (bsc#967716). - cdc-acm: added sanity checking for probe() (bsc#993891). - include/linux/math64.h: add div64_ul() (bsc#996329). - kabi-fix for flock_owner addition (bsc#998689). - kabi: get back scsi_device.current_cmnd (bsc#935436). - kaweth: fix firmware download (bsc#993890). - kaweth: fix oops upon failed memory allocation (bsc#993890). - kexec: add a kexec_crash_loaded() function (bsc#973691). - md linear: fix a race between linear_add() and linear_congested() (bsc#1018446). - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (bsc#1011820). - mpt3sas: Fix panic when aer correct error occurred (bsc#997708, bsc#999943). - mremap: enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma() (VM Functionality, bsc#1008645). - nfs4: reset states to use open_stateid when returning delegation voluntarily (bsc#1007944). - ocfs2: fix BUG_ON() in ocfs2_ci_checkpointed() (bnc#1019783). - posix-timers: Remove remaining uses of tasklist_lock (bnc#997401). - posix-timers: Use sighand lock instead of tasklist_lock for task clock sample (bnc#997401). - posix-timers: Use sighand lock instead of tasklist_lock on timer deletion (bnc#997401). - powerpc: Add ability to build little endian kernels (bsc#967716). - powerpc: Avoid load of static chain register when calling nested functions through a pointer on 64bit (bsc#967716). - powerpc: Do not build assembly files with ABIv2 (bsc#967716). - powerpc: Do not use ELFv2 ABI to build the kernel (bsc#967716). - powerpc: Fix 64 bit builds with binutils 2.24 (bsc#967716). - powerpc: Fix error when cross building TAGS and cscope (bsc#967716). - powerpc: Make the vdso32 also build big-endian (bsc#967716). - powerpc: Remove altivec fix for gcc versions before 4.0 (bsc#967716). - powerpc: Remove buggy 9-year-old test for binutils lower than 2.12.1 (bsc#967716). - powerpc: Require gcc 4.0 on 64-bit (bsc#967716). - powerpc: dtc is required to build dtb files (bsc#967716). - printk/sched: Introduce special printk_sched() for those awkward (bsc#1013042, bsc#996541, bsc#1015878). - qlcnic: Schedule napi directly in netpoll (bsc#966826). - reiserfs: fix race in prealloc discard (bsc#987576). - rpm/config.sh: Set a fitting release string (bsc#997059) - rpm/kernel-binary.spec.in: Export a make-stderr.log file (bsc#1012422) - rpm/mkspec: Read a default release string from rpm/config.sh (bsc997059) - s390/dasd: fix failfast for disconnected devices (bnc#961923, LTC#135138). - sched/core: Fix a race between try_to_wake_up() and a woken up task (bnc#1002165). - sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() (bnc#1001419). - sched: Fix possible divide by zero in avg_atom() calculation (bsc#996329). - scsi: lpfc: Set elsiocb contexts to NULL after freeing it (bsc#996557). - scsi: remove current_cmnd field from struct scsi_device (bsc#935436). - x86/MCE/intel: Cleanup CMCI storm logic (bsc#929141). - xfs: remove the deprecated nodelaylog option (bsc#992906). Important SUSE bug 1001419 SUSE bug 1002165 SUSE bug 1003077 SUSE bug 1003253 SUSE bug 1003925 SUSE bug 1004517 SUSE bug 1007944 SUSE bug 1008374 SUSE bug 1008645 SUSE bug 1008831 SUSE bug 1008833 SUSE bug 1008850 SUSE bug 1009875 SUSE bug 1010150 SUSE bug 1010467 SUSE bug 1010501 SUSE bug 1010507 SUSE bug 1010711 SUSE bug 1010713 SUSE bug 1010716 SUSE bug 1011685 SUSE bug 1011820 SUSE bug 1012183 SUSE bug 1012422 SUSE bug 1012832 SUSE bug 1012851 SUSE bug 1012852 SUSE bug 1012895 SUSE bug 1013038 SUSE bug 1013042 SUSE bug 1013531 SUSE bug 1013542 SUSE bug 1014454 SUSE bug 1014746 SUSE bug 1015878 SUSE bug 1017710 SUSE bug 1018446 SUSE bug 1019079 SUSE bug 1019783 SUSE bug 1021258 SUSE bug 821612 SUSE bug 824171 SUSE bug 914939 SUSE bug 929141 SUSE bug 935436 SUSE bug 956514 SUSE bug 961923 SUSE bug 966826 SUSE bug 967716 SUSE bug 969340 SUSE bug 973691 SUSE bug 979595 SUSE bug 987576 SUSE bug 989152 SUSE bug 989261 SUSE bug 991665 SUSE bug 992566 SUSE bug 992569 SUSE bug 992906 SUSE bug 992991 SUSE bug 993890 SUSE bug 993891 SUSE bug 994296 SUSE bug 994618 SUSE bug 994759 SUSE bug 995968 SUSE bug 996329 SUSE bug 996541 SUSE bug 996557 SUSE bug 997059 SUSE bug 997401 SUSE bug 997708 SUSE bug 998689 SUSE bug 999932 SUSE bug 999943 CVE-2004-0230 CVE-2012-6704 CVE-2015-1350 CVE-2015-8956 CVE-2015-8962 CVE-2015-8964 CVE-2015-8970 CVE-2016-0823 CVE-2016-10088 CVE-2016-3841 CVE-2016-6828 CVE-2016-7042 CVE-2016-7097 CVE-2016-7117 CVE-2016-7425 CVE-2016-7910 CVE-2016-7911 CVE-2016-7916 CVE-2016-8399 CVE-2016-8632 CVE-2016-8633 CVE-2016-8646 CVE-2016-9555 CVE-2016-9685 CVE-2016-9756 CVE-2016-9793 CVE-2017-5551 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The container framework LXC has been updated to fix various bugs and a security issue: * CVE-2013-6441: The sshd template allowed privilege escalation on the host. * SLES container time not aligned with host time (bnc#839653) * SLES container boot takes ages (bnc#839663) * lxc mounts /dev/pts with wrong options (bnc#869663) Security Issues: * CVE-2013-6441 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6441> SUSE bug 839653 SUSE bug 839663 SUSE bug 855809 SUSE bug 869663 CVE-2013-6441 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA lxc was update to fix one security issue. The following vulnerability was fixed: * CVE-2015-1335: A directory traversal flaw while lxc-start is initially setting up the mounts for a container (bsc#946744) Moderate SUSE bug 946744 CVE-2015-1335 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mailman to version 2.1.15 fixes the following issues: - CVE-2016-6893: Prevent cross-site request forgery (CSRF) vulnerability in the user options page that allowed remote attackers to hijack the authentication of arbitrary users for requests that modify an option (bsc#995352). - Various other hardenings against CSFR attacks For details please see https://launchpad.net/mailman/+milestone/2.1.15 Moderate SUSE bug 995352 CVE-2016-6893 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mailman fixes the following issues: - Fixed a XSS vulnerability and information leak in user options CGI, which could be used to execute arbitrary scripts in the user's browser via specially encoded URLs (bsc#1077358 CVE-2018-5950) - Fixed a directory traversal vulnerability in MTA transports when using the recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775) - Fixed a XSS vulnerability, which allowed malicious listowners to inject scripts into the listinfo pages (bsc#1099510 CVE-2018-0618) - Fixed arbitrary text injection vulnerability in several mailman CGIs (CVE-2018-13796 bsc#1101288) - Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352) Important SUSE bug 1077358 SUSE bug 1099510 SUSE bug 1101288 SUSE bug 925502 SUSE bug 995352 CVE-2015-2775 CVE-2016-6893 CVE-2018-0618 CVE-2018-13796 CVE-2018-5950 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mailman fixes the following issues: Security issue fixed: - CVE-2016-6893: Fixed a Cross-site request forgery vulnerability in the admin web interface (bsc#997205). Following bug was fixed: - Allow CSRF check to pass in mailman web frontend if the list name contains a "+" (bsc#1102416) Important SUSE bug 1102416 SUSE bug 997205 CVE-2016-6893 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This mailx update fixes the following security issues: * bnc#909208: Shell command injection via crafted email addresses (CVE-2004-2771, CVE-2014-7844). Security Issues: * CVE-2004-2771 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2771> * CVE-2014-7844 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7844> SUSE bug 909208 CVE-2004-2771 CVE-2014-7844 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox, mozilla-nss fixes security issues and bugs. The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026 bsc#1012964): - CVE-2016-9079: Use-after-free in SVG Animation (MFSA 2016-92 bsc#1012964) - CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404) - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402) - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410) The following vulnerabilities were fixed in mozilla-nss 3.21.3: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422) - CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517) The following bugs were fixed: - Firefox would fail to go into fullscreen mode with some window managers (bsc#992549) - font warning messages would flood console, now using fontconfig configuration from firefox-fontconfig instead of the system one (bsc#1000751) Important SUSE bug 1000751 SUSE bug 1009026 SUSE bug 1010395 SUSE bug 1010401 SUSE bug 1010402 SUSE bug 1010404 SUSE bug 1010410 SUSE bug 1010422 SUSE bug 1010427 SUSE bug 1010517 SUSE bug 1012964 SUSE bug 992549 CVE-2016-5285 CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9064 CVE-2016-9066 CVE-2016-9074 CVE-2016-9079 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mgetty fixes the following issues: - CVE-2018-16741: The function do_activate() did not properly sanitize shell metacharacters to prevent command injection (bsc#1108752) - CVE-2018-16745: The mail_to parameter was not sanitized, leading to a buffer overflow if long untrusted input reached it (bsc#1108756) - CVE-2018-16744: The mail_to parameter was not sanitized, leading to command injection if untrusted input reached reach it (bsc#1108757) - CVE-2018-16742: Prevent stack-based buffer overflow that could have been triggered via a command-line parameter (bsc#1108762) - CVE-2018-16743: The command-line parameter username wsa passed unsanitized to strcpy(), which could have caused a stack-based buffer overflow (bsc#1108761) Important SUSE bug 1108752 SUSE bug 1108756 SUSE bug 1108757 SUSE bug 1108761 SUSE bug 1108762 CVE-2018-16741 CVE-2018-16742 CVE-2018-16743 CVE-2018-16744 CVE-2018-16745 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA Update to Intel microcode version 20180108 (bsc#1075262 CVE-2017-5715) - The pre-released microcode fixing some important security issues is now officially published (and included in the added tarball). Among other updates it contains: - IVT C0 (06-3e-04:ed) 428->42a - SKL-U/Y D0 (06-4e-03:c0) ba->c2 - BDW-U/Y E/F (06-3d-04:c0) 25->28 - HSW-ULT Cx/Dx (06-45-01:72) 20->21 - Crystalwell Cx (06-46-01:32) 17->18 - BDW-H E/G (06-47-01:22) 17->1b - HSX-EX E0 (06-3f-04:80) 0f->10 - SKL-H/S R0 (06-5e-03:36) ba->c2 - HSW Cx/Dx (06-3c-03:32) 22->23 - HSX C0 (06-3f-02:6f) 3a->3b - BDX-DE V0/V1 (06-56-02:10) 0f->14 - BDX-DE V2 (06-56-03:10) 700000d->7000011 - KBL-U/Y H0 (06-8e-09:c0) 62->80 - KBL Y0 / CFL D0 (06-8e-0a:c0) 70->80 - KBL-H/S B0 (06-9e-09:2a) 5e->80 - CFL U0 (06-9e-0a:22) 70->80 - CFL B0 (06-9e-0b:02) 72->80 - SKX H0 (06-55-04:b7) 2000035->200003c - GLK B0 (06-7a-01:01) 1e->22 Important SUSE bug 1075262 CVE-2017-5715 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws (boo#1085207 CVE-2017-5715) - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 1000140 - Updates - SNB D2 6-2a-7:12 29->2d - JKT C1 6-2d-6:6d 619->61c - JKT C2 6-2d-7:6d 710->713 - IVB E2 6-3a-9:12 1c->1f - IVT C0 6-3e-4:ed 428->42c - IVT D1 6-3e-7:ed 70d->713 - HSW Cx/Dx 6-3c-3:32 22->24 - HSW-ULT Cx/Dx 6-45-1:72 20->23 - CRW Cx 6-46-1:32 17->19 - HSX C0 6-3f-2:6f 3a->3c - HSX-EX E0 6-3f-4:80 0f->11 - BDW-U/Y E/F 6-3d-4:c0 25->2a - BDW-H E/G 6-47-1:22 17->1d - BDX-DE V0/V1 6-56-2:10 0f->15 - BDW-DE V2 6-56-3:10 700000d->7000012 - BDW-DE Y0 6-56-4:10 f00000a->f000011 - SKL-U/Y D0 6-4e-3:c0 ba->c2 - SKL R0 6-5e-3:36 ba->c2 - KBL-U/Y H0 6-8e-9:c0 62->84 - KBL B0 6-9e-9:2a 5e->84 - CFL D0 6-8e-a:c0 70->84 - CFL U0 6-9e-a:22 70->84 - CFL B0 6-9e-b:02 72->84 - SKX H0 6-55-4:b7 2000035->2000043 Important SUSE bug 1085207 CVE-2017-5715 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for microcode_ctl fixes the following security issue: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction (bsc#1095735) Moderate SUSE bug 1095735 CVE-2017-5715 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for microcode_ctl fixes the following issues: The Intel CPU Microcode bundle was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and helps mitigating CVE-2018-3639 (Spectre v4) (bsc#1100147 bsc#1087082 bsc#1087083) More details can be found on: https://downloadcenter.intel.com/download/27945/Linux-Processor-Microcode-Data-File Following chipsets are fixed in this round: Model Stepping F-MO-S/PI Old->New ---- updated platforms ------------------------------------ SNB-EP C1 6-2d-6/6d 0000061c->0000061d Xeon E5 SNB-EP C2 6-2d-7/6d 00000713->00000714 Xeon E5 IVT C0 6-3e-4/ed 0000042c->0000042d Xeon E5 v2; Core i7-4960X/4930K/4820K IVT D1 6-3e-7/ed 00000713->00000714 Xeon E5 v2 HSX-E/EP/4S C0 6-3f-2/6f 0000003c->0000003d Xeon E5 v3 HSX-EX E0 6-3f-4/80 00000011->00000012 Xeon E7 v3 SKX-SP/D/W/X H0 6-55-4/b7 02000043->0200004d Xeon Bronze 31xx, Silver 41xx, Gold 51xx/61xx Platinum 81xx, D/W-21xx; Core i9-7xxxX BDX-DE A1 6-56-5/10 0e000009->0e00000a Xeon D-15x3N BDX-ML B/M/R0 6-4f-1/ef 0b00002c->0b00002e Xeon E5/E7 v4; Core i7-69xx/68xx Important SUSE bug 1087082 SUSE bug 1087083 SUSE bug 1100147 CVE-2018-3639 CVE-2018-3640 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA ucode-intel was updated to the 20180807 release. For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a), and is part of the mitigations for CVE-2018-3639 (Spectre v4) and CVE-2018-3646 (L1 Terminal Fault). (bsc#1104134 bsc#1087082 bsc#1087083 bsc#1089343) Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New ---- new platforms ---------------------------------------- WSM-EP/WS U1 6-2c-2/03 0000001f Xeon E/L/X56xx, W36xx NHM-EX D0 6-2e-6/04 0000000d Xeon E/L/X65xx/75xx BXT C0 6-5c-2/01 00000014 Atom T5500/5700 APL E0 6-5c-a/03 0000000c Atom x5-E39xx DVN B0 6-5f-1/01 00000024 Atom C3xxx ---- updated platforms ------------------------------------ NHM-EP/WS D0 6-1a-5/03 00000019->0000001d Xeon E/L/X/W55xx NHM B1 6-1e-5/13 00000007->0000000a Core i7-8xx, i5-7xx; Xeon L3426, X24xx WSM B1 6-25-2/12 0000000e->00000011 Core i7-6xx, i5-6xx/4xxM, i3-5xx/3xxM, Pentium G69xx, Celeon P45xx; Xeon L3406 WSM K0 6-25-5/92 00000004->00000007 Core i7-6xx, i5-6xx/5xx/4xx, i3-5xx/3xx, Pentium G69xx/P6xxx/U5xxx, Celeron P4xxx/U3xxx SNB D2 6-2a-7/12 0000002d->0000002e Core Gen2; Xeon E3 WSM-EX A2 6-2f-2/05 00000037->0000003b Xeon E7 IVB E2 6-3a-9/12 0000001f->00000020 Core Gen3 Mobile HSW-H/S/E3 Cx/Dx 6-3c-3/32 00000024->00000025 Core Gen4 Desktop; Xeon E3 v3 BDW-U/Y E/F 6-3d-4/c0 0000002a->0000002b Core Gen5 Mobile HSW-ULT Cx/Dx 6-45-1/72 00000023->00000024 Core Gen4 Mobile and derived Pentium/Celeron HSW-H Cx 6-46-1/32 00000019->0000001a Core Extreme i7-5xxxX BDW-H/E3 E/G 6-47-1/22 0000001d->0000001e Core i5-5xxxR/C, i7-5xxxHQ/EQ; Xeon E3 v4 SKL-U/Y D0 6-4e-3/c0 000000c2->000000c6 Core Gen6 Mobile BDX-DE V1 6-56-2/10 00000015->00000017 Xeon D-1520/40 BDX-DE V2/3 6-56-3/10 07000012->07000013 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 BDX-DE Y0 6-56-4/10 0f000011->0f000012 Xeon D-1557/59/67/71/77/81/87 APL D0 6-5c-9/03 0000002c->00000032 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx SKL-H/S/E3 R0 6-5e-3/36 000000c2->000000c6 Core Gen6; Xeon E3 v5 Important SUSE bug 1087082 SUSE bug 1087083 SUSE bug 1089343 SUSE bug 1104134 CVE-2018-3639 CVE-2018-3640 CVE-2018-3646 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for microcode_ctl fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old->New - ---- new platforms ---------------------------------------- - CLX-SP B1 6-55-7/bf 05000021 Xeon Scalable Gen2 - ---- updated platforms ------------------------------------ - SNB D2/G1/Q0 6-2a-7/12 0000002e->0000002f Core Gen2 - IVB E1/L1 6-3a-9/12 00000020->00000021 Core Gen3 - HSW C0 6-3c-3/32 00000025->00000027 Core Gen4 - BDW-U/Y E0/F0 6-3d-4/c0 0000002b->0000002d Core Gen5 - IVB-E/EP C1/M1/S1 6-3e-4/ed 0000042e->0000042f Core Gen3 X Series; Xeon E5 v2 - IVB-EX D1 6-3e-7/ed 00000714->00000715 Xeon E7 v2 - HSX-E/EP Cx/M1 6-3f-2/6f 00000041->00000043 Core Gen4 X series; Xeon E5 v3 - HSX-EX E0 6-3f-4/80 00000013->00000014 Xeon E7 v3 - HSW-U C0/D0 6-45-1/72 00000024->00000025 Core Gen4 - HSW-H C0 6-46-1/32 0000001a->0000001b Core Gen4 - BDW-H/E3 E0/G0 6-47-1/22 0000001e->00000020 Core Gen5 - SKL-U/Y D0/K1 6-4e-3/c0 000000c6->000000cc Core Gen6 - SKX-SP H0/M0/U0 6-55-4/b7 0200005a->0000005e Xeon Scalable - SKX-D M1 6-55-4/b7 0200005a->0000005e Xeon D-21xx - BDX-DE V1 6-56-2/10 00000019->0000001a Xeon D-1520/40 - BDX-DE V2/3 6-56-3/10 07000016->07000017 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 - BDX-DE Y0 6-56-4/10 0f000014->0f000015 Xeon D-1557/59/67/71/77/81/87 - BDX-NS A0 6-56-5/10 0e00000c->0e00000d Xeon D-1513N/23/33/43/53 - APL D0 6-5c-9/03 00000036->00000038 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx - SKL-H/S R0/N0 6-5e-3/36 000000c6->000000cc Core Gen6; Xeon E3 v5 - DNV B0 6-5f-1/01 00000024->0000002e Atom Processor C Series - GLK B0 6-7a-1/01 0000002c->0000002e Pentium Silver N/J5xxx, Celeron N/J4xxx - AML-Y22 H0 6-8e-9/10 0000009e->000000b4 Core Gen8 Mobile - KBL-U/Y H0 6-8e-9/c0 0000009a->000000b4 Core Gen7 Mobile - CFL-U43e D0 6-8e-a/c0 0000009e->000000b4 Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000a4->000000b8 Core Gen8 Mobile - WHL-U V0 6-8e-d/94 000000b2->000000b8 Core Gen8 Mobile - KBL-G/H/S/E3 B0 6-9e-9/2a 0000009a->000000b4 Core Gen7; Xeon E3 v6 - CFL-H/S/E3 U0 6-9e-a/22 000000aa->000000b4 Core Gen8 Desktop, Mobile, Xeon E - CFL-S B0 6-9e-b/02 000000aa->000000b4 Core Gen8 - CFL-H/S P0 6-9e-c/22 000000a2->000000ae Core Gen9 - CFL-H R0 6-9e-d/22 000000b0->000000b8 Core Gen9 Mobile Important SUSE bug 1111331 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for microcode_ctl fixes the following issues: This update contains the Intel QSR 2019.1 Microcode release (bsc#1111331) Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331) - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) - CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS) - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) These updates contain the CPU Microcode adjustments for the software mitigations. For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736 Release notes: ---- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061d->0000061f Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000714->00000718 Xeon E3/E5, Core X ---- new platforms ---------------------------------------- VLV C0 6-37-8/02 00000838 Atom Z series VLV C0 6-37-8/0C 00000838 Celeron N2xxx, Pentium N35xx VLV D0 6-37-9/0F 0000090c Atom E38xx CHV C0 6-4c-3/01 00000368 Atom X series CHV D0 6-4c-4/01 00000411 Atom X series Readded what missing in last update: BDX-ML B0/M0/R0 6-4f-1/ef 0b00002e->00000036 Xeon E5/E7 v4; Core i7-69xx/68xx Important SUSE bug 1111331 SUSE bug 1141977 CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for minicom fixes the following issues: - CVE-2017-7467: Invalid cursor coordinates and scroll regions could lead to code execution (bsc#1033783) Moderate SUSE bug 1033783 CVE-2017-7467 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA mono-core was updated to fix the following vulnerabilities: - CVE-2009-0689: Remote attackers could cause a denial of service and possibly arbitrary code execution through the string-to-double parser implementation (bsc#958097) - CVE-2012-3543: Remote attackers could cause a denial of service through increased CPU consumption due to lack of protection against predictable hash collisions when processing form parameters (bsc#739119) Moderate SUSE bug 739119 SUSE bug 958097 CVE-2009-0689 CVE-2012-3543 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA mono-core was updated to fix the following vulnerabilities: - CVE-2009-0689: Remote attackers could cause a denial of service and possibly arbitrary code execution through the string-to-double parser implementation. (bsc#958097) - CVE-2012-3543: Remote attackers could cause a denial of service through increased CPU consumption due to lack of protection against predictable hash collisions when processing form parameters. (bsc#739119) Moderate SUSE bug 739119 SUSE bug 958097 CVE-2009-0689 CVE-2012-3543 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss fixes the following issues: (bsc#963520) Mozilla Firefox was updated to 38.6.0 ESR. Mozilla NSS was updated to 3.20.2. The following vulnerabilities were fixed: - CVE-2016-1930: Memory safety bugs fixed in Firefox ESR 38.6 (bsc#963632) - CVE-2016-1935: Buffer overflow in WebGL after out of memory allocation (bsc#963635) - CVE-2016-1938: Calculations with mp_div and mp_exptmod in Network Security Services (NSS) canproduce wrong results (bsc#963731) The following improvements were added: - bsc#954447: Mozilla NSS now supports a number of new DHE ciphersuites - Tracking protection is now enabled by default Important SUSE bug 954447 SUSE bug 963520 SUSE bug 963632 SUSE bug 963635 SUSE bug 963731 CVE-2016-1930 CVE-2016-1935 CVE-2016-1938 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA mozilla-nspr was update to version 4.10.8 Moderate SUSE bug 935979 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update contains mozilla-nss 3.19.2.2 and fixes the following security issue: - CVE-2015-7575: MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature (bsc#959888) Moderate SUSE bug 959888 CVE-2015-7575 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla NSS has been updated to 3.15.2 (bnc#847708) bringing various features and bugfixes: The main feature is TLS 1.2 support and its dependent algorithms. * Support for AES-GCM ciphersuites that use the SHA-256 PRF * MD2, MD4, and MD5 signatures are no longer accepted for OCSP or CRLs * Add PK11_CipherFinal macro * sizeof() used incorrectly * nssutil_ReadSecmodDB() leaks memory * Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished. * Deprecate the SSL cipher policy code * Avoid uninitialized data read in the event of a decryption failure. (CVE-2013-1739) Changes coming with version 3.15.1: * TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations: The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. o some bugfixes and improvements Changes with version 3.15 * New Functionality o Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); o Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. o Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. o certutil has been updated to support creating name constraints extensions. Security Issue reference: * CVE-2013-1739 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1739> SUSE bug 847708 CVE-2013-1739 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The mailreader mutt was updated to fix a security issue in displaying mail headers, where a crafted e-mail could cause a heap overflow, which in turn might be used by attackers to crash mutt or potentially even execute code. Security Issues references: * CVE-2014-0467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467> SUSE bug 868115 CVE-2014-0467 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mutt fixes the following issues: Security issues fixed: - CVE-2018-14352: Fix imap_quote_string in imap/util.c that does not leave room for quote characters (bsc#1101582). - CVE-2018-14353: Fix imap_quote_string in imap/util.c that has an integer underflow (bsc#1101581). - CVE-2018-14362: Fix pop.c that does not forbid characters that may have unsafe interaction with message-cache pathnames (bsc#1101567). - CVE-2018-14354: Fix arbitrary command execution from remote IMAP servers via backquote characters (bsc#1101578). - CVE-2018-14356: Fix pop.c that mishandles a zero-length UID (bsc#1101576). - CVE-2018-14355: Fix imap/util.c that mishandles ".." directory traversal in a mailbox name (bsc#1101577). - CVE-2018-14349: Fix imap/command.c that mishandles a NO response without a message (bsc#1101589). - CVE-2018-14350: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along INTERNALDATE field (bsc#1101588). - CVE-2018-14357: Fix that remote IMAP servers are allowed to execute arbitrary commands via backquote characters (bsc#1101573). - CVE-2018-14359: Fix buffer overflow via base64 data (bsc#1101570). - CVE-2018-14358: Fix imap/message.c that has a stack-based buffer overflow for a FETCH response with along RFC822.SIZE field (bsc#1101571). Bug fixes: - bsc#936807: On entering a 70 character subject line in mutt, a tab is added to the text after 67 characters. Important SUSE bug 1101567 SUSE bug 1101570 SUSE bug 1101571 SUSE bug 1101573 SUSE bug 1101576 SUSE bug 1101577 SUSE bug 1101578 SUSE bug 1101581 SUSE bug 1101582 SUSE bug 1101588 SUSE bug 1101589 SUSE bug 936807 CVE-2018-14349 CVE-2018-14350 CVE-2018-14352 CVE-2018-14353 CVE-2018-14354 CVE-2018-14355 CVE-2018-14356 CVE-2018-14357 CVE-2018-14358 CVE-2018-14359 CVE-2018-14362 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA MySQL was updated to version 5.5.45, fixing bugs and security issues. A list of all changes can be found on: - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html To fix the "BACKRONYM" security issue (CVE-2015-3152) the behaviour of the SSL options was changed slightly to meet expectations: Now using '--ssl-verify-server-cert' and '--ssl[-*]' implies that the ssl connection is required. The mysql client will now print an error if ssl is required, but the server can not handle a ssl connection [bnc#924663], [bnc#928962], [CVE-2015-3152] Additional bugs fixed: - fix rc.mysql-multi script to start instances after restart properly [bnc#934401]. Moderate SUSE bug 924663 SUSE bug 928962 SUSE bug 934401 SUSE bug 938412 CVE-2015-2582 CVE-2015-2611 CVE-2015-2617 CVE-2015-2620 CVE-2015-2639 CVE-2015-2641 CVE-2015-2643 CVE-2015-2648 CVE-2015-2661 CVE-2015-3152 CVE-2015-4737 CVE-2015-4752 CVE-2015-4756 CVE-2015-4757 CVE-2015-4761 CVE-2015-4767 CVE-2015-4769 CVE-2015-4771 CVE-2015-4772 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The mysql package was updated to version 5.5.46 to fixs several security and non security issues. - bnc#951391: update to version 5.5.46 * changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html * fixed CVEs: CVE-2015-1793, CVE-2015-0286, CVE-2015-0288, CVE-2015-1789, CVE-2015-4730, CVE-2015-4766, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862, CVE-2015-4864, CVE-2015-4866, CVE-2015-4870, CVE-2015-4879, CVE-2015-4890, CVE-2015-4895, CVE-2015-4904, CVE-2015-4905, CVE-2015-4910, CVE-2015-4913 - bnc#952196: Fixed a build error for ppc*, s390* and ia64 architectures. Moderate SUSE bug 951391 SUSE bug 952196 CVE-2015-0286 CVE-2015-0288 CVE-2015-1789 CVE-2015-1793 CVE-2015-4730 CVE-2015-4766 CVE-2015-4792 CVE-2015-4800 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816 CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4833 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4862 CVE-2015-4864 CVE-2015-4866 CVE-2015-4870 CVE-2015-4879 CVE-2015-4890 CVE-2015-4895 CVE-2015-4904 CVE-2015-4905 CVE-2015-4910 CVE-2015-4913 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to MySQL 5.5.47 fixes the following issues (bsc#962779): - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0616: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf() The following bugs were fixed: - bsc#960961: Incorrect use of plugin-load option in default_plugins.cnf Moderate SUSE bug 959724 SUSE bug 960961 SUSE bug 962779 CVE-2015-7744 CVE-2016-0502 CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598 CVE-2016-0600 CVE-2016-0606 CVE-2016-0608 CVE-2016-0609 CVE-2016-0616 SUSE Linux Enterprise Server 11 SP3-TERADATA mysql was updated to version 5.5.49 to fix 13 security issues. These security issues were fixed: - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#976341). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#976341). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#976341). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#976341). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#976341). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#976341). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#976341). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#976341). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#976341). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#976341). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#976341). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#976341). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com (bsc#963806). More details are available at - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html - http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html Important SUSE bug 963806 SUSE bug 976341 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0651 CVE-2016-0666 CVE-2016-2047 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql fixes the following issues: - bsc#959724: fix incorrect usage of sprintf/strcpy that caused possible buffer overflow issues at various places On SUSE Linux Enterprise 11 SP4 this fix was not yet shipped: - Increase the key length (to 2048 bits) used in vio/viosslfactories.c for creating Diffie-Hellman keys (Logjam Attack) [bnc#934789] [CVE-2015-4000] Moderate SUSE bug 934789 SUSE bug 959724 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This mysql update to verson 5.5.52 fixes the following issues: Security issues fixed: - CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser (bsc#989913). - CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types (bsc#989919). - CVE-2016-3615: Fixed unspecified vulnerability in subcomponent dml (bsc#989922). - CVE-2016-5440: Fixed unspecified vulnerability in subcomponent rbr (bsc#989926). - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and , under certain circumstances, execute arbitrary code as mysql (or even root) user. (bsc#998309) More details can be found on: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html Bugs fixed: - bsc#967374: properly restart mysql multi instances during upgrade - bnc#937258: multi script to restart after crash Important SUSE bug 937258 SUSE bug 967374 SUSE bug 989913 SUSE bug 989919 SUSE bug 989922 SUSE bug 989926 SUSE bug 998309 CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 CVE-2016-6662 SUSE Linux Enterprise Server 11 SP3-TERADATA This mysql version update to 5.5.53 fixes the following issues: - CVE-2016-6662: Unspecified vulnerability in subcomponent Logging (bsc#1005580) - CVE-2016-7440: Unspecified vulnerability in subcomponent Encryption (bsc#1005581) - CVE-2016-5584: Unspecified vulnerability in subcomponent Encryption (bsc#1005558) Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html Important SUSE bug 1005558 SUSE bug 1005580 SUSE bug 1005581 CVE-2016-5584 CVE-2016-6662 CVE-2016-7440 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This mysql version update to 5.5.54 fixes the following issues: - CVE-2017-3318: Unspecified vulnerability affecting Error Handling (bsc#1020896) - CVE-2017-3317: Unspecified vulnerability affecting Logging (bsc#1020894) - CVE-2017-3313: Unspecified vulnerability affecting the MyISAM component (bsc#1020890) - CVE-2017-3312: Insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873) - CVE-2017-3291: Unrestricted mysqld_safe's ledir (bsc#1020884) - CVE-2017-3265: Unsafe chmod/chown use in init script (bsc#1020885) - CVE-2017-3258: Unspecified vulnerability in the DDL component (bsc#1020875) - CVE-2017-3244: Unspecified vulnerability affecing the DML component (bsc#1020877) - CVE-2017-3243: Unspecified vulnerability affecting the Charsets component (bsc#1020891) - CVE-2017-3238: Unspecified vulnerability affecting the Optimizer component (bsc#1020882) - Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428) Release Notes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html Important SUSE bug 1020868 SUSE bug 1020873 SUSE bug 1020875 SUSE bug 1020877 SUSE bug 1020882 SUSE bug 1020884 SUSE bug 1020885 SUSE bug 1020890 SUSE bug 1020891 SUSE bug 1020894 SUSE bug 1020896 SUSE bug 1022428 CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql to version 5.5.55 fixes the following issues: These security issues were fixed: - CVE-2017-3308: Unspecified vulnerability in Server: DML (bsc#1034850) - CVE-2017-3309: Unspecified vulnerability in Server: Optimizer (bsc#1034850) - CVE-2017-3329: Unspecified vulnerability in Server: Thread (bsc#1034850) - CVE-2017-3600: Unspecified vulnerability in Client: mysqldump (bsc#1034850) - CVE-2017-3453: Unspecified vulnerability in Server: Optimizer (bsc#1034850) - CVE-2017-3456: Unspecified vulnerability in Server: DML (bsc#1034850) - CVE-2017-3463: Unspecified vulnerability in Server: Security (bsc#1034850) - CVE-2017-3462: Unspecified vulnerability in Server: Security (bsc#1034850) - CVE-2017-3461: Unspecified vulnerability in Server: Security (bsc#1034850) - CVE-2017-3464: Unspecified vulnerability in Server: DDL (bsc#1034850) - CVE-2017-3305: MySQL client sent authentication request unencrypted even if SSL was required (aka Ridddle) (bsc#1029396). - CVE-2016-5483: Mysqldump failed to properly quote certain identifiers in SQL statements written to the dump output, allowing for execution of arbitrary commands (bsc#1029014) - '--ssl-mode=REQUIRED' can be specified to require a secure connection (it fails if a secure connection cannot be obtained) This non-security issue was fixed: - Set the default umask to 077 in rc.mysql-multi [bsc#1020976] For additional changes please see http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html Note: The issue tracked in bsc#1022428 and fixed in the last update was assigned CVE-2017-3302. Important SUSE bug 1020976 SUSE bug 1022428 SUSE bug 1029014 SUSE bug 1029396 SUSE bug 1034850 CVE-2016-5483 CVE-2017-3302 CVE-2017-3305 CVE-2017-3308 CVE-2017-3309 CVE-2017-3329 CVE-2017-3453 CVE-2017-3456 CVE-2017-3461 CVE-2017-3462 CVE-2017-3463 CVE-2017-3464 CVE-2017-3600 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql fixes the following issues: - CVE-2017-3635: C API unspecified vulnerability (bsc#1049398) - CVE-2017-3636: Client programs unspecified vulnerability (bsc#1049399) - CVE-2017-3641: DML unspecified vulnerability (bsc#1049404) - CVE-2017-3648: Charsets unspecified vulnerability (bsc#1049411) - CVE-2017-3651: Client mysqldump unspecified vulnerability (bsc#1049415) - CVE-2017-3652: DDL unspecified vulnerability (bsc#1049416) - CVE-2017-3653: DDL unspecified vulnerability (bsc#1049417) Moderate SUSE bug 1049398 SUSE bug 1049399 SUSE bug 1049404 SUSE bug 1049411 SUSE bug 1049415 SUSE bug 1049416 SUSE bug 1049417 SUSE bug 1049422 CVE-2017-3635 CVE-2017-3636 CVE-2017-3641 CVE-2017-3648 CVE-2017-3651 CVE-2017-3652 CVE-2017-3653 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql to version 5.5.58 fixes the following issues: Fixed security issues: - CVE-2017-10268: issue inside subcomponent Server Replication [bsc#1064101] - CVE-2017-10378: issue inside subcomponent Server Optimizer [bsc#1064115] - CVE-2017-10379: issue inside subcomponent Client programs [bsc#1064116] - CVE-2017-10384: issue inside subcomponent Server DDL [bsc#1064117] For a full list of changes check: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-58.html Important SUSE bug 1064101 SUSE bug 1064115 SUSE bug 1064116 SUSE bug 1064117 SUSE bug 1064119 CVE-2017-10268 CVE-2017-10378 CVE-2017-10379 CVE-2017-10384 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql to version 5.5.59 fixes several issues. These security issues were fixed: - CVE-2018-2622: Vulnerability in the subcomponent: Server: DDL. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369) - CVE-2018-2562: Vulnerability in the subcomponent: Server : Partition. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data (bsc#1076369) - CVE-2018-2640: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369) - CVE-2018-2665: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369) - CVE-2018-2668: Vulnerability in the subcomponent: Server: Optimizer. Easily exploitable vulnerability allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server (bsc#1076369) For additional changes please see http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-59.html Moderate SUSE bug 1076369 CVE-2018-2562 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following issues: - Update to 5.5.60 in Oracle Apr2018 CPU (bsc#1089987). - CVE-2018-2761: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2755: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). - CVE-2018-2781: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2819: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2818: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2817: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2771: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Locking). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). - CVE-2018-2813: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). - CVE-2018-2773: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Moderate SUSE bug 1089987 CVE-2018-2755 CVE-2018-2761 CVE-2018-2771 CVE-2018-2773 CVE-2018-2781 CVE-2018-2813 CVE-2018-2817 CVE-2018-2818 CVE-2018-2819 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for mysql to version 5.5.61 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-3066: Fixed a difficult to exploit vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data. (bsc#1101678) - CVE-2018-3070: Fixed an easily exploitable vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1101679) - CVE-2018-3081: Fixed a difficult to exploit vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. (bsc#1101680) - CVE-2018-3058: Fixed an easily exploitable vulnerability that allowed low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. (bsc#1101676) - CVE-2018-3063: Fixed an easily exploitable vulnerability allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (bsc#1101677) You can find more detailed information about this update in the [release notes](http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-61.html) Moderate SUSE bug 1101676 SUSE bug 1101677 SUSE bug 1101678 SUSE bug 1101679 SUSE bug 1101680 CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3070 CVE-2018-3081 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA MySQL server was updated to version 5.5.62, fixing bugs and security issues. Changes: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html Following security issues were fixed: - CVE-2016-9843: The crc32_big function in zlib might have allowed context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. (bsc#1013882) Please note that SUSE uses the system zlib, not the embedded copy. - CVE-2018-3133: Authenticated low privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112369) - CVE-2018-3174: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112368) - CVE-2018-3282: Authenticated high privilege attackers could cause denial of service attacks (hangs or crashes) against the mysql server (bsc#1112432) Important SUSE bug 1013882 SUSE bug 1112368 SUSE bug 1112369 SUSE bug 1112432 CVE-2016-9843 CVE-2018-3133 CVE-2018-3174 CVE-2018-3282 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The monitoring service Nagios has been updated to fix potential buffer overflows in its CGI scripts. (CVE-2014-1878) Security Issue reference: * CVE-2014-1878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1878> SUSE bug 864843 CVE-2014-1878 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for nagios fixes the following issues: - CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root (bsc#1011630 / bsc#1018047) Moderate SUSE bug 1011630 SUSE bug 1018047 CVE-2016-10089 CVE-2016-8641 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA nagios-nrpe has been updated to prevent possible remote command execution when command arguments are enabled. This issue affects versions 2.15 and older. Further information is available at http://seclists.org/fulldisclosure/2014/Apr/240 <http://seclists.org/fulldisclosure/2014/Apr/240> These security issues have been fixed: * Remote command execution (CVE-2014-2913) Security Issue references: * CVE-2014-2913 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2913> SUSE bug 874743 CVE-2014-2913 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for nagios-nrpe fixes one issue. This security issue was fixed: - CVE-2015-4000: Prevent Logjam. The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE (bsc#938906). Moderate SUSE bug 938906 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This security update fixes the following issues: * Removed the requirement for root access from plugins-root/check_icmp.c and plugins-root/check_icmp.c. The necessary capabilities(7) were added to the README file. * Fixed array out of bounds issue in plugins-root/check_dhcp.c. Security Issues: * CVE-2014-4701 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4701> * CVE-2014-4702 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4702> SUSE bug 885205 SUSE bug 885207 CVE-2014-4701 CVE-2014-4702 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for nautilus fixes the following security issue: - CVE-2017-14604: Fixed a file type spoofing attack by adding a metadata::trusted attribute to a file once the user acknowledges the file as trusted, and also remove the "trusted" content in the desktop file (bsc#1060031). Low SUSE bug 1060031 CVE-2017-14604 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-10684: Possible RCE via stack-based buffer overflow in the fmt_entry function. (bsc#1046858) - CVE-2017-10685: Possible RCE with format string vulnerability in the fmt_entry function. (bsc#1046853) Important SUSE bug 1046853 SUSE bug 1046858 CVE-2017-10684 CVE-2017-10685 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-11112: Illegal address access in append_acs. (bsc#1047964) - CVE-2017-11113: Dereferencing NULL pointer in _nc_parse_entry. (bsc#1047965) - CVE-2017-10684, CVE-2017-10685: Add modified upstream fix from ncurses 6.0 to avoid broken termcap format (bsc#1046853, bsc#1046858, bsc#1049344) Moderate SUSE bug 1046853 SUSE bug 1046858 SUSE bug 1047964 SUSE bug 1047965 SUSE bug 1049344 CVE-2017-10684 CVE-2017-10685 CVE-2017-11112 CVE-2017-11113 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136). - CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132). - CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131). - CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129). - CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128). - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). - CVE-2017-16879: Fix stack-based buffer overflow in the _nc_write_entry() function (bsc#1069530). Important SUSE bug 1056127 SUSE bug 1056128 SUSE bug 1056129 SUSE bug 1056131 SUSE bug 1056132 SUSE bug 1056136 SUSE bug 1069530 CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-16879 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ncurses fixes the following issues: Security issue fixed: - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). Moderate SUSE bug 1056127 CVE-2017-13733 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA net-snmp was updated to fix one security vulnerability and several bugs. - fix a vulnerability within the snmp_pdu_parse() function of snmp_api.c. (bnc#940188, CVE-2015-5621) - Add build requirement 'procps' to fix a net-snmp-config error. (bsc#935863) - add support for /dev/shm in snmp hostmib (bnc#853382, FATE#316893). - stop snmptrapd on package removal. Moderate SUSE bug 853382 SUSE bug 935863 SUSE bug 940188 CVE-2015-5621 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for netpbm fixes the following security issues: - CVE-2017-2581: An out-of-bounds write in writeRasterPbm() could lead to memory corruption and potential code execution. (bsc#1024287) Moderate SUSE bug 1024287 CVE-2017-2581 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for netpbm fixes the following issues: Security issues fixed: - CVE-2017-2579: Fixed out-of-bounds read in expandCodeOntoStack() (bsc#1024288). - CVE-2017-2580: Fixed out-of-bounds write of heap data in addPixelToRaster() function (bsc#1024291). - created a netpbm-vulnerable subpackage and move pstopnm there, as it uses ghostscript for conversion (bsc#1136936) Moderate SUSE bug 1024288 SUSE bug 1024291 SUSE bug 1136936 CVE-2017-2579 CVE-2017-2580 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for nmap fixes the following issues: Security issue fixed: - CVE-2018-15173: Fixed a remote denial of service attack via a crafted TCP-based service (bsc#1104139). Important SUSE bug 1104139 SUSE bug 1135350 CVE-2018-15173 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Mozilla NSPR and NSS were updated to fix various security bugs that could be used to crash the browser or potentially execute code. Mozilla NSPR 4.10.2 has the following bug fixes: * Bug 770534: Possible pointer overflow in PL_ArenaAllocate(). Fixed by Pascal Cuoq and Kamil Dudka. * Bug 888546: ptio.c:PR_ImportUDPSocket doesn't work. Fixed by Miloslav Trmac. * Bug 915522: VS2013 support for NSPR. Fixed by Makoto Kato. * Bug 927687: Avoid unsigned integer wrapping in PL_ArenaAllocate. (CVE-2013-5607) Mozilla NSS 3.15.3 is a patch release for NSS 3.15 and includes the following bug fixes: * Bug 925100: Ensure a size is <= half of the maximum PRUint32 value. (CVE-2013-1741) * Bug 934016: Handle invalid handshake packets. (CVE-2013-5605) * Bug 910438: Return the correct result in CERT_VerifyCert on failure, if a verifyLog isn't used. (CVE-2013-5606) Security Issue references: * CVE-2013-1741 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741> * CVE-2013-5605 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605> * CVE-2013-5606 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606> * CVE-2013-5607 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5607> SUSE bug 850148 CVE-2013-1741 CVE-2013-5605 CVE-2013-5606 CVE-2013-5607 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The NTP time service could have been used for remote denial of service amplification attacks. This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001: http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html <http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html> and on http://support.novell.com/security/cve/CVE-2013-5211.html <http://support.novell.com/security/cve/CVE-2013-5211.html> This update now also replaces the default ntp.conf template to fix this problem. Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described. Additionally the following bug has been fixed: * ntp start script does not update the /var/lib/ntp/etc/localtime file if /etc/localtime is a symlink (bnc#838458) Security Issues: * CVE-2013-5211 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211> SUSE bug 838458 SUSE bug 857195 CVE-2013-5211 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues: Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) Major functional changes: - The "sntp" commandline tool changed its option handling in a major way. - "controlkey 1" is added during update to ntp.conf to allow sntp to work. - The local clock is being disabled during update. - ntpd is no longer running chrooted. Other functional changes: - ntp-signd is installed. - "enable mode7" can be added to the configuration to allow ntdpc to work as compatibility mode option. - "kod" was removed from the default restrictions. - SHA1 keys are used by default instead of MD5 keys. These security issues were fixed: - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608). - CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608). - CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608). - CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608). - CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608). - CVE-2015-7850: remote config logfile-keyfile (bsc#951608). - CVE-2015-7849: trusted key use-after-free (bsc#951608). - CVE-2015-7848: mode 7 loop counter underrun (bsc#951608). - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608). - CVE-2015-7703: configuration directives "pidfile" and "driftfile" should only be allowed locally (bsc#951608). - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608). - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. - Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq. - bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution. - bsc#905885: Use SHA1 instead of MD5 for symmetric keys. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - Fix legacy action scripts to pass on command line arguments. - bsc#944300: Remove "kod" from the restrict line in ntp.conf. - bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd. - Don't let "keysdir" lines in ntp.conf trigger the "keys" parser. - Disable mode 7 (ntpdc) again, now that we don't use it anymore. - Add "addserver" as a new legacy action. - bsc#910063: Fix the comment regarding addserver in ntp.conf. - bsc#926510: Disable chroot by default. - bsc#920238: Enable ntpdc for backwards compatibility. - bsc#784760: Remove local clock from default configuration. - bsc#942441/fate#319496: Require perl-Socket6. - Improve runtime configuration: * Read keytype from ntp.conf * Don't write ntp keys to syslog. - bsc#920183: Allow -4 and -6 address qualifiers in "server" directives. - Use upstream ntp-wait, because our version is incompatible with the new ntpq command line syntax. Important SUSE bug 782060 SUSE bug 784760 SUSE bug 905885 SUSE bug 910063 SUSE bug 916617 SUSE bug 920183 SUSE bug 920238 SUSE bug 926510 SUSE bug 936327 SUSE bug 937837 SUSE bug 942441 SUSE bug 942587 SUSE bug 943216 SUSE bug 943218 SUSE bug 944300 SUSE bug 946386 SUSE bug 951351 SUSE bug 951559 SUSE bug 951608 SUSE bug 951629 SUSE bug 954982 SUSE bug 956773 SUSE bug 962318 SUSE bug 962784 SUSE bug 962802 SUSE bug 962960 SUSE bug 962966 SUSE bug 962970 SUSE bug 962988 SUSE bug 962994 SUSE bug 962995 SUSE bug 962997 SUSE bug 963000 SUSE bug 963002 SUSE bug 975496 SUSE bug 975981 CVE-2015-5194 CVE-2015-5219 CVE-2015-5300 CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ntp fixes the following issues: - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". - Update to 4.2.8p7 (bsc#977446): * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * integrate ntp-fork.patch * Improve the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). Important SUSE bug 957226 SUSE bug 977446 SUSE bug 977450 SUSE bug 977451 SUSE bug 977452 SUSE bug 977455 SUSE bug 977457 SUSE bug 977458 SUSE bug 977459 SUSE bug 977461 SUSE bug 977464 CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for libtasn1 fixes the following issues: - Malformed asn1 definitions could have caused a segmentation fault in the asn1 definition parser (bsc#961491) - CVE-2015-3622: Fixed invalid read in octet string decoding (bsc#929414) - CVE-2016-4008: Fixed infinite loop while parsing DER certificates (bsc#982779) Moderate SUSE bug 929414 SUSE bug 961491 SUSE bug 982779 CVE-2015-3622 CVE-2016-4008 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - Keep the parent process alive until the daemon has finished initialisation, to make sure that the PID file exists when the parent returns. - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). Important SUSE bug 979302 SUSE bug 981422 SUSE bug 982056 SUSE bug 982064 SUSE bug 982065 SUSE bug 982066 SUSE bug 982067 SUSE bug 982068 CVE-2016-4953 CVE-2016-4954 CVE-2016-4955 CVE-2016-4956 CVE-2016-4957 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: Null pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-8140: ntpq vulnerable to replay attacks. - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed: - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in "trap" (bsc#981252). - Reduce the number of netlink groups to listen on for changes to the local network setup (bsc#992606). - Fix segfault in "sntp -a" (bsc#1009434). - Silence an OpenSSL version warning (bsc#992038). - Make the resolver task change user and group IDs to the same values as the main task. (bsc#988028) - Simplify ntpd's search for its own executable to prevent AppArmor warnings (bsc#956365). Moderate SUSE bug 1009434 SUSE bug 1011377 SUSE bug 1011390 SUSE bug 1011395 SUSE bug 1011398 SUSE bug 1011404 SUSE bug 1011406 SUSE bug 1011411 SUSE bug 1011417 SUSE bug 943216 SUSE bug 956365 SUSE bug 981252 SUSE bug 988028 SUSE bug 992038 SUSE bug 992606 CVE-2015-5219 CVE-2015-8139 CVE-2015-8140 CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 SUSE Linux Enterprise Server 11 SP3-TERADATA This ntp update to version 4.2.8p10 fixes the following issues: Security issues fixed (bsc#1030050): - CVE-2017-6464: Denial of Service via Malformed Config - CVE-2017-6462: Buffer Overflow in DPTS Clock - CVE-2017-6463: Authenticated DoS via Malicious Config Option - CVE-2017-6458: Potential Overflows in ctl_put() functions - CVE-2017-6451: Improper use of snprintf() in mx4200_send() - CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist - CVE-2016-9042: 0rigin (zero origin) DoS. - ntpq_stripquotes() returns incorrect Value - ereallocarray()/eallocarray() underused - Copious amounts of Unused Code - Off-by-one in Oncore GPS Receiver - Makefile does not enforce Security Flags Bugfixes: - Remove spurious log messages (bsc#1014172). - Fixing ppc and ppc64 linker issue (bsc#1031085). - clang scan-build findings - Support for openssl-1.1.0 without compatibility modes - Bugfix 3072 breaks multicastclient - forking async worker: interrupted pipe I/O - (...) time_pps_create: Exec format error - Incorrect Logic for Peer Event Limiting - Change the process name of forked DNS worker - Trap Configuration Fail - Nothing happens if minsane < maxclock < minclock - allow -4/-6 on restrict line with mask - out-of-bound pointers in ctl_putsys and decode_bitflags - Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates. Moderate SUSE bug 1014172 SUSE bug 1030050 SUSE bug 1031085 CVE-2016-9042 CVE-2017-6451 CVE-2017-6458 CVE-2017-6460 CVE-2017-6462 CVE-2017-6463 CVE-2017-6464 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ntp fixes the following issues: - Update to 4.2.8p11 (bsc#1082210): * CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. * CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426) * CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424) * CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422) * CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420) * CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417) - Don't use libevent's cached time stamps in sntp. Moderate SUSE bug 1077445 SUSE bug 1082210 SUSE bug 1083417 SUSE bug 1083420 SUSE bug 1083422 SUSE bug 1083424 SUSE bug 1083426 CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA NTP was updated to 4.2.8p12 (bsc#1111853): - CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531) - CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424) Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information. Moderate SUSE bug 1083424 SUSE bug 1098531 SUSE bug 1111853 CVE-2018-12327 CVE-2018-7170 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ntp fixes the following issues: Security issue fixed: - CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd (bsc#1128525). Other issues addressed: - Make sure that SLE12 version is higher than the one in SLE11 (bsc#1001182). - Fixed several bugs in the BANCOMM reclock driver. - Fixed ntp_loopfilter.c snprintf compilation warnings. - Fixed spurious initgroups() error message. - Fixed STA_NANO struct timex units. - Fixed GPS week rollover in libparse. - Fixed incorrect poll interval in packet. - Added a missing check for ENABLE_CMAC. Moderate SUSE bug 1001182 SUSE bug 1128525 CVE-2019-8936 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA openldap2 was updated to fix one security issue. This security issue was fixed: - CVE-2015-4000: The Logjam Attack / weakdh.org (bsc#937766). This non-security issue was fixed: - bsc#932773: ldapmodify failed with DOS format LDIF files containing "-" separator. Moderate SUSE bug 924496 SUSE bug 932773 SUSE bug 937766 CVE-2015-4000 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA openldap2 was updated to fix three security issues and one non-security bug. The following vulnerabilities were fixed: * A remote attacker could cause a denial of service (slapd crash) by unbinding immediately after a search request. (bnc#846389, CVE-2013-4449) * A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897, CVE-2015-1545) * A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914, CVE-2015-1546) The following non-security bug was fixed: * Prevent connection-0 (internal connection) from showing up in the monitor back-end. (bnc#905959) Security Issues: * CVE-2015-1546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1546> * CVE-2015-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545> * CVE-2013-4449 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449> SUSE bug 846389 SUSE bug 905959 SUSE bug 916897 SUSE bug 916914 CVE-2013-4449 CVE-2015-1545 CVE-2015-1546 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue: - CVE-2015-6908. Passing a crafted packet to the function ber_get_next(), an attacker may cause a remote denial of service, crashing the OpenLDAP server (bsc#945582). Moderate SUSE bug 945582 CVE-2015-6908 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for opensc fixes the following issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card (bsc#1106998) - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card (bsc#1106999) - CVE-2018-16393: Fixed buffer overflows when handling responses from Gemsafe V1 Smartcards (bsc#1108318) - CVE-2018-16418: Fixed buffer overflow when handling string concatenation in util_acl_to_str (bsc#1107039) - CVE-2018-16419: Fixed several buffer overflows when handling responses from a Cryptoflex card (bsc#1107107) - CVE-2018-16422: Fixed single byte buffer overflow when handling responses from an esteid Card (bsc#1107038) - CVE-2018-16423: Fixed double free when handling responses from a smartcard (bsc#1107037) - CVE-2018-16427: Fixed out of bounds reads when handling responses in OpenSC (bsc#1107033) Moderate SUSE bug 1104812 SUSE bug 1106998 SUSE bug 1106999 SUSE bug 1107033 SUSE bug 1107037 SUSE bug 1107038 SUSE bug 1107039 SUSE bug 1107107 SUSE bug 1108318 CVE-2018-16391 CVE-2018-16392 CVE-2018-16393 CVE-2018-16418 CVE-2018-16419 CVE-2018-16422 CVE-2018-16423 CVE-2018-16427 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenSLP fixes a bug in SLPIntersectStringList that could lead to an out-of-bounds read (CVE-2012-4428). Additionally, the SLP daemon now always use localtime(3) when writing to log files to avoid having timestamps with different timezones. Security Issues: * CVE-2012-4428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4428> SUSE bug 778508 SUSE bug 855385 CVE-2012-4428 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openslp fixes the following issues: - CVE-2017-17833: Prevent heap-related memory corruption issue which may have manifested itself as a denial-of-service or a remote code-execution vulnerability (bsc#1090638). Important SUSE bug 1090638 CVE-2017-17833 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenSSH fixes the following issues: * Exit sshd normally when port is already in use. (bnc#832628) * Use hardware crypto engines where available. (bnc#826427) * Use correct options for login when it is used. (bnc#833605) * Move FIPS messages to higher debug level. (bnc#862875) * Fix forwarding with IPv6 addresses in DISPLAY. (bnc#847710) * Do not link OpenSSH binaries with LDAP libraries. (bnc#826906) * Parse AcceptEnv properly. (bnc#869101, CVE-2014-2532) * Check SSHFP DNS records even for server certificates. (bnc#870532, CVE-2014-2653) Security Issues references: * CVE-2014-2532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532> * CVE-2014-2653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2653> SUSE bug 826427 SUSE bug 833605 SUSE bug 847710 SUSE bug 869101 SUSE bug 870532 CVE-2014-2532 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA openssh was updated to fix several security issues and bugs. These security issues were fixed: * CVE-2015-5352: The x11_open_helper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window (bsc#936695). * CVE-2015-5600: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH did not properly restrict the processing of keyboard-interactive devices within a single connection, which made it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list (bsc#938746). * CVE-2015-4000: Removed and disabled weak DH groups to address LOGJAM (bsc#932483). * Hardening patch to fix sftp RCE (bsc#903649). * CVE-2015-6563: The monitor component in sshd in OpenSSH accepted extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allowed local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. * CVE-2015-6564: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH might have allowed local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. These non-security issues were fixed: - bsc#914309: sshd inherits oom_adj -17 on SIGHUP causing DoS potential for oom_killer. - bsc#673532: limits.conf fsize change in SLES10SP3 causing problems to WebSphere mqm user. - bsc#916549: Fixed support for aesXXX-gcm@openssh.com. Important SUSE bug 673532 SUSE bug 903649 SUSE bug 905118 SUSE bug 914309 SUSE bug 916549 SUSE bug 932483 SUSE bug 936695 SUSE bug 938746 SUSE bug 943006 SUSE bug 943010 SUSE bug 945493 CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for OpenSSH fixes the following issues: - Prevent user enumeration through the timing of password processing. (bsc#989363, CVE-2016-6210) - Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. (bsc#948902) - Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115) - Prevent X11 SECURITY circumvention when forwarding X11 connections. (bsc#962313, CVE-2016-1908) - Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902) - Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325) - Limit the accepted password length (prevents a possible denial of service). (bsc#992533, CVE-2016-6515) - Relax version requires for the openssh-askpass sub-package. (bsc#962794) - Avoid complaining about unset DISPLAY variable. (bsc#981654) - Initialize message id to prevent connection breakups in some cases. (bsc#959096) Moderate SUSE bug 932483 SUSE bug 948902 SUSE bug 959096 SUSE bug 962313 SUSE bug 962794 SUSE bug 970632 SUSE bug 975865 SUSE bug 981654 SUSE bug 989363 SUSE bug 992533 CVE-2015-8325 CVE-2016-1908 CVE-2016-3115 CVE-2016-6210 CVE-2016-6515 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh fixes the following issues: Security issues fixed: - CVE-2016-8858: prevent resource depletion during key exchange (bsc#1005480) - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation (bsc#1016366) - CVE-2016-10011: Prevent possible leaks of host private keys to low-privilege process handling authentication (bsc#1016369) Non security issues fixed: - Properly verify CIDR masks in the AllowUsers and DenyUsers configuration lists (bsc#1005893) Moderate SUSE bug 1005480 SUSE bug 1005893 SUSE bug 1016366 SUSE bug 1016369 CVE-2016-10009 CVE-2016-10011 CVE-2016-8858 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh fixes the following issues: Security issues fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability. (bsc#1106163) - CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files. (bsc#1065000, bsc#1106726) - CVE-2016-10708: sshd allowed remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. (bsc#1076957) - CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010) - CVE-2016-10012: Removed pre-auth compression support from the server to prevent possible cryptographic attacks. (bsc#1016370) Bugs fixed: - Fixed failing "AuthorizedKeysCommand" within a "Match User" block in sshd_config (bsc#1105180) Important SUSE bug 1016370 SUSE bug 1065000 SUSE bug 1076957 SUSE bug 1105010 SUSE bug 1105180 SUSE bug 1106163 SUSE bug 1106726 CVE-2016-10012 CVE-2016-10708 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh to version 6.6p1 fixes the following issues: Security issues fixed: - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) Important SUSE bug 1121571 CVE-2018-20685 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh fixes the following issues: Security vulnerabilities addressed: - CVE-2019-6109: Fixed an character encoding issue in the progress display of the scp client that could be used to manipulate client output, allowing for spoofing during file transfers (bsc#1121816). - CVE-2019-6111: Properly validate object names received by the scp client to prevent arbitrary file overwrites when interacting with a malicious SSH server (bsc#1121821). Other issues fixed: - Fixed two race conditions in sshd relating to SIGHUP (bsc#1119183). - Returned proper reason for port forwarding failures (bsc#1090671). - Fixed SSHD termination of multichannel sessions with non-root users (bsc#1115550). Moderate SUSE bug 1090671 SUSE bug 1115550 SUSE bug 1119183 SUSE bug 1121816 SUSE bug 1121821 SUSE bug 1131709 CVE-2019-6109 CVE-2019-6111 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. Critical SUSE bug 961642 SUSE bug 961645 CVE-2016-0777 CVE-2016-0778 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh-openssl1 fixes the following issues: Security issues fixed: - CVE-2016-6210: Prevent user enumeration through the timing of password processing (bsc#989363) - CVE-2016-6515: limit accepted password length (prevents possible DoS) (bsc#992533) - CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632) - CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313) - CVE-2015-8325: ignore PAM environment when using login (bsc#975865) - Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902) - Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902) Bugs fixed: - avoid complaining about unset DISPLAY variable (bsc#981654) - Correctly parse GSSAPI KEX algorithms (bsc#961368) - more verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414) - fix PRNG re-seeding (bsc#960414, bsc#729190) - Allow empty Match blocks (bsc#961494) Moderate SUSE bug 729190 SUSE bug 932483 SUSE bug 948902 SUSE bug 960414 SUSE bug 961368 SUSE bug 961494 SUSE bug 962313 SUSE bug 965576 SUSE bug 970632 SUSE bug 975865 SUSE bug 981654 SUSE bug 989363 SUSE bug 992533 CVE-2015-8325 CVE-2016-1908 CVE-2016-3115 CVE-2016-6210 CVE-2016-6515 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh-openssl1 fixes the following issues: - Properly verify CIDR masks in configuration (bsc#1005893) - CVE-2016-10009: limit directories for loading PKCS11 modules (bsc#1016366) - CVE-2016-10011: Prevent possible leaks of host private keys to low-privilege process handling authentication (bsc#1016369) - CVE-2016-8858: prevent resource depletion during key exchange (bsc#1005480) - fix suggested command for removing conflicting server keys from the known_hosts file (bsc#1006221) Moderate SUSE bug 1005480 SUSE bug 1005893 SUSE bug 1006221 SUSE bug 1016366 SUSE bug 1016369 CVE-2016-10009 CVE-2016-10011 CVE-2016-8858 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh-openssl1 fixes the following issues: These security issues were fixed: - CVE-2016-10708: Prevent NULL pointer dereference via an out-of-sequence NEWKEYS message allowed remote attackers to cause a denial of service (bsc#1076957). - CVE-2017-15906: The process_open function did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files (bsc#1065000). - CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) did not ensure that a bounds check is enforced by all compilers, which might have allowed local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures (bsc#1016370). - CVE-2008-1483: Prevent local users from hijacking forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port. This problem was reontroduced by another patch and was previously fixed by another update (bsc#1069509). These non-security issues were fixed: - Remove duplicate KEX method (bsc#1053972) - New switch for printing diagnostic messages in sftp client's batch mode (bsc#1023275) - Enable case-insensitive hostname matching (bsc#1017099) Important SUSE bug 1016370 SUSE bug 1017099 SUSE bug 1023275 SUSE bug 1053972 SUSE bug 1065000 SUSE bug 1069509 SUSE bug 1076957 CVE-2008-1483 CVE-2016-10012 CVE-2016-10708 CVE-2017-15906 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssh-openssl1 fixes the following issues: Security issues fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability. (bsc#1106163) - CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010) Following non-security issues were fixed: - Fix for sftp client because it returns wrong error code upon failure (bsc#1091396) - Stop leaking File descriptors (bsc#964336) Moderate SUSE bug 1091396 SUSE bug 1105010 SUSE bug 1106163 SUSE bug 964336 CVE-2018-15473 CVE-2018-15919 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: - CVE-2015-3195: When presented with a malformed X509_ATTRIBUTE structure OpenSSL would leak memory. This structure is used by the PKCS#7 and CMS routines so any application which reads PKCS#7 or CMS data from untrusted sources is affected. SSL/TLS is not affected. (bsc#957812) - Prevent segfault in s_client with invalid options (bsc#952099) Moderate SUSE bug 952099 SUSE bug 957812 CVE-2015-3195 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also fixes the following bug: - Avoid running OPENSSL_config twice. This avoids breaking engine loading and also fixes a memory leak in libssl. (bsc#952871 bsc#967787) Important SUSE bug 952871 SUSE bug 963415 SUSE bug 967787 SUSE bug 968046 SUSE bug 968047 SUSE bug 968048 SUSE bug 968051 SUSE bug 968053 SUSE bug 968374 CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0705 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) Bugs fixed: - fate#320304: build 32bit devel package - bsc#976943: Fix buffer overrun in ASN1_parse - bsc#973223: allow weak DH groups, vulnerable to the logjam attack, when environment variable OPENSSL_ALLOW_LOGJAM_ATTACK is set - bsc#889013: Rename README.SuSE to the new spelling Important SUSE bug 889013 SUSE bug 968050 SUSE bug 976942 SUSE bug 976943 SUSE bug 977614 SUSE bug 977615 SUSE bug 977617 CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behavior (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * Update expired S/MIME certs (bsc#979475) * Fix crash in print_notice (bsc#998190) * Resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Important SUSE bug 979475 SUSE bug 982575 SUSE bug 983249 SUSE bug 993819 SUSE bug 994749 SUSE bug 994844 SUSE bug 995075 SUSE bug 995324 SUSE bug 995359 SUSE bug 995377 SUSE bug 998190 SUSE bug 999665 SUSE bug 999666 SUSE bug 999668 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - don't attempt session resumption if no ticket is present and session ID length is zero (bsc#984663) Moderate SUSE bug 1000677 SUSE bug 1001912 SUSE bug 1004499 SUSE bug 1005878 SUSE bug 1019334 SUSE bug 1021641 SUSE bug 984663 CVE-2016-2108 CVE-2016-7056 CVE-2016-8610 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: - CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102) Important SUSE bug 1087102 CVE-2018-0739 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158). - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) Moderate SUSE bug 1097158 SUSE bug 1097624 SUSE bug 1098592 CVE-2018-0732 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following security issue: - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) Moderate SUSE bug 1089039 CVE-2018-0737 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). - Fixed the "One and Done" side-channel attack on RSA (bsc#1104789). Moderate SUSE bug 1104789 SUSE bug 1110018 SUSE bug 1113534 SUSE bug 1113652 CVE-2016-8610 CVE-2018-0734 CVE-2018-5407 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: Security issues fixed: - CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080) - Reject invalid EC point coordinates (bsc#1131291) - Mitigate the "The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations" attack (bsc#1117951) Moderate SUSE bug 1117951 SUSE bug 1127080 SUSE bug 1131291 CVE-2019-1559 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl fixes the following issues: OpenSSL Security Advisory [10 September 2019] - CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance (bsc#1150003). - CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250). Moderate SUSE bug 1150003 SUSE bug 1150250 CVE-2019-1547 CVE-2019-1563 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA openssl-certs has been updated to include four new and remove two certificates: * new: Atos_TrustedRoot_2011:2.8.92.51.203.98.44.95.179.50.crt * new: E-Tugra_Certification_Authority:2.8.106.104.62.156.81.155.203.83.crt * new: TeliaSonera_Root_CA_v1:2.17.0.149.190.22.160.247.46.70.241.123.57.130.114.250.139.205.150.crt * new: T-TeleSec_GlobalRoot_Class_2:2.1.1.crt * removed: Firmaprofesional_Root_CA:2.1.1.crt * removed: TDC_OCES_Root_CA:2.4.62.72.189.196.crt SUSE bug 875647 SUSE bug 881241 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) Bugs fixed: - bsc#971354: libopenssl1_0_0 now Recommends: openssl1 to get correct SSL Root Certificate hashes - bsc#889013: Rename README.SuSE to the new spelling README.SUSE - bsc#976943: Fixed a buffer overrun in ASN1_parse. - bsc#977621: Preserve negotiated digests for SNI (bsc#977621) Important SUSE bug 889013 SUSE bug 971354 SUSE bug 976942 SUSE bug 976943 SUSE bug 977614 SUSE bug 977615 SUSE bug 977616 SUSE bug 977617 SUSE bug 977621 CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: penSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed: * update expired S/MIME certs (bsc#979475) * improve s390x performance (bsc#982745) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) Important SUSE bug 979475 SUSE bug 982575 SUSE bug 982745 SUSE bug 983249 SUSE bug 990419 SUSE bug 993819 SUSE bug 994749 SUSE bug 994844 SUSE bug 995075 SUSE bug 995324 SUSE bug 995359 SUSE bug 995377 SUSE bug 998190 SUSE bug 999665 SUSE bug 999666 SUSE bug 999668 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - call c_rehash in %post (bsc#1001707) - ship static libraries in the devel package (bsc#1022644) Moderate SUSE bug 1000677 SUSE bug 1001707 SUSE bug 1001912 SUSE bug 1004499 SUSE bug 1005878 SUSE bug 1019334 SUSE bug 1021641 SUSE bug 1022085 SUSE bug 1022644 CVE-2016-2108 CVE-2016-7056 CVE-2016-8610 CVE-2017-3731 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825) - Missing important ciphers in openssl 1.0.1i-47.1 (bsc#990592) Bug fixes: - support alternate root ca chains (bsc#1032261) - Require openssl1, so c_rehash1 is available during %post to hash the certificates (bsc#1057660) Important SUSE bug 1027908 SUSE bug 1032261 SUSE bug 1055825 SUSE bug 1056058 SUSE bug 1057660 SUSE bug 1065363 SUSE bug 990592 CVE-2017-3735 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: - CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102) Important SUSE bug 1087102 CVE-2018-0739 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following security issues: - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039) - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158) - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) Moderate SUSE bug 1089039 SUSE bug 1097158 SUSE bug 1097624 SUSE bug 1098592 CVE-2018-0732 CVE-2018-0737 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). - Fixed the "One and Done" side-channel attack on RSA (bsc#1104789). Moderate SUSE bug 1104789 SUSE bug 1110018 SUSE bug 1113534 SUSE bug 1113652 CVE-2016-8610 CVE-2018-0734 CVE-2018-5407 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following security issues: - CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080) - Reject invalid EC point coordinates (bsc#1131291) - Fixed "The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations" (bsc#1117951) Moderate SUSE bug 1117951 SUSE bug 1127080 SUSE bug 1131291 CVE-2019-1559 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openssl1 fixes the following issues: OpenSSL Security Advisory [10 September 2019] * CVE-2019-1547: Added EC_GROUP_set_generator side channel attack avoidance. (bsc#1150003) * CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key (bsc#1150250) Moderate SUSE bug 1150003 SUSE bug 1150250 CVE-2019-1547 CVE-2019-1563 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA OpenVPN used a non-constant-time memcmp in HMAC comparison in openvpn_decrypt that might have allowed remote attackers to gain knowledge of plaintext data. (CVE-2013-2061) Security Issues: * CVE-2013-2061 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2061> SUSE bug 843509 CVE-2013-2061 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openvpn fixes the following issues: - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] Important SUSE bug 1044947 CVE-2017-7508 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openvpn fixes the following security issues: - CVE-2017-12166: OpenVPN was vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution. (bsc#1060877). - CVE-2016-6329: Now show which ciphers should no longer be used in openvpn --show-ciphers to avoid the SWEET32 attack (bsc#995374) - CVE-2017-7478: OpenVPN was vulnerable to unauthenticated Denial of Service of server via received large control packet. (bsc#1038709) - CVE-2017-7479: OpenVPN was vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker. (bsc#1038711) - Some other hardening fixes have also been applied (bsc#1038713) Important SUSE bug 1038709 SUSE bug 1038711 SUSE bug 1038713 SUSE bug 1060877 SUSE bug 995374 CVE-2016-6329 CVE-2017-12166 CVE-2017-7478 CVE-2017-7479 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openvpn-openssl1 fixes the following issues: - Some parts of the certificate-parsing code did not always clear all allocated memory. This would have allowed clients to leak a few bytes of memory for each connection attempt, thereby facilitating a (quite inefficient) DoS attack on the server. [bsc#1044947, CVE-2017-7521] - The ASN1 parsing code contained a bug that could have resulted in some buffers being free()d twice, and this issue could have potentially been triggered remotely by a VPN peer. [bsc#1044947, CVE-2017-7521] - If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker between client and proxy could cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory was likely to contain the proxy password. If the proxy password had not been reused, this was unlikely to compromise the security of the OpenVPN tunnel itself. Clients who did not use the --http-proxy option with ntlm2 authentication were not affected. [bsc#1044947, CVE-2017-7520] - It was possible to trigger an assertion by sending a malformed IPv6 packet. That issue could have been abused to remotely shutdown an openvpn server or client, if IPv6 and --mssfix were enabled and if the IPv6 networks used inside the VPN were known. [bsc#1044947, CVE-2017-7508] - The installed sample configuration file was updated to comply to FIPS requirements. [bsc#988522] - Remedy large latencies on the openVPN server during authentication process. [bsc#959511] - Fix potential denial-of-service attacks found during independent audits. [bsc#1038713, bsc#1038709, CVE-2017-7478, bsc#1038711, CVE-2017-7479] Important SUSE bug 1038709 SUSE bug 1038711 SUSE bug 1038713 SUSE bug 1044947 SUSE bug 959511 SUSE bug 988522 CVE-2017-7478 CVE-2017-7479 CVE-2017-7508 CVE-2017-7520 CVE-2017-7521 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openvpn-openssl1 fixes the following issues: Security issue fixed: - CVE-2017-12166: Fix remote buffer overflow (bsc#1060877). Important SUSE bug 1060877 CVE-2017-12166 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623). - CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623). Important SUSE bug 1122623 CVE-2019-3816 CVE-2019-3833 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This orca update fixes the following security issue. - Don't try to import modules from current working directory (bsc#916835, CVE-2013-4245). Moderate SUSE bug 916835 CVE-2013-4245 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update changes the broken default behavior of pam_pwhistory to not enforce checks when the root user requests password changes. In order to enforce pwhistory checks on the root user, the "enforce_for_root" parameter needs to be set for the pam_pwhistory.so module. This pam update fixes the following security and non-security issues: * bnc#870433: Fixed pam_timestamp path injection problem (CVE-2014-2583) * bnc#848417: Fixed pam_pwhistory root password enforcement when resetting non-root user's password Security Issue references: * CVE-2014-2583 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2583> SUSE bug 848417 SUSE bug 870433 CVE-2014-2583 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for pam fixes the following issues: Security issues fixed: - CVE-2015-3238: Fixed a denial of service and information leak which could be caused by very long passwords (bsc#934920). - CVE-2013-7041: Fixed a potential authentication bypass where password hashes weren't compared case-sensitively (bsc#854480). Moderate SUSE bug 854480 SUSE bug 934920 CVE-2013-7041 CVE-2015-3238 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for pam-modules fixes the following issue. This security issue was fixed: - CVE-2011-3172: Ensure that unix2_chkpwd calls pam_acct_mgmt to prevent usage of locked accounts (bsc#707645, bsc#839386). Moderate SUSE bug 707645 SUSE bug 839386 CVE-2011-3172 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for pam_pkcs11 fixes the following security issues: - It was possible to replay an authentication by using a specially prepared smartcard or token (bsc#1105012) - Prevent buffer overflow if a user has a home directory with a length of more than 512 bytes (bsc#1105012) - Memory not cleaned properly before free() (bsc#1105012) Moderate SUSE bug 1105012 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for patch fixes several issues. These security issues were fixed: - CVE-2018-1000156: patch: Malicious patch files cause ed to execute arbitrary commands (bsc#1088420). - CVE-2014-9637: Prevent DoS by remote attackers (memory consumption and segmentation fault) via a crafted diff file (bsc#914891). - CVE-2016-10713: Prevent out-of-bounds access within pch_write_line() that could have lead to DoS via a crafted input file (bsc#1080918). - CVE-2010-4651: Fixed a directory traversal bug (bsc#662957): Important SUSE bug 1059698 SUSE bug 1080918 SUSE bug 1088420 SUSE bug 662957 SUSE bug 914891 CVE-2010-4651 CVE-2014-9637 CVE-2016-10713 CVE-2018-1000156 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a memory leak and an infinite recursion in Data::Dumper. (CVE-2014-4330) Security Issues: * CVE-2014-4330 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4330> SUSE bug 838333 SUSE bug 896715 CVE-2014-4330 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl fixes the following issues: - CVE-2016-6185: xsloader looking at a "(eval)" directory [bsc#988311] - CVE-2016-1238: searching current directory for optional modules [bsc#987887] - CVE-2015-8853: regex engine hanging on bad utf8 [bnc976584] - CVE-2016-2381: environment dup handling bug [bsc#967082] - perl panic with utf8_mg_pos_cache_update [bsc#929027] Moderate SUSE bug 929027 SUSE bug 967082 SUSE bug 987887 SUSE bug 988311 CVE-2015-8853 CVE-2016-1238 CVE-2016-2381 CVE-2016-6185 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl fixes the following issues: Security issue fixed: - CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. (bnc#1047178) Bug fixes: - reformat baselibs.conf as source validator workaround Low SUSE bug 1047178 CVE-2017-6512 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl fixes the following issues: Security issue fixed: - CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216). - CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233). Moderate SUSE bug 1082216 SUSE bug 1082233 CVE-2018-6798 CVE-2018-6913 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl fixes the following issues: - CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718). Moderate SUSE bug 1096718 CVE-2018-12015 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl-Archive-Zip fixes the following security issue: - CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497). Moderate SUSE bug 1099497 CVE-2018-10860 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl-DBD-mysql fixes the following issues: - Add patch to fix CVE-2016-1251 (bsc#1012546) use-after-free for repeated fetchrow_arrayref calls when mysql_server_prepare=1 Moderate SUSE bug 1012546 CVE-2016-1251 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl-DBD-mysql fixes the following issues: - CVE-2016-1246: Buffer overflow allowed context-dependent attackers to cause a denial of service (crash) via vectors related to an error message (bsc#1002626). - CVE-2016-1249: Out-of-bounds read when using server-side prepared statement support (bsc#1010457). Moderate SUSE bug 1002626 SUSE bug 1010457 CVE-2016-1246 CVE-2016-1249 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl-DBD-mysql fixes the following issues: - CVE-2017-10789: The DBD::mysql module when with mysql_ssl=1 setting enabled, means that SSL is optional (even though this setting's documentation has a \"your communication with the server will be encrypted\" statement), which could lead man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152. (bsc#1047059) - CVE-2017-10788: The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. (bsc#1047095) Moderate SUSE bug 1047059 SUSE bug 1047095 CVE-2017-10788 CVE-2017-10789 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for perl-XML-LibXML fixes the following issues: - CVE-2017-10672: A use-after-free allowed remote attackers to potentially execute arbitrary code by controlling the arguments to a replaceChild call (bsc#1046848) Important SUSE bug 1046848 CVE-2017-10672 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA PHP was updated to fix two security issues. The following vulnerabilities were fixed: * CVE-2015-5589: PHP could be crashed when processing an invalid file with the "phar" extension with a segfault in Phar::convertToData, leading to Denial of Service (DOS) (bsc#938721) * CVE-2015-5590: PHP could be crashed or have unspecified other impact due to a buffer overlow in phar_fix_filepath (bsc#938719) Moderate SUSE bug 938719 SUSE bug 938721 CVE-2015-5589 CVE-2015-5590 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of PHP5 brings several security fixes. Security fixes: * CVE-2015-6831: A use after free vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#942291] [bnc#942294] [bnc#942295] * CVE-2015-6836: A SOAP serialize_function_call() type confusion leading to remote code execution problem was fixed. [bnc#945428] * CVE-2015-6837 CVE-2015-6838: Two NULL pointer dereferences in the XSLTProcessor class were fixed. [bnc#945412] It also includes a bugfix for the odbc module: * compare with SQL_NULL_DATA correctly [bnc#935074] Important SUSE bug 935074 SUSE bug 942291 SUSE bug 942294 SUSE bug 942295 SUSE bug 942296 SUSE bug 945412 SUSE bug 945428 CVE-2015-6831 CVE-2015-6833 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2015-7803: A Stack overflow vulnerability when decompressing tar phar archives could potentially lead to code execution. [bsc#949961] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] Note: we do not ship the phar extension currently, so we are not affected. - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] Important SUSE bug 949961 SUSE bug 968284 SUSE bug 969821 SUSE bug 971611 SUSE bug 971612 SUSE bug 971912 SUSE bug 973351 SUSE bug 973792 CVE-2014-9767 CVE-2015-7803 CVE-2015-8835 CVE-2015-8838 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following security issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) Moderate SUSE bug 976996 SUSE bug 976997 SUSE bug 977003 SUSE bug 977005 CVE-2015-8866 CVE-2015-8867 CVE-2016-4070 CVE-2016-4073 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: - CVE-2016-5093: A get_icu_value_internal out-of-bounds read could crash the php interpreter (bsc#982010) - CVE-2016-5094,CVE-2016-5095: Don't allow creating strings with lengths outside int range, avoids overflows (bsc#982011,bsc#982012) - CVE-2016-5096: A int/size_t confusion in fread could corrupt memory (bsc#982013) - CVE-2016-5114: A fpm_log.c memory leak and buffer overflow could leak information out of the php process or overwrite a buffer by 1 byte (bsc#982162) - CVE-2016-4346: A heap overflow was fixed in ext/standard/string.c (bsc#977994) - CVE-2016-4342: A heap corruption was fixed in tar/zip/phar parser (bsc#977991) - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative scale causing heap buffer overflow corrupting _one_ definition (bsc#978827) - CVE-2016-4539: Malformed input causes segmentation fault in xml_parse_into_struct() function (bsc#978828) - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read in zif_grapheme_stripos when given negative offset (bsc#978829) - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544: Out-of-bounds heap memory read in exif_read_data() caused by malformed input (bsc#978830) - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function (bsc#980366) - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c (bsc#980373) - CVE-2015-8874: Stack consumption vulnerability in GD (bsc#980375) - CVE-2015-8879: odbc_bindcols function in ext/odbc/php_odbc.c mishandles driver behavior for SQL_WVARCHAR (bsc#981050) Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS: - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792). - CVE-2015-8835: SoapClient s_call method suffered from a type confusion issue that could have lead to crashes [bsc#973351] - CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could lead to crashes. [bsc#968284] - CVE-2015-7803: A Stack overflow vulnerability when decompressing tar phar archives could potentially lead to code execution. [bsc#949961] - CVE-2016-3141: A use-after-free / double-free in the WDDX deserialization could lead to crashes or potential code execution. [bsc#969821] - CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead to crashes. [bsc#971912] - CVE-2014-9767: A directory traversal when extracting zip files was fixed that could lead to overwritten files. [bsc#971612] - CVE-2016-3185: A type confusion vulnerability in make_http_soap_request() could lead to crashes or potentially code execution. [bsc#971611] - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) Important SUSE bug 949961 SUSE bug 968284 SUSE bug 969821 SUSE bug 971611 SUSE bug 971612 SUSE bug 971912 SUSE bug 973351 SUSE bug 973792 SUSE bug 976996 SUSE bug 976997 SUSE bug 977003 SUSE bug 977005 SUSE bug 977991 SUSE bug 977994 SUSE bug 978827 SUSE bug 978828 SUSE bug 978829 SUSE bug 978830 SUSE bug 980366 SUSE bug 980373 SUSE bug 980375 SUSE bug 981050 SUSE bug 982010 SUSE bug 982011 SUSE bug 982012 SUSE bug 982013 SUSE bug 982162 CVE-2014-9767 CVE-2015-4116 CVE-2015-7803 CVE-2015-8835 CVE-2015-8838 CVE-2015-8866 CVE-2015-8867 CVE-2015-8873 CVE-2015-8874 CVE-2015-8879 CVE-2016-2554 CVE-2016-3141 CVE-2016-3142 CVE-2016-3185 CVE-2016-4070 CVE-2016-4073 CVE-2016-4342 CVE-2016-4346 CVE-2016-4537 CVE-2016-4538 CVE-2016-4539 CVE-2016-4540 CVE-2016-4541 CVE-2016-4542 CVE-2016-4543 CVE-2016-4544 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 CVE-2016-5114 SUSE Linux Enterprise Server 11 SP3-TERADATA php53 was updated to fix five security issues. These security issues were fixed: - CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows (bsc#986388). - CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004). - CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244). - CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386). - CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393). Important SUSE bug 986004 SUSE bug 986244 SUSE bug 986386 SUSE bug 986388 SUSE bug 986393 CVE-2015-8935 CVE-2016-5766 CVE-2016-5767 CVE-2016-5769 CVE-2016-5772 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: - security update: * CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530] * CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] * CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] * CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] * CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] * CVE-2016-5399: Improper error handling in bzread() [bsc#991430] * CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433] * CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] Moderate SUSE bug 987530 SUSE bug 991426 SUSE bug 991427 SUSE bug 991428 SUSE bug 991429 SUSE bug 991430 SUSE bug 991433 SUSE bug 991437 CVE-2014-3587 CVE-2016-5399 CVE-2016-6288 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6296 CVE-2016-6297 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following security issues: * CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization * CVE-2016-7125: PHP Session Data Injection Vulnerability * CVE-2016-7126: select_colors write out-of-bounds * CVE-2016-7127: imagegammacorrect allowed arbitrary write access * CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF * CVE-2016-7129: wddx_deserialize allows illegal memory access * CVE-2016-7130: wddx_deserialize null dereference * CVE-2016-7131: wddx_deserialize null dereference with invalid xml * CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element Important SUSE bug 997206 SUSE bug 997207 SUSE bug 997208 SUSE bug 997210 SUSE bug 997211 SUSE bug 997220 SUSE bug 997225 SUSE bug 997230 SUSE bug 997257 SUSE bug 999679 SUSE bug 999680 SUSE bug 999682 SUSE bug 999684 SUSE bug 999685 SUSE bug 999819 SUSE bug 999820 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) Moderate SUSE bug 1004924 SUSE bug 1005274 CVE-2016-6911 CVE-2016-8670 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: * CVE-2014-9912: Stack-based buffer overflow in uloc_getDisplayName() [bsc#1012232] * CVE-2016-9933: Possible stack overflow on truecolor images handling [bsc#1015187] * CVE-2016-9934: Dereference from NULL pointer could lead to crash [bsc#1015188] * CVE-2016-9935: Invalid read could lead to crash [bsc#1015189] * Buffer overflow in libmagic, allowing attackers to crash the PHP interpreter [bsc#974305] Moderate SUSE bug 1012232 SUSE bug 1015187 SUSE bug 1015188 SUSE bug 1015189 SUSE bug 974305 CVE-2014-9912 CVE-2016-9933 CVE-2016-9934 CVE-2016-9935 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following security issues: - CVE-2016-7478: When unserializing untrusted input data, PHP could end up in an infinite loop, causing denial of service (bsc#1019550) - CVE-2016-10158: The exif_convert_any_to_int function in ext/exif/exif.c in PHP allowed remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1. (bsc#1022219) - CVE-2016-10159: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive. (bsc#1022255) - CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch. (bsc#1022257) - CVE-2016-10161: The object_common1 function in ext/standard/var_unserializer.c in PHP allowed remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. (bsc#1022260) - CVE-2016-10166: A potential unsigned underflow in gd interpolation functions could lead to memory corruption in the PHP gd module (bsc#1022263) - CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx() could lead to php out of memory even on small files. (bsc#1022264) - CVE-2016-10168: A signed integer overflow in the gd module could lead to memory corruption (bsc#1022265) Important SUSE bug 1019550 SUSE bug 1022219 SUSE bug 1022255 SUSE bug 1022257 SUSE bug 1022260 SUSE bug 1022263 SUSE bug 1022264 SUSE bug 1022265 CVE-2016-10158 CVE-2016-10159 CVE-2016-10160 CVE-2016-10161 CVE-2016-10166 CVE-2016-10167 CVE-2016-10168 CVE-2016-7478 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: This security issue was fixed: - CVE-2017-7272: PHP enabled potential SSRF in applications that accept an fsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax was recognized, fsockopen used the port number that is specified in the hostname argument, instead of the port number in the second argument of the function (bsc#1031246) - CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111). - CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in mbstring in PHP. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. (bsc#1040883) - CVE-2017-9226: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in mbstring in PHP. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (bsc#1040889) - CVE-2017-9224: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in mbstring in PHP. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (bsc#1040891) Moderate SUSE bug 1031246 SUSE bug 1035111 SUSE bug 1040883 SUSE bug 1040889 SUSE bug 1040891 CVE-2016-6294 CVE-2017-7272 CVE-2017-9224 CVE-2017-9226 CVE-2017-9227 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: - The fix for CVE-2017-7272 was reverted, as it caused regressions in the mysql server connect module. [bsc#1044976] The security fix tried to avoid a server side request forgery, and will be submitted when a better fix becomes available. Important SUSE bug 1031246 SUSE bug 1044976 CVE-2017-7272 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the several issues. These security issues were fixed: - CVE-2017-12933: The finish_nested_data function in ext/standard/var_unserializer.re was prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue could have had an unspecified impact on the integrity of PHP (bsc#1054430). - CVE-2017-11628: Stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could have caused a denial of service or potentially allowed executing code (bsc#1050726). - CVE-2017-7890: The GIF decoding function gdImageCreateFromGifCtx in the GD Graphics Library did not zero colorMap arrays use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information (bsc#1050241). - CVE-2016-5766: Integer overflow in the _gd2GetHeader in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image (bsc#986386). - CVE-2017-11145: An error in the date extension's timelib_meridian parsing code could have been used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function (bsc#1048112). - CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could have lead to information leak [bsc#1048111] - CVE-2016-10397: Incorrect handling of various URI components in the URL parser could have been used by attackers to bypass hostname-specific URL checks (bsc#1047454). - CVE-2017-11147: The PHAR archive handler could have been used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function (bsc#1048094). - CVE-2017-11144: The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could have lead to a crash of the PHP interpreter (bsc#1048096). Moderate SUSE bug 1047454 SUSE bug 1048094 SUSE bug 1048096 SUSE bug 1048111 SUSE bug 1048112 SUSE bug 1050241 SUSE bug 1050726 SUSE bug 1054430 SUSE bug 986386 CVE-2016-10168 CVE-2016-10397 CVE-2016-5766 CVE-2017-11144 CVE-2017-11145 CVE-2017-11146 CVE-2017-11147 CVE-2017-11628 CVE-2017-12933 CVE-2017-7890 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2017-16642: Fix timelib_meridian error that could be used to leak information from the interpreter (bsc#1067441). - CVE-2017-9228: Fix heap out-of-bounds write that occurs in bitset_set_range() during regex compilation (bsc#1069606). - CVE-2017-9229: Fix invalid pointer dereference in left_adjust_char_head() (bsc#1069631). Moderate SUSE bug 1067441 SUSE bug 1069606 SUSE bug 1069631 CVE-2017-16642 CVE-2017-9228 CVE-2017-9229 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes several issues. These security issues were fixed: - CVE-2016-10712: In PHP all of the return values of stream_get_meta_data could be controlled if the input can be controlled (e.g., during file uploads). (bsc#1080234) - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220) - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) - CVE-2016-5773: php_zip.c in the zip extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object. (bsc#986247) - CVE-2016-5771: spl_array.c in the SPL extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data. (bsc#986391) - CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex. (bsc#1083639) Important SUSE bug 1076220 SUSE bug 1076391 SUSE bug 1080234 SUSE bug 1083639 SUSE bug 986247 SUSE bug 986391 CVE-2016-10712 CVE-2016-5771 CVE-2016-5773 CVE-2018-5711 CVE-2018-5712 CVE-2018-7584 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367). - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362). - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363). - CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355). Important SUSE bug 1091355 SUSE bug 1091362 SUSE bug 1091363 SUSE bug 1091367 CVE-2018-10545 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: The following security issue was fixed: - An out-of-bounds read in the do_core_note function in readelf.c in libmagic.a allowed remote attackers to cause a denial of service via a crafted ELF file (CVE-2018-10360, bsc#1096984) - CVE-2018-12882: exif_read_from_impl allowed attackers to trigger a use-after-free (in exif_read_from_file) because it closed a stream that it is not responsible for closing (bsc#1099098) Moderate SUSE bug 1096984 SUSE bug 1099098 CVE-2018-10360 CVE-2018-12882 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: The following security issues were fixed: - CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659) - CVE-2018-14883: Fixed an integer overflow leading to a heap based buffer over-read in exif_thumbnail_extract of exif.c. (bsc#1103836) - CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466) Moderate SUSE bug 1103659 SUSE bug 1103836 SUSE bug 1105466 CVE-2017-9118 CVE-2018-14851 CVE-2018-14883 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issue: - CVE-2018-17082: The Apache2 component in PHP allowed XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade was mishandled in the php_handler function (bsc#1108753) Moderate SUSE bug 1108753 CVE-2018-17082 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issue fixed: - CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107). Moderate SUSE bug 1117107 CVE-2018-19518 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). Moderate SUSE bug 1123354 SUSE bug 1123522 CVE-2019-6977 CVE-2019-6978 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892). - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886). - CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889). - CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887). - CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883). - CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821). - CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711). - CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122). - CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713). - CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823). - CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722). Moderate SUSE bug 1126711 SUSE bug 1126713 SUSE bug 1126821 SUSE bug 1126823 SUSE bug 1127122 SUSE bug 1128722 SUSE bug 1128883 SUSE bug 1128886 SUSE bug 1128887 SUSE bug 1128889 SUSE bug 1128892 CVE-2018-20783 CVE-2019-9020 CVE-2019-9021 CVE-2019-9023 CVE-2019-9024 CVE-2019-9637 CVE-2019-9638 CVE-2019-9639 CVE-2019-9640 CVE-2019-9641 CVE-2019-9675 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838). - CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837). - CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322). Moderate SUSE bug 1132837 SUSE bug 1132838 SUSE bug 1134322 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173). - CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172). Moderate SUSE bug 1138172 SUSE bug 1138173 CVE-2019-11039 CVE-2019-11040 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140118). - CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360). - CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095). Important SUSE bug 1140118 SUSE bug 1145095 SUSE bug 1146360 CVE-2019-11038 CVE-2019-11041 CVE-2019-11042 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for policycoreutils fixes the following issues: * CVE-2016-7545: nonpriv session can escape to parent [bsc#1000998] Low SUSE bug 1000998 CVE-2016-7545 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for policycoreutils fixes the following issues: - CVE-2018-1063: Prevent chcon from following symlinks in /tmp, /var/tmp, /var/run and /var/lib/debug (bsc#1083624). Moderate SUSE bug 1083624 CVE-2018-1063 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for poppler fixes the following issues: Security issues fixed: - CVE-2015-8868: Corrupted PDF file can corrupt heap, causing DoS (bsc#976844) Moderate SUSE bug 976844 CVE-2015-8868 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for poppler fixes the following issues: - CVE-2017-14977: Fixed a NULL pointer dereference vulnerability in the FoFiTrueType::getCFFBlock() function in FoFiTrueType.cc that occurred due to lack of validation of a table pointer, which allows an attacker to launch a denial of service attack. (bsc#1061265) - CVE-2017-1000456: Validate boundaries in TextPool::addWord to prevent overflows in subsequent calculations (bsc#1074453) - CVE-2017-15565: Prevent NULL Pointer dereference in the GfxImageColorMap::getGrayLine() function via a crafted PDF document (bsc#1064593) Moderate SUSE bug 1061265 SUSE bug 1064593 SUSE bug 1074453 CVE-2017-1000456 CVE-2017-14977 CVE-2017-15565 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This rpm update fixes the following security and non security issues. * bnc#908128: check for bad invalid name sizes (CVE-2014-8118) * bnc#906803: create files with mode 0 (CVE-2013-6435) * bnc#892431: honor --noglob in install mode Security Issues: * CVE-2014-8118 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8118> * CVE-2013-6435 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435> SUSE bug 892431 SUSE bug 906803 SUSE bug 908128 CVE-2013-6435 CVE-2014-8118 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of postgresql94 to 9.4.5 fixes the following issues: * CVE-2015-5289: json or jsonb input values constructed from arbitrary user input could have crashed the PostgreSQL server and caused a denial of service (bsc#949670) * CVE-2015-5288: crypt() (pgCrypto extension) couldi potentially be exploited to read a few additional bytes of memory (bsc#949669) Also contains all changes and bugfixes in the upstream 9.4.5 release: http://www.postgresql.org/docs/current/static/release-9-4-5.html Moderate SUSE bug 949669 SUSE bug 949670 CVE-2015-5288 CVE-2015-5289 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql-init fixes the following issues: - CVE-2017-14798: A race condition in the init script could be used by attackers able to access the postgresql account to escalate their privileges to root (bsc#1062722) Moderate SUSE bug 1062722 CVE-2017-14798 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql10 brings version 10.6 to SUSE Linux Enterprise 11. This release marks the change of the versioning scheme for PostgreSQL to a "x.y" format. This means the next minor releases of PostgreSQL will be 10.1, 10.2, ... and the next major release will be 11. * Logical Replication Logical replication extends the current replication features of PostgreSQL with the ability to send modifications on a per-database and per-table level to different PostgreSQL databases. Users can now fine-tune the data replicated to various database clusters and will have the ability to perform zero-downtime upgrades to future major PostgreSQL versions. * Declarative Table Partitioning Table partitioning has existed for years in PostgreSQL but required a user to maintain a nontrivial set of rules and triggers for the partitioning to work. PostgreSQL 10 introduces a table partitioning syntax that lets users easily create and maintain range and list partitioned tables. * Improved Query Parallelism PostgreSQL 10 provides better support for parallelized queries by allowing more parts of the query execution process to be parallelized. Improvements include additional types of data scans that are parallelized as well as optimizations when the data is recombined, such as pre-sorting. These enhancements allow results to be returned more quickly. * Quorum Commit for Synchronous Replication PostgreSQL 10 introduces quorum commit for synchronous replication, which allows for flexibility in how a primary database receives acknowledgement that changes were successfully written to remote replicas. Moderate SUSE bug 1108308 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689). Bug fixes: - For a complete list of fixes check the release notes. * https://www.postgresql.org/docs/10/release-10-8.html * https://www.postgresql.org/docs/10/release-10-7.html Moderate SUSE bug 1134689 CVE-2019-10130 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql10 to version 10.9 fixes the following issues: Security issue fixed: - CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034). More information at https://www.postgresql.org/docs/10/release-10-9.html Important SUSE bug 1138034 CVE-2019-10164 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner (bsc#1145092). Important SUSE bug 1145092 CVE-2019-10208 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The PostgreSQL database server was updated to 9.1.15, fixing bugs and security issues: * Fix buffer overruns in to_char() (CVE-2015-0241). * Fix buffer overrun in replacement *printf() functions (CVE-2015-0242). * Fix buffer overruns in contrib/pgcrypto (CVE-2015-0243). * Fix possible loss of frontend/backend protocol synchronization after an error (CVE-2015-0244). * Fix information leak via constraint-violation error messages (CVE-2014-8161). For a comprehensive list of fixes, please refer to the following release notes: * http://www.postgresql.org/docs/9.1/static/release-9-1-15.html <http://www.postgresql.org/docs/9.1/static/release-9-1-15.html> * http://www.postgresql.org/docs/9.1/static/release-9-1-14.html <http://www.postgresql.org/docs/9.1/static/release-9-1-14.html> * http://www.postgresql.org/docs/9.1/static/release-9-1-13.html <http://www.postgresql.org/docs/9.1/static/release-9-1-13.html> Security Issues: * CVE-2015-0241 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0241> * CVE-2015-0243 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0243> * CVE-2015-0244 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0244> * CVE-2014-8161 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8161> SUSE bug 916953 CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed: * CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) * CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) * CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to http://www.postgresql.org/docs/9.1/static/release-9-1-18.html <http://www.postgresql.org/docs/9.1/static/release-9-1-18.html> . This update also includes changes in PostgreSQL's packaging to prepare for the migration to the new major version 9.4. (FATE#316970, bsc#907651) Security Issues: * CVE-2015-3165 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3165> * CVE-2015-3166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3166> * CVE-2015-3167 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3167> SUSE bug 907651 SUSE bug 931972 SUSE bug 931973 SUSE bug 931974 SUSE bug 932040 CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of postgresql91 to 9.1.19 fixes the following issues: * CVE-2015-5288: crypt() (pgCrypto extension) couldi potentially be exploited to read a few additional bytes of memory (bsc#949669) Also contains all changes and bugfixes in the upstream 9.1.19 release: http://www.postgresql.org/docs/9.1/static/release-9-1-19.html Moderate SUSE bug 949669 CVE-2015-5288 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: - Security and bugfix release 9.4.6: * *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries. * Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). * Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). * Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). * Fix many issues in pg_dump with specific object types * Prevent over-eager pushdown of HAVING clauses for GROUPING SETS * Fix deparsing error with ON CONFLICT ... WHERE clauses * Fix tableoid errors for postgres_fdw * Prevent floating-point exceptions in pgbench * Make \det search Foreign Table names consistently * Fix quoting of domain constraint names in pg_dump * Prevent putting expanded objects into Const nodes * Allow compile of PL/Java on Windows * Fix "unresolved symbol" errors in PL/Python execution * Allow Python2 and Python3 to be used in the same database * Add support for Python 3.5 in PL/Python * Fix issue with subdirectory creation during initdb * Make pg_ctl report status correctly on Windows * Suppress confusing error when using pg_receivexlog with older servers * Multiple documentation corrections and additions * Fix erroneous hash calculations in gin_extract_jsonb_path() - For the full release notse, see: http://www.postgresql.org/docs/9.4/static/release-9-4-6.html - Security and bugfix release 9.4.5: * CVE-2015-5289, bsc#949670: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. * CVE-2015-5288, bsc#949669: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed. - For the full release notse, see: http://www.postgresql.org/docs/current/static/release-9-4-5.html - Relax dependency on libpq to major version. Important SUSE bug 949669 SUSE bug 949670 SUSE bug 966435 SUSE bug 966436 CVE-2007-4772 CVE-2015-5288 CVE-2015-5289 CVE-2016-0766 CVE-2016-0773 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed: - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). For the non-security issues please refer to - http://www.postgresql.org/docs/9.4/static/release-9-4-9.html - http://www.postgresql.org/docs/9.4/static/release-9-4-8.html - http://www.postgresql.org/docs/9.4/static/release-9-4-7.html Important SUSE bug 993453 SUSE bug 993454 CVE-2016-5423 CVE-2016-5424 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql93 fixes the following issues: - bsc#1029547: Fix tests with timezone 2017a - CVE-2017-7486: Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1037624) - CVE-2017-7485: Recognize PGREQUIRESSL variable again. (bsc#1038293) - CVE-2017-7484: Prevent exposure of statistical information via leaky operators. (bsc#1037603) Moderate SUSE bug 1029547 SUSE bug 1037603 SUSE bug 1037624 SUSE bug 1038293 CVE-2017-7484 CVE-2017-7485 CVE-2017-7486 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA Postgresql94 was updated to 9.4.13 to fix the following issues: * CVE-2017-7547: Further restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options. (bsc#1051685) * CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. (bsc#1051684) * CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259) The changelog for this release is here: https://www.postgresql.org/docs/9.4/static/release-9-4-13.html Important SUSE bug 1051684 SUSE bug 1051685 SUSE bug 1053259 CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: Security issues fixed: - CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844). - CVE-2017-12172: Start scripts permit database administrator to modify root-owned files. This issue did not affect SUSE (bsc#1062538). Bug fixes: - Update to version 9.4.15 * https://www.postgresql.org/docs/9.4/static/release-9-4-15.html * https://www.postgresql.org/docs/9.4/static/release-9-4-14.html Moderate SUSE bug 1062538 SUSE bug 1067844 CVE-2017-12172 CVE-2017-15098 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.16, full release notes: https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Security issues fixed: - CVE-2018-1053: Ensure that all temporary files made by pg_upgrade are non-world-readable. (bsc#1077983) Moderate SUSE bug 1077983 CVE-2018-1053 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: Security issues fixed: - CVE-2018-1058: Fixed uncontrolled search path element in pg_dump and other client applications (bsc#1081925). Bug fixes: - See release notes for details: * https://www.postgresql.org/docs/9.4/static/release-9-4-17.html * https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Moderate SUSE bug 1081925 CVE-2018-1058 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: postgresql was updated to 9.4.19: https://www.postgresql.org/docs/current/static/release-9-4-19.html * CVE-2018-10915, bsc#1104199: Fix failure to reset libpq's state fully between connection attempts. postgresql was updated to 9.4.18: - https://www.postgresql.org/about/news/1851/ - https://www.postgresql.org/docs/current/static/release-9-4-18.html A dump/restore is not required for those running 9.4.X. However, if the function marking mistakes mentioned in the first changelog entry below affect you, you will want to take steps to correct your database catalogs. Important SUSE bug 1104199 CVE-2018-10915 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for postgresql94 fixes the following issues: Security issue fixed: - CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner (bsc#1145092). Important SUSE bug 1145092 CVE-2019-10208 SUSE Linux Enterprise Server 11 SP3 The "snap" system information collection tool of the PowerPC Utils package collected fstab and yaboot.conf files which might contain passwords. (CVE-2014-4040) As these files are of interest, we now print a warning that the user of the "snap" tool should check if private passwords are in those files. Security Issues: * CVE-2014-4040 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4040> SUSE bug 883174 CVE-2014-4040 SUSE Linux Enterprise Server 11 SP3 ppc64-diag has been updated to prevent the usage of predictable filenames in /tmp in various scripts and daemons (CVE-2014-4038) Also the snapshot tarball was previously generated world readable, which could have leaked sensible information, which is only visible to root, to all users. It is now readable for root only (CVE-2014-4039). Security Issues: * CVE-2014-4038 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4038> * CVE-2014-4039 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4039> SUSE bug 882667 CVE-2014-4038 CVE-2014-4039 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This ppp update fixes a potential security issue that an unprivileged attacker could access privileged options: * integer overflow in option parsing (CVE-2014-3158, bnc#891489) Security Issues: * CVE-2014-3158 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3158> SUSE bug 891489 CVE-2014-3158 SUSE Linux Enterprise Server 11 SP3-TERADATA The ppp package was updated to fix the following security issue: - CVE-2015-3310: Fixed a buffer overflow in radius plug-in's rc_mksid() (bsc#927841). Moderate SUSE bug 927841 CVE-2015-3310 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA procmail was updated to fix a security issue in its formail helper. * When formail processed specially crafted e-mail headers a heap corruption could be triggered, which would lead to a crash of formail. (CVE-2014-3618) Security Issues: * CVE-2014-3618 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3618> SUSE bug 894999 CVE-2014-3618 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for procmail fixes the following issues: Security issue fixed: - CVE-2017-16844: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. (bnc#1068648) Moderate SUSE bug 1068648 CVE-2017-16844 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for procps fixes the following security issues: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). Moderate SUSE bug 1092100 CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Puppet was updated to fix the following security issues: * Unsafe use of temporary files. (CVE-2013-4969) * Arbitrary code execution with required social engineering. (CVE-2014-3248, CVE-2014-3250) Security Issues references: * CVE-2014-3248 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248> * CVE-2013-4969 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969> * CVE-2014-3250 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250> SUSE bug 856843 SUSE bug 879913 CVE-2013-4969 CVE-2014-3248 CVE-2014-3250 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for puppet fixes the following issues: - CVE-2017-2295: Fixed a security vulnerability where an attacker could force YAML deserialization in an unsafe manner, which would lead to remote code execution. In default, this update would break a backwards compatibility with Puppet agents older than 3.2.2 as the SLE11 master doesn't support other fact formats than pson in default anymore. In order to allow users to continue using their SLE11 agents a patch was added that enables sending PSON from agents. For non-SUSE clients older that 3.2.2 a new puppet master boolean option "dangerous_fact_formats" was added. When it's set to true it enables using dangerous fact formats (e.g. YAML). When it's set to false, only PSON fact format is accepted. (bsc#1040151), (bsc#1077767) Moderate SUSE bug 1040151 SUSE bug 1077767 CVE-2017-2295 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA pure-ftpd was updated to fix one security issue and two non-security bugs: * SSLv2 and SSLv3 have been disabled to avoid the attack named POODLE (CVE-2014-3566, bnc#902229). * Added the disable_ascii option (bnc#828469). * Fixed wait on TLS handshake (bnc#856424). Security Issues: * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> SUSE bug 828469 SUSE bug 856424 SUSE bug 902229 CVE-2014-3566 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issues: - CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751) - CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348) - CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523) Moderate SUSE bug 984751 SUSE bug 985348 SUSE bug 989523 CVE-2016-0772 CVE-2016-1000110 CVE-2016-5699 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issues: - CVE-2017-1000158: Fixed integer overflow in thePyString_DecodeEscape function (bsc#1068664). Moderate SUSE bug 1068664 CVE-2017-1000158 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issues: The following security vulnerabilities were addressed: - Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. [bsc#1083507, CVE-2017-18207] Moderate SUSE bug 1083507 CVE-2017-18207 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python-base fixes the following issues: Security issues fixed: - CVE-2018-1061: Fixed DoS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (bsc#1088004). - CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in apop() method in pop3lib (bsc#1088009). - CVE-2016-5636: Fixed heap overflow in zipimporter module (bsc#985177) Bug fixes: - bsc#1086001: python tarfile uses random order. Important SUSE bug 1086001 SUSE bug 1088004 SUSE bug 1088009 SUSE bug 985177 CVE-2016-5636 CVE-2018-1060 CVE-2018-1061 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issue: - CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM (bsc#1109847) Moderate SUSE bug 1109847 CVE-2018-14647 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issues: Security issues fixed: - CVE-2019-9948: Fixed a 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead (bsc#1130847). - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). Important SUSE bug 1129346 SUSE bug 1130847 CVE-2019-9636 CVE-2019-9948 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python fixes the following issues: - CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459). - CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation (bsc#1141853). Important SUSE bug 1138459 SUSE bug 1141853 CVE-2018-20852 CVE-2019-10160 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This python update fixes a certificate hostname issue. * bnc#834601: CVE-2013-4238: python: SSL module does not handle certificates that contain hostnames with NULL bytes Security Issue reference: * CVE-2013-4238 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238> SUSE bug 834601 CVE-2013-4238 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Python was updated to fix one security issue: * Potential wraparound/overflow in buffer() (CVE-2014-7185) As an additional hardening measure SSLv2 has been disabled (bnc#901715). Security Issues: * CVE-2014-7185 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7185> SUSE bug 898572 SUSE bug 901715 CVE-2014-7185 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for Python fixes the following security issues: * bnc#834601: SSL module does not handle certificates that contain hostnames with NULL bytes. (CVE-2013-4238) * bnc#856836: Various stdlib read flaws. (CVE-2013-1752) Additionally, the following non-security issues have been fixed: * bnc#859068: Turn off OpenSSL's aggressive optimizations that conflict with Python's GC. * bnc#847135: Setting fips=1 at boot time causes problems with Python due to MD5 usage. Security Issue references: * CVE-2013-4073 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4073> * CVE-2013-4238 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238> SUSE bug 834601 SUSE bug 847135 SUSE bug 856836 SUSE bug 859068 CVE-2013-4073 CVE-2013-4238 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Python was updated to fix a security issue in the socket.recvfrom_into function, where data could be written over the end of the buffer. (CVE-2014-1912) Security Issue reference: * CVE-2014-1912 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1912> SUSE bug 863741 CVE-2014-1912 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for Python provides fixes for the following issues: * CGIHTTPServer file disclosure and directory traversal through URL-encoded characters. (CVE-2014-4650) * The 'urlparse' module has been updated to correctly parse IPv6 addresses. (bnc#872848) * Correctly enable IPv6 support. Security Issues: * CVE-2014-4650 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650> SUSE bug 872848 SUSE bug 885882 CVE-2014-4650 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This python-imaging update fixes the following two security issues: * bnc#863541: Fixed insecure temporary file creation and handling (CVE-2014-1932, CVE-2014-1933) Security Issue references: * CVE-2014-1932 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932> * CVE-2014-1933 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933> SUSE bug 863541 CVE-2014-1932 CVE-2014-1933 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This security update for python-lxml fixes a input sanitization flaw in clean_html. (CVE-2014-3146) Security Issues: * CVE-2014-3146 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3146> SUSE bug 877258 CVE-2014-3146 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python-numpy fixes the following issues: Security issue fixed: - CVE-2019-6446: Set allow_pickle to false by default to restrict loading untrusted content (bsc#1122208). With this update we decrease the possibility of allowing remote attackers to execute arbitrary code by misusing numpy.load(). A warning during runtime will show-up when the allow_pickle is not explicitly set. NOTE: By applying this update the behavior of python-numpy changes, which might break your application. In order to get the old behaviour back, you have to explicitly set `allow_pickle` to True. Be aware that this should only be done for trusted input, as loading untrusted input might lead to arbitrary code execution. Important SUSE bug 1122208 CVE-2019-6446 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python-paramiko fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authentication step (bsc#1085276) Important SUSE bug 1085276 CVE-2018-7750 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python-pycrypto fixes the following issues: - CVE-2013-7459: Fixed a potential heap buffer overflow in ALGnew (bsc#1017420). Important SUSE bug 1017420 CVE-2013-7459 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a TOCTOU vulnerability during certificate validation. CVE-2013-6418 has been assigned to this issue. This update also introduces a new dependency on python-m2crypto. Security Issue reference: * CVE-2013-6418 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6418> SUSE bug 856108 SUSE bug 856323 CVE-2013-6418 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python27 fixes the following issues: Security issues fixed: - CVE-2017-1000158: Fixed integer overflows in PyString_DecodeEscape that could have resulted in heap-based buffer overflow attacks and possible arbitrary code execution (bsc#1068664). - CVE-2018-1000030: Fixed crash inside the Python interpreter when multiple threads used the same I/O stream concurrently (bsc#1079300). Moderate SUSE bug 1068664 SUSE bug 1079300 CVE-2017-1000158 CVE-2018-1000030 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python27 fixes the following issues: The following security vulnerabilities were addressed: - Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. [bsc#1083507, CVE-2017-18207] Moderate SUSE bug 1083507 CVE-2017-18207 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python27 fixes the following issue: - CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663) - CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM (bsc#1109847). Moderate SUSE bug 1109663 SUSE bug 1109847 CVE-2018-1000802 CVE-2018-14647 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python27 fixes the following issues: Security issue fixed: - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Moderate SUSE bug 1122191 CVE-2019-5010 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for python27 fixes the following issues: Security issues fixed: - CVE-2019-9948: Fixed a 'file:' blacklist bypass in URIs by using the 'local-file:' scheme instead (bsc#1130847). - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization (bsc#1129346). Important SUSE bug 1129346 SUSE bug 1130847 CVE-2019-9636 CVE-2019-9948 SUSE Linux Enterprise Server 11 SP3-TERADATA This update provides various modules for Python 2.7. It also updates python 2.7 to the 2.7.16 release, fixing security issues and bugs. The following packages are included in the update: - cloud-init - growpart - python27-argparse - python27-blinker - python27-boto3 - python27-botocore - python27-cffi - python27-Cheetah - python27-configobj - python27-cryptography - python27-dateutil - python27-docutils - python27-ecdsa - python27-enum34 - python27-futures - python27-httplib2 - python27-idna - python27-ipaddress - python27-Jinja2 - python27-jmespath - python27-jsonpatch - python27-jsonpointer - python27-jsonschema - python27-lockfile - python27-MarkupSafe - python27-oauthlib - python27-oauth - python27-paramiko - python27-ply - python27-PrettyTable - python27-pyasn1-modules - python27-pyasn1 - python27-pycparser - python27-pycrypto - python27-PyJWT - python27-pyserial - python27-pytest - python27-python-daemon - python27-PyYAML - python27-requests - python27-s3transfer - python27-setuptools - python27-simplejson - python27-six Moderate SUSE bug 1007084 SUSE bug 1014478 SUSE bug 1015776 SUSE bug 1054106 SUSE bug 1054413 SUSE bug 1064755 SUSE bug 1073879 SUSE bug 1075263 SUSE bug 1082318 SUSE bug 1097455 SUSE bug 1098681 SUSE bug 905354 SUSE bug 962170 SUSE bug 974705 SUSE bug 974993 SUSE bug 975949 SUSE bug 998103 SUSE bug 998378 CVE-2017-12880 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of quagga fixes two security issues: * CVE-2013-0149: specially-crafted OSPF packets could have caused the routing table to be erased (bnc#822572) * CVE-2013-2236: local network stack overflow (bnc#828117) Security Issue references: * CVE-2013-2236 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2236> * CVE-2013-0149 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0149> SUSE bug 822572 SUSE bug 828117 CVE-2013-0149 CVE-2013-2236 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Moderate SUSE bug 970952 CVE-2016-2342 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for quagga fixes one security issue: - bsc#770619: Disallow unprivileged users to enter config directory /etc/quagga (group: quagga, mode: 750) and read configuration files installed there (group: quagga, mode: 640). Low SUSE bug 770619 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for quagga fixes the following issue: Security issue fixed: - CVE-2016-4049: Fix for a buffer overflow error in bgp_dump_routes_func. (bsc#977012) Moderate SUSE bug 977012 CVE-2016-4049 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for quagga fixes the following issues: - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA receive code (bsc#1005258). Important SUSE bug 1005258 CVE-2016-1245 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for quagga fixes the following issues: - The Quagga BGP daemon contained a bug in the AS_PATH size calculation that could have been exploited to facilitate a remote denial-of-service attack via specially crafted BGP UPDATE messages. [CVE-2017-16227, bsc#1065641] - The Quagga BGP daemon did not check whether data sent to peers via NOTIFY had an invalid attribute length. It was possible to exploit this issue and cause the bgpd process to leak sensitive information over the network to a configured peer. [CVE-2018-5378, bsc#1079798] - The Quagga BGP daemon used to double-free memory when processing certain forms of UPDATE messages. This issue could be exploited by sending an optional/transitive UPDATE attribute that all conforming eBGP speakers should pass along. Consequently, a single UPDATE message could have affected many bgpd processes across a wide area of a network. Through this vulnerability, attackers could potentially have taken over control of affected bgpd processes remotely. [CVE-2018-5379, bsc#1079799] - It was possible to overrun internal BGP code-to-string conversion tables in the Quagga BGP daemon. Configured peers could have exploited this issue and cause bgpd to emit debug and warning messages into the logs that would contained arbitrary bytes. [CVE-2018-5380, bsc#1079800] - The Quagga BGP daemon could have entered an infinite loop if sent an invalid OPEN message by a configured peer. If this issue was exploited, then bgpd would cease to respond to any other events. BGP sessions would have been dropped and not be reestablished. The CLI interface would have been unresponsive. The bgpd daemon would have stayed in this state until restarted. [CVE-2018-5381, bsc#1079801] - The Quagga daemon's telnet "vty" CLI contains an unbounded memory allocation bug that could be exploited for a denial-of-service attack on the daemon. This issue has been fixed. [CVE-2017-5495, bsc#1021669] - The telnet "vty" CLI of the Quagga daemon is no longer enabled by default, because the passwords in the default "zebra.conf" config file are now disabled. The vty interface is available via "vtysh" utility using pam authentication to permit management access for root without password. [bsc#1021669] Important SUSE bug 1021669 SUSE bug 1065641 SUSE bug 1079798 SUSE bug 1079799 SUSE bug 1079800 SUSE bug 1079801 CVE-2017-16227 CVE-2017-5495 CVE-2018-5378 CVE-2018-5379 CVE-2018-5380 CVE-2018-5381 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA sendmail has been updated to fix the following security issue: * Not properly closing file descriptors before executing programs (CVE-2014-3956). Security Issues: * CVE-2014-3956 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3956> SUSE bug 881284 CVE-2014-3956 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service. Moderate SUSE bug 940191 SUSE bug 946204 CVE-2015-7236 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for rsync fixes two security issues: - CVE-2014-8242: Checksum collisions leading to a denial of service (bsc#900914) - CVE-2014-9512: Malicious servers could send files outside of the transferred directory (bsc#915410) Moderate SUSE bug 900914 SUSE bug 915410 CVE-2014-8242 CVE-2014-9512 SUSE Linux Enterprise Server 11 SP3-TERADATA rsync was updated to fix one security issue. - CVE-2014-9512: rsync allowed remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path (bsc#915410). Moderate SUSE bug 915410 CVE-2014-9512 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for rsync fixes the following issues: Security issues fixed: - CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also did not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allowed remote attackers to bypass intended access restrictions" (bsc#1071460). - CVE-2017-17433: The recv_files function in receiver.c in the daemon in rsync, proceeded with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allowed remote attackers to bypass intended access restrictions (bsc#1071459). - CVE-2017-16548: The receive_xattr function in xattrs.c in rsync did not check for a trailing '\\0' character in an xattr name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon (bsc#1066644). Moderate SUSE bug 1066644 SUSE bug 1071459 SUSE bug 1071460 CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for rsync fixes one issues. This security issue was fixed: - CVE-2018-5764: The parse_arguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism (bsc#1076503) Moderate SUSE bug 1076503 CVE-2018-5764 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA rsyslog has been updated to fix a remote denial of service issue: * Under certain configurations, a local or remote attacker able to send syslog messages to the server could have crashed the log server due to an array overread. (CVE-2014-3634, CVE-2014-3683) Security Issues: * CVE-2014-3634 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3634> * CVE-2014-3683 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3683> SUSE bug 890228 SUSE bug 897262 SUSE bug 899756 CVE-2014-3634 CVE-2014-3683 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This Ruby update fixes the following security issue: * bnc#808137: Fixed entity expansion DoS vulnerability in REXML (CVE-2013-1821). Security Issue reference: * CVE-2013-1821 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821> SUSE bug 808137 CVE-2013-1821 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for ruby fixes the following issues: Secuirty issues fixed: - CVE-2015-1855: Ruby OpenSSL Hostname Verification (bsc#926974) - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495) Bugfixes: - fix small mistake in the backport for (bsc#986630) Moderate SUSE bug 926974 SUSE bug 959495 SUSE bug 986630 CVE-2015-1855 CVE-2015-7551 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for rzsz fixes the following issues: - L3: sz of rzsz segfaults in zsdata() (bsc#1086416) - VUL-0: CVE-2018-10195: rzsz: sz can leak data to receiving side (bsc#1090051) - rzsz-0.12.20-976.7: illegal use of freed variable (bsc#529899) - /usr/bin/lsb segfaults [rzsz] (bsc#1076576) Moderate SUSE bug 1076576 SUSE bug 1086416 SUSE bug 1090051 SUSE bug 529899 CVE-2018-10195 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: Security issue fixed: - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222). Bug fixed: - Fix leaking memory in libsmbclient: Add missing talloc stackframe; (bso#11177); (bsc#967017). Important SUSE bug 967017 SUSE bug 968222 CVE-2015-7560 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA samba was updated to fix seven security issues. These security issues were fixed: - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862). - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031). - CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032). - CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033). - CVE-2016-2113: TLS certificate validation were missing (bsc#973034). - CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036). - CVE-2016-2118: "Badlock" DCERPC impersonation of authenticated account were possible (bsc#971965). These non-security issues were fixed: - bsc#967017: Fix leaking memory in libsmbclient in cli_set_mntpoint function - Getting and setting Windows ACLs on symlinks can change permissions on link Important SUSE bug 936862 SUSE bug 967017 SUSE bug 971965 SUSE bug 973031 SUSE bug 973032 SUSE bug 973033 SUSE bug 973034 SUSE bug 973036 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2115 CVE-2016-2118 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba provides the following fixes: Security issues fixed: - CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441) - CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442) Non security issues fixed: - Allow SESSION KEY setup without signing. (bsc#1009711) - Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731) - Don't fail when using default domain with user@domain.com format. (bsc#997833) - Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692) Moderate SUSE bug 1003731 SUSE bug 1009711 SUSE bug 1014441 SUSE bug 1014442 SUSE bug 993692 SUSE bug 997833 CVE-2016-2125 CVE-2016-2126 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: Security issue fixed: - CVE-2017-2619: symlink race permits opening files outside share directory (bsc#1027147). Important SUSE bug 1027147 CVE-2017-2619 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: Security issue fixed: - CVE-2017-2619: symlink race permits opening files outside share directory (bsc#1027147). For SUSE Linux Enterprise 11 SP4 this is a re-issue of the update, a regression in the fix has been addressed (bsc#1036283, bso#12721). Important SUSE bug 1027147 SUSE bug 1036283 CVE-2017-2619 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issue: - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. [CVE-2017-7494, bso#12780, bsc#1038231] Important SUSE bug 1038231 CVE-2017-7494 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes several issues. These security issues were fixed: - CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file, leaking information from the server to the client (bsc#1058624) - CVE-2017-12150: Always enforce smb signing when it is configured (bsc#1058622) This non-security issue was fixed: - Fix error where short name length was read as 2 bytes, should be 1 (bsc#1042419). Moderate SUSE bug 1042419 SUSE bug 1058622 SUSE bug 1058624 CVE-2017-12150 CVE-2017-12163 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: - CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - s3/libads: fix seal/signed ldap connections so they are reused; (bsc#1016531). Moderate SUSE bug 1016531 SUSE bug 1063008 CVE-2017-15275 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: - CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally (bsc#1081741) Moderate SUSE bug 1081741 CVE-2018-1050 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: The following security issues were fixed: - CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient (bsc#1103411). The following other bugs were fixed: - s3:winbindd: allow a fallback to NTLMSSP for LDAP connections (bsc#1079449) Important SUSE bug 1079449 SUSE bug 1103411 CVE-2018-10858 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for samba fixes the following issues: Security issue fixed: - CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share (bsc#1131060). Non-security issue fixed: - Make init scripts create log directories before running daemons (bsc#1101499) Moderate SUSE bug 1101499 SUSE bug 1131060 CVE-2019-3880 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Samba has been updated to fix one security issue: * CVE-2015-0240: Don't call talloc_free on an uninitialized pointer (bnc#917376). Additionally, these non-security issues have been fixed: * Realign the winbind request structure following require_membership_of field expansion (bnc#913001). * Reuse connections derived from DFS referrals (bso#10123, fate#316512). * Set domain/workgroup based on authentication callback value (bso#11059). * Fix spoolss error response marshalling (bso#10984). * Fix spoolss EnumJobs and GetJob responses (bso#10905, bnc#898031). * Fix handling of bad EnumJobs levels (bso#10898). * Fix small memory-leak in the background print process; (bnc#899558). * Prune idle or hung connections older than "winbind request timeout" (bso#3204, bnc#872912). Security Issues: * CVE-2015-0240 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240> SUSE bug 872912 SUSE bug 898031 SUSE bug 899558 SUSE bug 913001 SUSE bug 917376 CVE-2015-0240 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for Samba fixes the following security issues: - CVE-2015-5330: Remote read memory exploit in LDB (bnc#958586) - CVE-2015-5252: Insufficient symlink verification (file access outside the share) (bnc#958582) - CVE-2015-5296: No man in the middle protection when forcing smb encryption on the client side (bnc#958584) - CVE-2015-5299: Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2) (bnc#958583) Non-security issues fixed: - Prevent null pointer access in samlogon fallback when security credentials are null (bnc#949022) - Ensure samlogon fall-back requests are rerouted after kerberos failure (bnc#953382) - Ensure "Your account is disabled" message is displayed when attempting to ssh into locked account (bnc#953382) - Address unrecoverable winbind failure: "key length too large" (bnc#934299) - Take resource group sids into account when caching netsamlogon data (bnc#912457) - Fix lookup of groups with "Local Domain" scope from Active Directory (bnc#948244) - dependency issue with samba-winbind (bnc#936909) Important SUSE bug 295284 SUSE bug 912457 SUSE bug 934299 SUSE bug 936909 SUSE bug 948244 SUSE bug 949022 SUSE bug 953382 SUSE bug 958582 SUSE bug 958583 SUSE bug 958584 SUSE bug 958586 CVE-2015-5252 CVE-2015-5296 CVE-2015-5299 CVE-2015-5330 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sane-backends fixes the following issues: - saned could have leaked uninitialized memory back to its requesters for some opcodes, allowing for information disclosure of saned memory (CVE-2017-6318, bsc#1027197). Moderate SUSE bug 1027197 CVE-2017-6318 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of sblim-sfcb fixes a potential NULL pointer crash in lookupProviders() (CVE-2015-5185). Moderate SUSE bug 942628 CVE-2015-5185 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sblim-sfcb fixes the following issues: Feature enhancements: - A seperate sblim-sfcb-openssl1 package was added to the SECURITY Module. (fate#322032/bsc#1012814) This package can be installed additionaly, and the SysV Init script will pick the openssl1 variant on the next start, offering TLS 1.2 support on the WBEM SSL socket. Bugfixes: - Add sslNoSSLv3 and sslNoTLSv1 configuration options (bsc#923349, bsc#1008130) Moderate SUSE bug 1008130 SUSE bug 1012814 SUSE bug 923349 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for screen fixes the following issues: Security issue fixed: - CVE-2015-6806: Fixed a stack overflow due to deep recursion (bsc#944458). Low SUSE bug 944458 CVE-2015-6806 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA shim has been updated to fix three security issues: * OOB read access when parsing DHCPv6 packets (remote DoS) (CVE-2014-3675). * Heap overflow when parsing IPv6 addresses provided by tftp:// DHCPv6 boot option (RCE) (CVE-2014-3676). * Memory corruption when processing user provided MOK lists (CVE-2014-3677). Security Issues: * CVE-2014-3675 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3675> * CVE-2014-3676 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3676> * CVE-2014-3677 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3677> SUSE bug 813448 SUSE bug 863205 SUSE bug 866690 SUSE bug 875385 SUSE bug 889332 SUSE bug 889765 CVE-2014-3675 CVE-2014-3676 CVE-2014-3677 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for socat fixes the following issues: - CVE-2013-3571: Fix a file descriptor leak that could have been misused for a denial of service attack against socat running in server mode (bsc#821985) - CVE-2014-0019: PROXY-CONNECT address was vulnerable to a stack buffer overflow (bsc#860991) - Fix a stack overflow in the parser that could have been leveraged to execute arbitrary code (bsc#964844) Moderate SUSE bug 821985 SUSE bug 860991 SUSE bug 964844 CVE-2013-3571 CVE-2014-0019 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sqlite3 fixes the following issues: The following security issue was fixed: - CVE-2016-6153: Fixed a tempdir selection vulnerability (bsc#987394) Moderate SUSE bug 987394 CVE-2016-6153 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sqlite3 fixes the following issue: Security issue fixed: - CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687). Moderate SUSE bug 1119687 CVE-2018-20346 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sqlite3 fixes the following issues: Security issue fixed: - CVE-2018-8740: Fixed a NULL pointer dereference related to corrupted databases schemas (bsc#1085790). - CVE-2017-10989: Fixed a heap-based buffer over-read in getNodeSize() (bsc#1132045). Moderate SUSE bug 1085790 SUSE bug 1132045 CVE-2017-10989 CVE-2018-8740 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sqlite3 fixes the following issue: Security issue fixed: - CVE-2019-8457: Fixed a Heap out-of-bound read in rtreenode() when handling invalid rtree tables (bsc#1136976). Important SUSE bug 1136976 CVE-2019-8457 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This squid update fixes a buffer overflow issue when squid attempts to resolve an overly long hostname. This can be triggered with specially crafted http requests. (bnc#829084, CVE-2013-4115) This update also includes a correction to the last change for logrotate. (bnc#677335) Security Issue reference: * CVE-2013-4115 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4115> SUSE bug 677335 SUSE bug 829084 CVE-2013-4115 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA squid was updated to fix two security issues. These security issues were fixed: - CVE-2014-6270: Fixed an off by one in snmp subsystem (bsc#895773). - CVE-2014-9749: Fixed a nonce replay vulnerability in Digest authentication (bsc#949942). Moderate SUSE bug 895773 SUSE bug 949942 CVE-2014-6270 CVE-2014-9749 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid fixes the following issues: - CVE-2016-4051: backport fix buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4554: backport fix for header smuggling issue in HTTP Request processing (bsc#979010) Moderate SUSE bug 976553 SUSE bug 979010 CVE-2016-4051 CVE-2016-4554 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid fixes the following issues: Security issue fixed: - CVE-2019-13345: Fixed a cross site scripting vulnerability via user_name or auth parameter in cachemgr.cgi (bsc#1140738). Moderate SUSE bug 1140738 CVE-2019-13345 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Squid3 was updated to fix a denial of service in Range Header processing, which would have allowed proxy users to crash the squid proxy process. (CVE-2014-3609) Security Issues: * CVE-2014-3609 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609> SUSE bug 893649 CVE-2014-3609 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid3 fixes the following issues: - Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142) - CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782) - CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010) - Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395) - Regression caused by the DoS fixes above (bsc#993299) - CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783) - CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553) - CVE-2016-4052, CVE-2016-4053, CVE-2016-4054: * fixes multiple issues in ESI processing (bsc#976556) - CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008) - CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715) - CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773) - Memory leak in squid3 when using external_acl (bsc#976708) Important SUSE bug 895773 SUSE bug 902197 SUSE bug 938715 SUSE bug 963539 SUSE bug 967011 SUSE bug 968392 SUSE bug 968393 SUSE bug 968394 SUSE bug 968395 SUSE bug 973782 SUSE bug 973783 SUSE bug 976553 SUSE bug 976556 SUSE bug 976708 SUSE bug 979008 SUSE bug 979009 SUSE bug 979010 SUSE bug 979011 SUSE bug 993299 CVE-2011-3205 CVE-2011-4096 CVE-2012-5643 CVE-2013-0188 CVE-2013-4115 CVE-2014-0128 CVE-2014-6270 CVE-2014-7141 CVE-2014-7142 CVE-2015-5400 CVE-2016-2390 CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572 CVE-2016-3947 CVE-2016-3948 CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 CVE-2016-4553 CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid3 fixes the following issues: - CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168) - CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942) Moderate SUSE bug 1016168 SUSE bug 949942 CVE-2014-9749 CVE-2016-10002 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid3 fixes the following issues: Security issues fixed: - CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI responses. This affects the default custom esi_parser (bsc#1077003). - CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI responses or downloading intermediate CA certificates (bsc#1077006). Moderate SUSE bug 1077003 SUSE bug 1077006 CVE-2018-1000024 CVE-2018-1000027 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid3 fixes the following issues: - CVE-2018-1172: Fixed a DoS caused by incorrect handling of ESI responses. (bsc#1090089, SQUID-2018:3) Important SUSE bug 1090089 CVE-2018-1172 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for squid3 fixes the following issues: Security issue fixed: - CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668). Important SUSE bug 1113668 CVE-2018-19131 SUSE Linux Enterprise Server 11 SP3-TERADATA squidGuard was updated to fix one security issue. This security issue was fixed: - CVE-2015-8936: Reflected cross site scripting vulnerability because of insufficient escaping (bsc#985612). Moderate SUSE bug 985612 CVE-2015-8936 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a NULL ptr dereference (DoS) via ID_DER_ASN1_DN ID payloads. Security Issue reference: * CVE-2014-2891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2891> SUSE bug 876449 CVE-2014-2891 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The strongswan package was updated to fix the following security issue: - CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817). Moderate SUSE bug 953817 CVE-2015-8023 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for strongswan fixes the following issues: - CVE-2017-9022: Insufficient Input Validation in gmp Plugin leads to Denial of service (bsc#1039514) - CVE-2017-9023: Incorrect x509 ASN.1 parser error handling could lead to Denial of service (bsc#1039515) Important SUSE bug 1039514 SUSE bug 1039515 CVE-2017-9022 CVE-2017-9023 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for strongswan fixes the following issues: - CVE-2017-11185: Specific RSA signatures passed to the gmp plugin for verification can cause a null-pointer dereference and it may lead to a denial of service (bsc#1051222) Moderate SUSE bug 1051222 CVE-2017-11185 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This collective update for sudo provides fixes for the following issues: * Security policy bypass when env_reset is disabled. (CVE-2014-0106, bnc#866503) * Regression in the previous update that causes a segmentation fault when running "sudo -s". (bnc#868444) * Command "who -m" prints no output when using log_input/log_output sudo options. (bnc#863025) Security Issues references: * CVE-2014-0106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106> SUSE bug 863025 SUSE bug 866503 SUSE bug 868444 CVE-2014-0106 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for sudo fixes the following issues: - Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality: * noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766] * noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501] - The SSSD plugin would occasionally crash sudo with an "internal error". This issue has been fixed. [bsc#948973] - The SSSD plugin would occasionally apply @netgroups rules from LDAP to all users rather than the @netgroup. This issue is now fixed. [bsc#966755] - When the SSSD plugin was used and a local user ran sudo, an e-mail used to be sent to administrator because SSSD did not support sudo rules for local users. This message did not signify an error, however, it was only noise. [bsc#1008043] Moderate SUSE bug 1007501 SUSE bug 1007766 SUSE bug 1008043 SUSE bug 948973 SUSE bug 966755 CVE-2016-7032 CVE-2016-7076 SUSE Linux Enterprise Server 11 SP3-TERADATA supportutils was updated to fix one security issue. This security issue was fixed: - CVE-2016-1602: Code injection and privilege escalation via unescaped filenames (bsc#980670). Moderate SUSE bug 980670 CVE-2016-1602 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for supportutils fixes the following issues: Security vulnerabilities fixed: - CVE-2018-19636: Local root exploit via inclusion of attacker controlled shell script (bsc#1117751) - CVE-2018-19640: Users can kill arbitrary processes (bsc#1118463) - CVE-2018-19638: User can overwrite arbitrary log files in support tar (bsc#1118460) - CVE-2018-19639: Code execution if run with -v (bsc#1118462) Moderate SUSE bug 1117751 SUSE bug 1118460 SUSE bug 1118462 SUSE bug 1118463 CVE-2018-19636 CVE-2018-19638 CVE-2018-19639 CVE-2018-19640 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA suseRegister was updated to fix one security issue: * POODLE: Ensure that only TLS is used. (CVE-2014-3566) Security Issues: * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> SUSE bug 901757 CVE-2014-3566 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tar fixes the following issues: - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line [bsc#1007188] [CVE-2016-6321] Moderate SUSE bug 1007188 CVE-2016-6321 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tboot provides the following fix: Security issue fixed: - CVE-2014-5118: tboot: bypass of measured boot (bsc#889339) Bug fixes: - Fixed failed trusted boot on some systems like Intel Xeon "Purley 8s" processors. The following error message showed: "TBOOT: wait-for-sipi loop timed-out". Booting continued but "TXT measured launch" was wrongly reported as FALSE. (bsc#1057555) Moderate SUSE bug 1057555 SUSE bug 889339 CVE-2014-5118 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA When running tcpdump, a remote unauthenticated user could have crashed the application or, potentially, execute arbitrary code by injecting crafted packages into the network. The following vulnerabilities in protocol printers have been fixed: * IPv6 mobility printer remote DoS (CVE-2015-0261, bnc#922220) * Ethernet printer remote DoS (CVE-2015-2154, bnc#922222) * PPP printer remote DoS (CVE-2014-9140, bnc#923142) Security Issues: * CVE-2015-0261 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0261> * CVE-2015-2154 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2154> * CVE-2014-9140 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9140> SUSE bug 922220 SUSE bug 922222 SUSE bug 923142 CVE-2014-9140 CVE-2015-0261 CVE-2015-2154 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tcpdump fixes the following issues: Security issues fixed (bsc#1020940): - CVE-2016-7922: Corrected buffer overflow in AH parser print-ah.c:ah_print(). - CVE-2016-7923: Corrected buffer overflow in ARP parser print-arp.c:arp_print(). - CVE-2016-7925: Corrected buffer overflow in compressed SLIP parser print-sl.c:sl_if_print(). - CVE-2016-7926: Corrected buffer overflow in the Ethernet parser print-ether.c:ethertype_print(). - CVE-2016-7927: Corrected buffer overflow in the IEEE 802.11 parser print-802_11.c:ieee802_11_radio_print(). - CVE-2016-7928: Corrected buffer overflow in the IPComp parser print-ipcomp.c:ipcomp_print(). - CVE-2016-7931: Corrected buffer overflow in the MPLS parser print-mpls.c:mpls_print(). - CVE-2016-7936: Corrected buffer overflow in the UDP parser print-udp.c:udp_print(). - CVE-2016-7934,CVE-2016-7935,CVE-2016-7937: Corrected segmentation faults in function udp_print(). - CVE-2016-7939: Corrected buffer overflows in GRE parser print-gre.c:(multiple functions). - CVE-2016-7940: Corrected buffer overflows in STP parser print-stp.c:(multiple functions). - CVE-2016-7973: Corrected buffer overflow in AppleTalk parser print-atalk.c. - CVE-2016-7974: Corrected buffer overflow in IP parser print-ip.c:(multiple functions). - CVE-2016-7975: Corrected buffer overflow in TCP parser print-tcp.c:tcp_print(). - CVE-2016-7983,CVE-2016-7984: Corrected buffer overflow in TFTP parser print-tftp.c:tftp_print(). - CVE-2016-7992: Corrected buffer overflow in Classical IP over ATM parser print-cip.c. - CVE-2016-7993: Corrected buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, etc.). - CVE-2016-8574: Corrected buffer overflow in FRF.15 parser print-fr.c:frf15_print(). - CVE-2017-5202: Corrected buffer overflow in ISO CLNS parser print-isoclns.c:clnp_print(). - CVE-2017-5203: Corrected buffer overflow in BOOTP parser print-bootp.c:bootp_print(). - CVE-2017-5204: Corrected buffer overflow in IPv6 parser print-ip6.c:ip6_print(). - CVE-2017-5483: Corrected buffer overflow in SNMP parser print-snmp.c:asn1_parse(). - CVE-2017-5484: Corrected buffer overflow in ATM parser print-atm.c:sig_print(). - CVE-2017-5485: Corrected buffer overflow in ISO CLNS parser addrtoname.c:lookup_nsap(). - CVE-2017-5486: Corrected buffer overflow in ISO CLNS parser print-isoclns.c:clnp_print(). Moderate SUSE bug 1020940 CVE-2016-7922 CVE-2016-7923 CVE-2016-7925 CVE-2016-7926 CVE-2016-7927 CVE-2016-7928 CVE-2016-7931 CVE-2016-7934 CVE-2016-7935 CVE-2016-7936 CVE-2016-7937 CVE-2016-7939 CVE-2016-7940 CVE-2016-7973 CVE-2016-7974 CVE-2016-7975 CVE-2016-7983 CVE-2016-7984 CVE-2016-7992 CVE-2016-7993 CVE-2016-8574 CVE-2017-5202 CVE-2017-5203 CVE-2017-5204 CVE-2017-5483 CVE-2017-5484 CVE-2017-5485 CVE-2017-5486 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tcpdump fixes the following issues: Security issues fixed: - CVE-2017-11108: Crafted input allowed remote DoS (bsc#1047873) - CVE-2017-11541: Prevent a heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c (bsc#1057247). - CVE-2017-11542: Prevent a heap-based buffer over-read in the pimv1_print function in print-pim.c (bsc#1057247). - CVE-2017-11543: Prevent a buffer overflow in the sliplink_print function in print-sl.c (bsc#1057247). - CVE-2017-13011: Several protocol parsers in tcpdump could have caused a buffer overflow in util-print.c:bittok2str_internal() (bsc#1057247). Moderate SUSE bug 1047873 SUSE bug 1057247 CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-13011 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA tiff was updated to fix six security issues found by fuzzing initiatives. These security issues were fixed: - CVE-2014-8127: Out-of-bounds write (bnc#914890). - CVE-2014-8128: Out-of-bounds write (bnc#914890). - CVE-2014-8129: Out-of-bounds write (bnc#914890). - CVE-2014-8130: Out-of-bounds write (bnc#914890). - CVE-2014-9655: Access of uninitialized memory (bnc#916927). Moderate SUSE bug 914890 SUSE bug 916927 CVE-2014-8127 CVE-2014-8128 CVE-2014-8129 CVE-2014-8130 CVE-2014-9655 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: - CVE-2015-8781, CVE-2015-8782, CVE-2015-8783: Out-of-bounds writes for invalid images (bsc#964225) - CVE-2015-7554: Out-of-bounds Write in the thumbnail and tiffcmp tools (bsc#960341) Moderate SUSE bug 960341 SUSE bug 964225 CVE-2015-7554 CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: - CVE-2016-3622: Specially crafted TIFF images could trigger a crash in tiff2rgba (bsc#974449) - Various out-of-bound write vulnerabilities with unspecified impact (MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098) - CVE-2016-5314: Specially crafted TIFF images could trigger a crash that could result in DoS (bsc#984831) - CVE-2016-5316: Specially crafted TIFF images could trigger a crash in the rgb2ycbcr tool, leading to Doa (bsc#984837) - CVE-2016-5317: Specially crafted TIFF images could trigger a crash through an out of bound write (bsc#984842) - CVE-2016-5320: Specially crafted TIFF images could trigger a crash or potentially allow remote code execution when using the rgb2ycbcr command (bsc#984808) - CVE-2016-5875: Specially crafted TIFF images could trigger could allow arbitrary code execution (bsc#987351) - CVE-2016-3623: Specially crafted TIFF images could trigger a crash in rgb2ycbcr (bsc#974618) - CVE-2016-3945: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution via tiff2rgba (bsc#974614) - CVE-2016-3990: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution (bsc#975069) - CVE-2016-3186: Specially crafted TIFF imaged could trigger a crash in the gif2tiff command via a buffer overflow (bsc#973340) Moderate SUSE bug 973340 SUSE bug 974449 SUSE bug 974614 SUSE bug 974618 SUSE bug 975069 SUSE bug 984808 SUSE bug 984831 SUSE bug 984837 SUSE bug 984842 SUSE bug 987351 CVE-2016-3186 CVE-2016-3622 CVE-2016-3623 CVE-2016-3945 CVE-2016-3990 CVE-2016-5314 CVE-2016-5316 CVE-2016-5317 CVE-2016-5320 CVE-2016-5875 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: - CVE-2016-9453: The t2p_readwrite_pdf_image_tile function allowed remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one (bsc#1011107). - CVE-2016-5652: An exploitable heap-based buffer overflow existed in the handling of TIFF images in the TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means (bsc#1007280). - CVE-2017-11335: There is a heap based buffer overflow in tools/tiff2pdf.c via a PlanarConfig=Contig image, which caused a more than one hundred bytes out-of-bounds write (related to the ZIPDecode function in tif_zip.c). A crafted input may lead to a remote denial of service attack or an arbitrary code execution attack (bsc#1048937). - CVE-2016-9536: tools/tiff2pdf.c had an out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow." (bsc#1011845) - CVE-2017-9935: In LibTIFF, there was a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or a double free in t2p_free. Given these possibilities, it probably could cause arbitrary code execution (bsc#1046077). - CVE-2017-17973: There is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. (bsc#1074318) - CVE-2015-7554: The _TIFFVGetField function in tif_dir.c allowed attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image (bsc#960341). - CVE-2016-5318: Stack-based buffer overflow in the _TIFFVGetField function allowed remote attackers to crash the application via a crafted tiff (bsc#983436). - CVE-2016-10095: Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c allowed remote attackers to cause a denial of service (crash) via a crafted TIFF file (bsc#1017690,). - CVE-2016-10268: tools/tiffcp.c allowed remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23 (bsc#1031255) - An overlapping of memcpy parameters was fixed which could lead to content corruption (bsc#1017691). - Fixed an invalid memory read which could lead to a crash (bsc#1017692). - Fixed a NULL pointer dereference in TIFFReadRawData (tiffinfo.c) that could crash the decoder (bsc#1017688). Moderate SUSE bug 1007280 SUSE bug 1011107 SUSE bug 1011845 SUSE bug 1017688 SUSE bug 1017690 SUSE bug 1017691 SUSE bug 1017692 SUSE bug 1031255 SUSE bug 1046077 SUSE bug 1048937 SUSE bug 1074318 SUSE bug 960341 SUSE bug 983436 CVE-2015-7554 CVE-2016-10095 CVE-2016-10268 CVE-2016-3945 CVE-2016-5318 CVE-2016-5652 CVE-2016-9453 CVE-2016-9536 CVE-2017-11335 CVE-2017-17973 CVE-2017-9935 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-5315: The setByteArray function in tif_dir.c allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image. (bsc#984809) - CVE-2016-10267: LibTIFF allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8. (bsc#1017694) - CVE-2016-10269: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2. (bsc#1031254) - CVE-2016-10270: LibTIFF allowed remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22. (bsc#1031250) - CVE-2017-18013: In LibTIFF, there was a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash. (bsc#1074317) - CVE-2017-7593: tif_read.c did not ensure that tif_rawdata is properly initialized, which might have allowed remote attackers to obtain sensitive information from process memory via a crafted image. (bsc#1033129) - CVE-2017-7595: The JPEGSetupEncode function in tiff_jpeg.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image. (bsc#1033127) - CVE-2017-7596: LibTIFF had an "outside the range of representable values of type float" undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033126) - CVE-2017-7597: tif_dirread.c had an "outside the range of representable values of type float" undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033120) - CVE-2017-7599: LibTIFF had an "outside the range of representable values of type short" undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033113) - CVE-2017-7600: LibTIFF had an "outside the range of representable values of type unsigned char" undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033112) - CVE-2017-7601: LibTIFF had a "shift exponent too large for 64-bit type long" undefined behavior issue, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033111) - CVE-2017-7602: LibTIFF had a signed integer overflow, which might have allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image. (bsc#1033109) - Multiple divide by zero issues - CVE-2016-5314: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr. (bsc#987351 bsc#984808 bsc#984831) Moderate SUSE bug 1017694 SUSE bug 1031250 SUSE bug 1031254 SUSE bug 1033109 SUSE bug 1033111 SUSE bug 1033112 SUSE bug 1033113 SUSE bug 1033120 SUSE bug 1033126 SUSE bug 1033127 SUSE bug 1033129 SUSE bug 1074317 SUSE bug 984808 SUSE bug 984809 SUSE bug 984831 SUSE bug 987351 CVE-2016-10267 CVE-2016-10269 CVE-2016-10270 CVE-2016-5314 CVE-2016-5315 CVE-2017-18013 CVE-2017-7593 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following security issues: - CVE-2017-5225: Prevent heap buffer overflow in the tools/tiffcp that could have caused DoS or code execution via a crafted BitsPerSample value (bsc#1019611) - CVE-2018-7456: Prevent a NULL Pointer dereference in the function TIFFPrintDirectory when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013 (bsc#1082825) - CVE-2017-11613: Prevent denial of service in the TIFFOpen function. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If the value of td_imagelength is set close to the amount of system memory, it will hang the system or trigger the OOM killer (bsc#1082332) - CVE-2016-10266: Prevent remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22 (bsc#1031263) - CVE-2018-8905: Prevent heap-based buffer overflow in the function LZWDecodeCompat via a crafted TIFF file (bsc#1086408) - CVE-2016-9540: Prevent out-of-bounds write on tiled images with odd tile width versus image width (bsc#1011839). - CVE-2016-9535: tif_predict.h and tif_predict.c had assertions that could have lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling (bsc#1011846). - CVE-2016-9535: tif_predict.h and tif_predict.c had assertions that could have lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling (bsc#1011846). - Removed assert in readSeparateTilesIntoBuffer() function (bsc#1017689). - CVE-2016-10095: Prevent stack-based buffer overflow in the _TIFFVGetField function that allowed remote attackers to cause a denial of service (crash) via a crafted TIFF file (bsc#1017690). - CVE-2016-8331: Prevent remote code execution because of incorrect handling of TIFF images. A crafted TIFF document could have lead to a type confusion vulnerability resulting in remote code execution. This vulnerability could have been be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality (bsc#1007276). - CVE-2016-3632: The _TIFFVGetField function allowed remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image (bsc#974621). Moderate SUSE bug 1007276 SUSE bug 1011839 SUSE bug 1011846 SUSE bug 1017689 SUSE bug 1017690 SUSE bug 1019611 SUSE bug 1031263 SUSE bug 1082332 SUSE bug 1082825 SUSE bug 1086408 SUSE bug 974621 CVE-2014-8128 CVE-2015-7554 CVE-2016-10095 CVE-2016-10266 CVE-2016-3632 CVE-2016-5318 CVE-2016-8331 CVE-2016-9535 CVE-2016-9540 CVE-2017-11613 CVE-2017-5225 CVE-2018-7456 CVE-2018-8905 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: The following security vulnerabilities were addressed: - CVE-2015-8668: Fixed a heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff, which allowed remote attackers to execute arbitrary code or cause a denial of service via a large width field in a specially crafted BMP image. (bsc#960589) - CVE-2018-10779: Fixed a heap-based buffer over-read in TIFFWriteScanline() in tif_write.c (bsc#1092480) - CVE-2017-17942: Fixed a heap-based buffer overflow in the function PackBitsEncode in tif_packbits.c. (bsc#1074186) - CVE-2016-5319: Fixed a beap-based buffer overflow in bmp2tiff (bsc#983440) Moderate SUSE bug 1074186 SUSE bug 1092480 SUSE bug 960589 SUSE bug 983440 CVE-2015-8668 CVE-2016-5319 CVE-2017-17942 CVE-2018-10779 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: - CVE-2018-17100: There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108637) - CVE-2018-17101: There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file. (bsc#1108627) - CVE-2018-17795: The function t2p_write_pdf in tiff2pdf.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935. (bsc#1110358) - CVE-2018-16335: newoffsets handling in ChopUpSingleUncompressedStrip in tif_dirread.c allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, as demonstrated by tiff2pdf. This is a different vulnerability than CVE-2018-15209. (bsc#1106853) Moderate SUSE bug 1106853 SUSE bug 1108627 SUSE bug 1108637 SUSE bug 1110358 CVE-2017-11613 CVE-2017-9935 CVE-2018-16335 CVE-2018-17100 CVE-2018-17101 CVE-2018-17795 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: Security issues fixed: - CVE-2018-18661: Fixed NULL pointer dereference in the function LZWDecode in the file tif_lzw.c (bsc#1113672). - CVE-2018-12900: Fixed heap-based buffer overflow in the cpSeparateBufToContigBuf (bsc#1099257). - CVE-2017-9147: Fixed invalid read in the _TIFFVGetField function in tif_dir.c, that allowed remote attackers to cause a DoS via acrafted TIFF file (bsc#1040322). - CVE-2017-9117: Fixed BMP images processing that was verified without biWidth and biHeight values (bsc#1040080). - CVE-2017-17942: Fixed issue in the function PackBitsEncode that could have led to a heap overflow and caused a DoS (bsc#1074186). - CVE-2016-9273: Fixed heap-based buffer overflow issue (bsc#1010163). - CVE-2016-5319: Fixed heap-based buffer overflow in PackBitsEncode (bsc#983440). - CVE-2016-3621: Fixed out-of-bounds read in the bmp2tiff tool (lzw packing) (bsc#974448). - CVE-2016-3620: Fixed out-of-bounds read in the bmp2tiff tool (zip packing) (bsc#974447) - CVE-2016-3619: Fixed out-of-bounds read in the bmp2tiff tool (none packing) (bsc#974446) - CVE-2015-8870: Fixed integer overflow in tools/bmp2tiff.c that allowed remote attackers to causea DOS (bsc#1014461). Non-security issues fixed: - asan_build: build ASAN included - debug_build: build more suitable for debugging Moderate SUSE bug 1010163 SUSE bug 1014461 SUSE bug 1040080 SUSE bug 1040322 SUSE bug 1074186 SUSE bug 1099257 SUSE bug 1113672 SUSE bug 974446 SUSE bug 974447 SUSE bug 974448 SUSE bug 983440 CVE-2015-8870 CVE-2016-3619 CVE-2016-3620 CVE-2016-3621 CVE-2016-5319 CVE-2016-9273 CVE-2017-17942 CVE-2017-9117 CVE-2017-9147 CVE-2018-12900 CVE-2018-18661 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10094: Fixed heap-based buffer overflow in the _tiffWriteProc function (bsc#1017693). - CVE-2016-10093: Fixed heap-based buffer overflow in the _TIFFmemcpy function (bsc#1017693). - CVE-2016-10092: Fixed heap-based buffer overflow in the TIFFReverseBits function (bsc#1017693). Moderate SUSE bug 1017693 CVE-2016-10092 CVE-2016-10093 CVE-2016-10094 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tiff fixes the following issue: Security vulnerabilities fixed: - CVE-2016-5102: Fixed a buffer overflow in readgifimage() (bsc#983268) - CVE-2019-6128: Fixed a memory leak in the TIFFFdOpen function in tif_unix.c (bsc#1121626) Low SUSE bug 1121626 SUSE bug 983268 CVE-2016-5102 CVE-2019-6128 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tomcat6 fixes the following issue: - CVE-2016-5388 Setting HTTP_PROXY environment variable via Proxy header (bsc#988489) Moderate SUSE bug 988489 CVE-2016-5388 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of tomcat6 fixes: * apache-tomcat-CVE-2012-3544.patch (bnc#831119) * use chown --no-dereference to prevent symlink attacks on log (bnc#822177#c7/prevents CVE-2013-1976) * Fix tomcat init scripts generating malformed classpath ( http://youtrack.jetbrains.com/issue/JT-18545 <http://youtrack.jetbrains.com/issue/JT-18545> ) bnc#804992 (patch from m407) * fix a typo in initscript (bnc#768772 ) * copy all shell scripts (bnc#818948) Security Issue references: * CVE-2012-3544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544> * CVE-2013-1976 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1976> * CVE-2012-0022 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022> SUSE bug 768772 SUSE bug 804992 SUSE bug 818948 SUSE bug 822177 SUSE bug 831119 CVE-2012-0022 CVE-2012-3544 CVE-2013-1976 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tomcat6 fixes the following issues: The version was updated from 6.0.41 to 6.0.45. Security issues fixed: * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (bsc#967967) * CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects before considering security constraints and Filters, which allowed remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (bsc#967965) * CVE-2016-0706: Apache Tomcat did not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. (bsc#967815) * CVE-2016-0714: The session-persistence implementation in Apache Tomcat mishandled session attributes, which allowed remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (bsc#967964) Important SUSE bug 934219 SUSE bug 967815 SUSE bug 967964 SUSE bug 967965 SUSE bug 967967 CVE-2015-5174 CVE-2015-5345 CVE-2016-0706 CVE-2016-0714 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tomcat6 fixes the following issues: Tomcat was updated to version 6.0.53: The full changelog is: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html Security issues fixed: - CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure (bsc#1036642) - CVE-2016-8745: Regression in the error handling methods could lead to information disclosure (bsc#1015119) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow remote attackers to redirect outbound HTTP traffic (bsc#988489) Important SUSE bug 1007853 SUSE bug 1007854 SUSE bug 1007855 SUSE bug 1007857 SUSE bug 1007858 SUSE bug 1011805 SUSE bug 1011812 SUSE bug 1015119 SUSE bug 1033448 SUSE bug 1036642 SUSE bug 988489 CVE-2016-0762 CVE-2016-5018 CVE-2016-5388 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 CVE-2017-5647 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tomcat6 fixes the following security issues: - : The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Tomcat did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page (bsc#1042910). - : The URL pattern of "" was not correctly handled when used as part of a security constraint definition. This caused the constraint to be ignored. It was possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected (bsc#1082480). Moderate SUSE bug 1042910 SUSE bug 1082480 CVE-2017-5664 CVE-2018-1304 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for tomcat6 fixes the following issue: Security issue fixed: - CVE-2018-11784: Fixed problem with specially crafted URLs that could be used to cause a redirect to any URI of an attackers choise (bsc#1110850). Moderate SUSE bug 1110850 CVE-2018-11784 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Tomcat has been updated to version 6.0.41, which brings security and bug fixes. The following security fixes have been fixed: * CVE-2014-0096: A XXE vulnerability via user supplied XSLTs. * CVE-2014-0099: Request smuggling via malicious content length header. * CVE-2014-0119: A XML parser hijack by malicious web application. Bugs fixed: * Socket bind fails on tomcat startup when using apr (IPV6) (bnc#881700) * classpath for org/apache/juli/logging/LogFactory (bnc#844689) Security Issues: * CVE-2013-4322 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4322> * CVE-2012-3544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544> * CVE-2014-0099 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0099> * CVE-2014-0096 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0096> * CVE-2014-0119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0119> SUSE bug 844689 SUSE bug 865746 SUSE bug 880346 SUSE bug 880347 SUSE bug 880348 SUSE bug 881700 CVE-2012-3544 CVE-2013-4322 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for transfig fixes the following issues: Security issue fixed: - CVE-2017-16899: Fix array index error in the fig2dev program (bsc#1069257). Moderate SUSE bug 1069257 CVE-2017-16899 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for unrar fixes the following issues: - CVE-2012-6706: decoding malicious RAR files could have lead to memory corruption or code execution. (bsc#1045315). Important SUSE bug 1045315 CVE-2012-6706 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed: - CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file (bsc#1054038). - CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function (bsc#1054038). - CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20 function (bsc#1054038). - CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function (bsc#1054038). These non-security issues were fixed: - Added extraction support for .LZ archives created by Lzip compressor - Enable unpacking of files in ZIP archives compressed with XZ algorithm and encrypted with AES - Added support for PAX extended headers inside of TAR archive - If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files - By default unrar skips symbolic links with absolute paths in link target when extracting unless -ola command line switch is specified - Added support for AES-NI CPU instructions - Support for a new RAR 5.0 archiving format - Wildcard exclusion mask for folders - Added libunrar* and libunrar*-devel subpackages (bsc#513804) - Prevent conditional jumps depending on uninitialised values (bsc#1046882) Moderate SUSE bug 1046882 SUSE bug 1054038 SUSE bug 513804 SUSE bug 693890 CVE-2012-6706 CVE-2017-12938 CVE-2017-12940 CVE-2017-12941 CVE-2017-12942 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues: * CVE-2014-8139: input sanitization errors (bnc#909214) * CVE-2014-9636: out-of-bounds read/write in test_compr_eb() (bnc#914442) Security Issues: * CVE-2014-9636 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9636> * CVE-2014-8139 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139> SUSE bug 909214 SUSE bug 914442 CVE-2014-8139 CVE-2014-9636 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for unzip fixes the following issues: - CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993) - CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110) - CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111) - CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992) Moderate SUSE bug 1013992 SUSE bug 1013993 SUSE bug 950110 SUSE bug 950111 CVE-2014-9913 CVE-2015-7696 CVE-2015-7697 CVE-2016-9844 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for unzip fixes the following issues: - CVE-2018-1000035: Fixed a heap-based buffer overflow in password protected ZIP archives (bsc#1080074) Moderate SUSE bug 1080074 CVE-2018-1000035 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for unzip fixes the following issues: - CVE-2018-18384: Fixed a buffer overflow when listing archives (bsc#1110194) Moderate SUSE bug 1110194 CVE-2018-18384 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for vim fixes the following security issues: - Fixed CVE-2016-1248, an arbitrary command execution vulnerability (bsc#1010685) Important SUSE bug 1010685 CVE-2016-1248 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for vim fixes the following issues: - CVE-2017-5953: Fixed a possible overflow with corrupted spell file (bsc#1024724) Moderate SUSE bug 1024724 CVE-2017-5953 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for vim fixes the following issues: Security issue fixed: - CVE-2019-12735: Fixed a potential arbitrary code execution vulnerability in getchar.c (bsc#1137443). Important SUSE bug 1137443 CVE-2019-12735 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA vino has been updated to fix a remote denial of service problem where remote attackers could have caused a infinite loop in vino (CPU consumption). (CVE-2013-5745) Security Issue reference: * CVE-2013-5745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5745> SUSE bug 843174 CVE-2013-5745 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA vsftpd has been updated to fix one security issue: * CVE-2015-1419: Config option deny_file was not handled correctly (bnc#915522, bnc#900326) Security Issues: * CVE-2015-1419 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1419> SUSE bug 900326 SUSE bug 915522 CVE-2015-1419 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for w3m fixes the following issues: - update to debian git version (bsc#1011293) addressed security issues: CVE-2016-9621: w3m: global-buffer-overflow write (bsc#1012020) CVE-2016-9622: w3m: null deref (bsc#1012021) CVE-2016-9623: w3m: null deref (bsc#1012022) CVE-2016-9624: w3m: near-null deref (bsc#1012023) CVE-2016-9625: w3m: stack overflow (bsc#1012024) CVE-2016-9626: w3m: stack overflow (bsc#1012025) CVE-2016-9627: w3m: heap overflow read + deref (bsc#1012026) CVE-2016-9628: w3m: null deref (bsc#1012027) CVE-2016-9629: w3m: null deref (bsc#1012028) CVE-2016-9630: w3m: global-buffer-overflow read (bsc#1012029) CVE-2016-9631: w3m: null deref (bsc#1012030) CVE-2016-9632: w3m: global-buffer-overflow read (bsc#1012031) CVE-2016-9633: w3m: OOM (bsc#1012032) CVE-2016-9434: w3m: null deref (bsc#1011283) CVE-2016-9435: w3m: use uninit value (bsc#1011284) CVE-2016-9436: w3m: use uninit value (bsc#1011285) CVE-2016-9437: w3m: write to rodata (bsc#1011286) CVE-2016-9438: w3m: null deref (bsc#1011287) CVE-2016-9439: w3m: stack overflow (bsc#1011288) CVE-2016-9440: w3m: near-null deref (bsc#1011289) CVE-2016-9441: w3m: near-null deref (bsc#1011290) CVE-2016-9442: w3m: potential heap buffer corruption (bsc#1011291) CVE-2016-9443: w3m: null deref (bsc#1011292) Moderate SUSE bug 1011269 SUSE bug 1011270 SUSE bug 1011271 SUSE bug 1011272 SUSE bug 1011283 SUSE bug 1011284 SUSE bug 1011285 SUSE bug 1011286 SUSE bug 1011287 SUSE bug 1011288 SUSE bug 1011289 SUSE bug 1011290 SUSE bug 1011291 SUSE bug 1011292 SUSE bug 1011293 SUSE bug 1012020 SUSE bug 1012021 SUSE bug 1012022 SUSE bug 1012023 SUSE bug 1012024 SUSE bug 1012025 SUSE bug 1012026 SUSE bug 1012027 SUSE bug 1012028 SUSE bug 1012029 SUSE bug 1012030 SUSE bug 1012031 SUSE bug 1012032 CVE-2010-2074 CVE-2016-9422 CVE-2016-9423 CVE-2016-9424 CVE-2016-9425 CVE-2016-9434 CVE-2016-9435 CVE-2016-9436 CVE-2016-9437 CVE-2016-9438 CVE-2016-9439 CVE-2016-9440 CVE-2016-9441 CVE-2016-9442 CVE-2016-9443 CVE-2016-9621 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9630 CVE-2016-9631 CVE-2016-9632 CVE-2016-9633 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wavpack fixes the following issues: - CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483) Moderate SUSE bug 1021483 CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wavpack fixes the following issues: Security issues fixed: - CVE-2018-19840: Fixed a denial-of-service in the WavpackPackInit function from pack_utils.c (bsc#1120930) Moderate SUSE bug 1120930 CVE-2018-19840 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA wget has been updated to fix one security issue and two non-security issues. This security issue has been fixed: * FTP symlink arbitrary filesystem access (CVE-2014-4877). These non-security issues have been fixed: * Fix displaying of download time (bnc#901276). * Fix 0 size FTP downloads after failure (bnc#885069). Security Issues: * CVE-2014-4877 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877> SUSE bug 885069 SUSE bug 901276 SUSE bug 902709 CVE-2014-4877 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wget fixes the following issues: - CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed. (bsc#984060). - CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext and making them accessible to the current user only. (bsc#995964) Bug fixed: - Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor (bsc#958342) Moderate SUSE bug 958342 SUSE bug 984060 SUSE bug 995964 CVE-2016-4971 CVE-2016-7098 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: (url_parse): Reject control characters in host part of URL (bsc#1028301). Moderate SUSE bug 1028301 CVE-2017-6508 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wget fixes the following issues: - CVE-2018-0494: Fixed Cookie injection vulnerability by checking for and joining continuation lines. (bsc#1092061) Moderate SUSE bug 1092061 CVE-2018-0494 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA wireshark has been updated to version 1.10.11 to fix five security issues. These security issues have been fixed: * SigComp UDVM buffer overflow (CVE-2014-8710). * AMQP dissector crash (CVE-2014-8711). * NCP dissector crashes (CVE-2014-8712, CVE-2014-8713). * TN5250 infinite loops (CVE-2014-8714). This non-security issue has been fixed: * enable zlib (bnc#899303). Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.11.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.11.html> Security Issues: * CVE-2014-8711 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8711> * CVE-2014-8710 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8710> * CVE-2014-8714 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8714> * CVE-2014-8712 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8712> * CVE-2014-8713 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8713> SUSE bug 899303 SUSE bug 905245 SUSE bug 905246 SUSE bug 905247 SUSE bug 905248 CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Wireshark has been updated to 1.12.7. (FATE#319388) The following vulnerabilities have been fixed: * Wireshark could crash when adding an item to the protocol tree. wnpa-sec-2015-21 CVE-2015-6241 * Wireshark could attempt to free invalid memory. wnpa-sec-2015-22 CVE-2015-6242 * Wireshark could crash when searching for a protocol dissector. wnpa-sec-2015-23 CVE-2015-6243 * The ZigBee dissector could crash. wnpa-sec-2015-24 CVE-2015-6244 * The GSM RLC/MAC dissector could go into an infinite loop. wnpa-sec-2015-25 CVE-2015-6245 * The WaveAgent dissector could crash. wnpa-sec-2015-26 CVE-2015-6246 * The OpenFlow dissector could go into an infinite loop. wnpa-sec-2015-27 CVE-2015-6247 * Wireshark could crash due to invalid ptvcursor length checking. wnpa-sec-2015-28 CVE-2015-6248 * The WCCP dissector could crash. wnpa-sec-2015-29 CVE-2015-6249 * Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html Also a fix from 1.12.6 in GSM DTAP was backported. (bnc#935158 CVE-2015-4652) Moderate SUSE bug 935158 SUSE bug 941500 CVE-2015-3813 CVE-2015-4652 CVE-2015-6241 CVE-2015-6242 CVE-2015-6243 CVE-2015-6244 CVE-2015-6245 CVE-2015-6246 CVE-2015-6247 CVE-2015-6248 CVE-2015-6249 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update contains Wireshark 1.12.9 and fixes the following issues: * CVE-2015-7830: pcapng file parser could crash while copying an interface filter (bsc#950437) * CVE-2015-8711: epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet. * CVE-2015-8712: The dissect_hsdsch_channel_info function in epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not validate the number of PDUs, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8713: epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet. * CVE-2015-8714: The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8715: epan/dissectors/packet-alljoyn.c in the AllJoyn dissector in Wireshark 1.12.x before 1.12.9 does not check for empty arguments, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. * CVE-2015-8716: The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8717: The dissect_sdp function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.12.x before 1.12.9 does not prevent use of a negative media count, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8718: Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1, when the "Match MSG/RES packets for async NLM" option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8719: The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet option, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8720: The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. * CVE-2015-8721: Buffer overflow in the tvb_uncompress function in epan/tvbuff_zlib.c in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet with zlib compression. * CVE-2015-8722: epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet. * CVE-2015-8723: The AirPDcapPacketProcess function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationship between the total length and the capture length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted * CVE-2015-8724: The AirPDcapDecryptWPABroadcastKey function in epan/crypt/airpdcap.c in the 802.11 dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not verify the WPA broadcast key length, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. * CVE-2015-8725: The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the IPv6 prefix length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. * CVE-2015-8726: wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. * CVE-2015-8727: The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet. * CVE-2015-8728: The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly uses the tvb_bcd_dig_to_wmem_packet_str function, which allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted packet. * CVE-2015-8729: The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presence of a '\0' character at the end of a date string, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. * CVE-2015-8730: epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the number of items, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted packet. * CVE-2015-8731: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not reject unknown TLV types, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. * CVE-2015-8732: The dissect_zcl_pwr_prof_pwrprofstatersp function in epan/dissectors/packet-zbee-zcl-general.c in the ZigBee ZCL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the Total Profile Number field, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. * CVE-2015-8733: The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. Low SUSE bug 950437 SUSE bug 960382 CVE-2015-7830 CVE-2015-8711 CVE-2015-8712 CVE-2015-8713 CVE-2015-8714 CVE-2015-8715 CVE-2015-8716 CVE-2015-8717 CVE-2015-8718 CVE-2015-8719 CVE-2015-8720 CVE-2015-8721 CVE-2015-8722 CVE-2015-8723 CVE-2015-8724 CVE-2015-8725 CVE-2015-8726 CVE-2015-8727 CVE-2015-8728 CVE-2015-8729 CVE-2015-8730 CVE-2015-8731 CVE-2015-8732 CVE-2015-8733 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to Wireshark 1 12.11 fixes a number issues in protocol dissectors that could have allowed a remote attacker to crash Wireshark or cause excessive CPU usage through specially crafted packages inserted into the network or a capture file. - The PKTC dissector could crash (wnpa-sec-2016-22) - The PKTC dissector could crash (wnpa-sec-2016-23) - The IAX2 dissector could go into an infinite loop (wnpa-sec-2016-24) - Wireshark and TShark could exhaust the stack (wnpa-sec-2016-25) - The GSM CBCH dissector could crash (wnpa-sec-2016-26) - The NCP dissector could crash (wnpa-sec-2016-28) - CVE-2016-2523: DNP dissector infinite loop (wnpa-sec-2016-03) - CVE-2016-2530: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2531: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2532: LLRP dissector crash (wnpa-sec-2016-11) - GSM A-bis OML dissector crash (wnpa-sec-2016-14) - ASN.1 BER dissector crash (wnpa-sec-2016-15) - ASN.1 BER dissector crash (wnpa-sec-2016-18) Also containsfurther bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.11.html https://www.wireshark.org/docs/relnotes/wireshark-1.12.10.html Moderate SUSE bug 968565 SUSE bug 976944 CVE-2016-2523 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 SUSE Linux Enterprise Server 11 SP3-TERADATA This update to wireshark 1.12.13 fixes the following issues: - CVE-2016-6504: wireshark: NDS dissector crash (bsc#991012) - CVE-2016-6505: wireshark: PacketBB dissector could divide by zero (bsc#991013) - CVE-2016-6506: wireshark: WSP infinite loop (bsc#991015) - CVE-2016-6507: wireshark: MMSE infinite loop (bsc#991016) - CVE-2016-6508: wireshark: RLC long loop (bsc#991017) - CVE-2016-6509: wireshark: LDSS dissector crash (bsc#991018) - CVE-2016-6510: wireshark: RLC dissector crash (bsc#991019) - CVE-2016-6511: wireshark: OpenFlow long loop (bnc991020) - CVE-2016-5350: SPOOLS infinite loop (bsc#983671) - CVE-2016-5351: IEEE 802.11 dissector crash (bsc#983671) - CVE-2016-5352: IEEE 802.11 dissector crash, different from wpna-sec-2016-30 (bsc#983671) - CVE-2016-5353: UMTS FP crash (bsc#983671) - CVE-2016-5354: USB dissector crash (bsc#983671) - CVE-2016-5355: Toshiba file parser crash (bsc#983671) - CVE-2016-5356: CoSine file parser crash (bsc#983671) - CVE-2016-5357: NetScreen file parser crash (bsc#983671) - CVE-2016-5358: Ethernet dissector crash (bsc#983671) - CVE-2016-5359: WBXML infinite loop (bsc#983671) For more details please see: https://www.wireshark.org/docs/relnotes/wireshark-1.12.12.html https://www.wireshark.org/docs/relnotes/wireshark-1.12.13.html Moderate SUSE bug 983671 SUSE bug 991012 SUSE bug 991013 SUSE bug 991015 SUSE bug 991016 SUSE bug 991017 SUSE bug 991018 SUSE bug 991019 SUSE bug 991020 CVE-2016-5350 CVE-2016-5351 CVE-2016-5352 CVE-2016-5353 CVE-2016-5354 CVE-2016-5355 CVE-2016-5356 CVE-2016-5357 CVE-2016-5358 CVE-2016-5359 CVE-2016-6504 CVE-2016-6505 CVE-2016-6506 CVE-2016-6507 CVE-2016-6508 CVE-2016-6509 CVE-2016-6510 CVE-2016-6511 SUSE Linux Enterprise Server 11 SP3-TERADATA Wireshark was updated to version 2.0.12, which brings several new features, enhancements and bug fixes. These security issues were fixed: - CVE-2017-7700: In Wireshark the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by ensuring a nonzero record size (bsc#1033936). - CVE-2017-7701: In Wireshark the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type (bsc#1033937). - CVE-2017-7702: In Wireshark the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation (bsc#1033938). - CVE-2017-7703: In Wireshark the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly (bsc#1033939). - CVE-2017-7704: In Wireshark the DOF dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dof.c by using a different integer data type and adjusting a return value (bsc#1033940). - CVE-2017-7705: In Wireshark the RPC over RDMA dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rpcrdma.c by correctly checking for going beyond the maximum offset (bsc#1033941). - CVE-2017-7745: In Wireshark the SIGCOMP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-sigcomp.c by correcting a memory-size check (bsc#1033942). - CVE-2017-7746: In Wireshark the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length (bsc#1033943). - CVE-2017-7747: In Wireshark the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-packetbb.c by restricting additions to the protocol tree (bsc#1033944). - CVE-2017-7748: In Wireshark the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check (bsc#1033945). - CVE-2016-7179: Stack-based buffer overflow in epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark allowed remote attackers to cause a denial of service (application crash) via a crafted packet (bsc#998963). - CVE-2016-9376: In Wireshark the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c by ensuring that certain length values were sufficiently large (bsc#1010735). - CVE-2016-9375: In Wireshark the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful (bsc#1010740). - CVE-2016-9374: In Wireshark the AllJoyn dissector could crash with a buffer over-read, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable (bsc#1010752). - CVE-2016-9373: In Wireshark the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings (bsc#1010754). - CVE-2016-7175: epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark mishandled MAC address data, which allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet (bsc#998761). - CVE-2016-7176: epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark called snprintf with one of its input buffers as the output buffer, which allowed remote attackers to cause a denial of service (copy overlap and application crash) via a crafted packet (bsc#998762). - CVE-2016-7177: epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark did not restrict the number of channels, which allowed remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet (bsc#998763). - CVE-2016-7180: epan/dissectors/packet-ipmi-trace.c in the IPMI trace dissector in Wireshark did not properly consider whether a string is constant, which allowed remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet (bsc#998800). - CVE-2016-7178: epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark did not ensure that memory is allocated for certain data structures, which allowed remote attackers to cause a denial of service (invalid write access and application crash) via a crafted packet (bsc#998964). - CVE-2017-6014: In Wireshark a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory (bsc#1025913). - CVE-2017-5596: In Wireshark the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow (bsc#1021739). - CVE-2017-5597: In Wireshark the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow (bsc#1021739). Moderate SUSE bug 1002981 SUSE bug 1010735 SUSE bug 1010740 SUSE bug 1010752 SUSE bug 1010754 SUSE bug 1010911 SUSE bug 1021739 SUSE bug 1025913 SUSE bug 1027998 SUSE bug 1033936 SUSE bug 1033937 SUSE bug 1033938 SUSE bug 1033939 SUSE bug 1033940 SUSE bug 1033941 SUSE bug 1033942 SUSE bug 1033943 SUSE bug 1033944 SUSE bug 1033945 SUSE bug 998761 SUSE bug 998762 SUSE bug 998763 SUSE bug 998800 SUSE bug 998963 SUSE bug 998964 CVE-2016-7175 CVE-2016-7176 CVE-2016-7177 CVE-2016-7178 CVE-2016-7179 CVE-2016-7180 CVE-2016-9373 CVE-2016-9374 CVE-2016-9375 CVE-2016-9376 CVE-2017-5596 CVE-2017-5597 CVE-2017-6014 CVE-2017-7700 CVE-2017-7701 CVE-2017-7702 CVE-2017-7703 CVE-2017-7704 CVE-2017-7705 CVE-2017-7745 CVE-2017-7746 CVE-2017-7747 CVE-2017-7748 SUSE Linux Enterprise Server 11 SP3-TERADATA The network analysis tool wireshark was updated to version 2.0.13 to fix the following issues: * CVE-2017-9352: Bazaar dissector infinite loop (wnpa-sec-2017-22) (bsc#1042304) * CVE-2017-9348: DOF dissector read overflow (wnpa-sec-2017-23) (bsc#1042303) * CVE-2017-9351: DHCP dissector read overflow (wnpa-sec-2017-24) (bsc#1042302) * CVE-2017-9346: SoulSeek dissector infinite loop (wnpa-sec-2017-25) (bsc#1042301) * CVE-2017-9345: DNS dissector infinite loop (wnpa-sec-2017-26) (bsc#1042300) * CVE-2017-9349: DICOM dissector infinite loop (wnpa-sec-2017-27) (bsc#1042305) * CVE-2017-9350: openSAFETY dissector memory exh.. (wnpa-sec-2017-28) (bsc#1042299) * CVE-2017-9344: BT L2CAP dissector divide by zero (wnpa-sec-2017-29) (bsc#1042298) * CVE-2017-9343: MSNIP dissector crash (wnpa-sec-2017-30) (bsc#1042309) * CVE-2017-9347: ROS dissector crash (wnpa-sec-2017-31) (bsc#1042308) * CVE-2017-9354: RGMP dissector crash (wnpa-sec-2017-32) (bsc#1042307) * CVE-2017-9353: wireshark: IPv6 dissector crash (wnpa-sec-2017-33) (bsc#1042306) Moderate SUSE bug 1042298 SUSE bug 1042299 SUSE bug 1042300 SUSE bug 1042301 SUSE bug 1042302 SUSE bug 1042303 SUSE bug 1042304 SUSE bug 1042305 SUSE bug 1042306 SUSE bug 1042307 SUSE bug 1042308 SUSE bug 1042309 CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 SUSE Linux Enterprise Server 11 SP3-TERADATA This wireshark update to version 2.2.8 fixes the following issues: Security issues fixed: - CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621) - CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255) - CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255) - CVE-2017-11407: The MQ dissector could crash. (bsc#1049255) - CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255) Moderate SUSE bug 1049255 SUSE bug 1049621 CVE-2017-11406 CVE-2017-11407 CVE-2017-11408 CVE-2017-11410 CVE-2017-11411 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark to version 2.2.11 fixes several issues. These security issues were fixed: - CVE-2017-13767: The MSDP dissector could have gone into an infinite loop. This was addressed by adding length validation (bsc#1056248) - CVE-2017-13766: The Profinet I/O dissector could have crash with an out-of-bounds write. This was addressed by adding string validation (bsc#1056249) - CVE-2017-13765: The IrCOMM dissector had a buffer over-read and application crash. This was addressed by adding length validation (bsc#1056251) - CVE-2017-9766: PROFINET IO data with a high recursion depth allowed remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function (bsc#1045341) - CVE-2017-9617: Deeply nested DAAP data may have cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in the DAAP dissector (bsc#1044417) - CVE-2017-15192: The BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level. (bsc#1062645) - CVE-2017-15193: The MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach. (bsc#1062645) - CVE-2017-15191: The DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length. (bsc#1062645) - CVE-2017-17083: NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer. (bsc#1070727) - CVE-2017-17084: IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length. (bsc#1070727) - CVE-2017-17085: the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length. (bsc#1070727) Moderate SUSE bug 1044417 SUSE bug 1045341 SUSE bug 1056248 SUSE bug 1056249 SUSE bug 1056251 SUSE bug 1062645 SUSE bug 1070727 CVE-2017-13765 CVE-2017-13766 CVE-2017-13767 CVE-2017-15191 CVE-2017-15192 CVE-2017-15193 CVE-2017-17083 CVE-2017-17084 CVE-2017-17085 CVE-2017-9617 CVE-2017-9766 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark to version 2.2.12 fixes the following issues: - CVE-2018-5334: IxVeriWave file could crash (bsc#1075737) - CVE-2018-5335: WCP dissector could crash (bsc#1075738) - CVE-2018-5336: Multiple dissector crashes (bsc#1075739) - CVE-2017-17935: Incorrect handling of "\n" in file_read_line function could have lead to denial of service (bsc#1074171) This release no longer enables the Linux kernel BPF JIT compiler via the net.core.bpf_jit_enable sysctl, as this would make systems more vulnerable to Spectre variant 1 CVE-2017-5753 - (bsc#1075748) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.12.html Moderate SUSE bug 1074171 SUSE bug 1075737 SUSE bug 1075738 SUSE bug 1075739 SUSE bug 1075748 CVE-2017-17935 CVE-2018-5334 CVE-2018-5335 CVE-2018-5336 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark fixes the following issues: Security issue fixed (bsc#1082692): - CVE-2018-7335: The IEEE 802.11 dissector could crash (wnpa-sec-2018-05) - CVE-2018-7321: thrift long dissector loop (dissect_thrift_map) - CVE-2018-7322: DICOM: inifinite loop (dissect_dcm_tag) - CVE-2018-7323: WCCP: very long loop (dissect_wccp2_alternate_mask_value_set_element) - CVE-2018-7324: SCCP: infinite loop (dissect_sccp_optional_parameters) - CVE-2018-7325: RPKI-Router Protocol: infinite loop (dissect_rpkirtr_pdu) - CVE-2018-7326: LLTD: infinite loop (dissect_lltd_tlv) - CVE-2018-7327: openflow_v6: infinite loop (dissect_openflow_bundle_control_v6) - CVE-2018-7328: USB-DARWIN: long loop (dissect_darwin_usb_iso_transfer) - CVE-2018-7329: S7COMM: infinite loop (s7comm_decode_ud_cpu_alarm_main) - CVE-2018-7330: thread_meshcop: infinite loop (get_chancount) - CVE-2018-7331: GTP: infinite loop (dissect_gprscdr_GGSNPDPRecord, dissect_ber_set) - CVE-2018-7332: RELOAD: infinite loop (dissect_statans) - CVE-2018-7333: RPCoRDMA: infinite loop in get_write_list_chunk_count - CVE-2018-7421: Multiple dissectors could go into large infinite loops (wnpa-sec-2018-06) - CVE-2018-7334: The UMTS MAC dissector could crash (wnpa-sec-2018-07) - CVE-2018-7337: The DOCSIS dissector could crash (wnpa-sec-2018-08) - CVE-2018-7336: The FCP dissector could crash (wnpa-sec-2018-09) - CVE-2018-7320: The SIGCOMP dissector could crash (wnpa-sec-2018-10) - CVE-2018-7420: The pcapng file parser could crash (wnpa-sec-2018-11) - CVE-2018-7417: The IPMI dissector could crash (wnpa-sec-2018-12) - CVE-2018-7418: The SIGCOMP dissector could crash (wnpa-sec-2018-13) - CVE-2018-7419: The NBAP disssector could crash (wnpa-sec-2018-14) - CVE-2017-17997: Misuse of NULL pointer in MRDISC dissector (bsc#1077080). Moderate SUSE bug 1077080 SUSE bug 1082692 CVE-2017-17997 CVE-2018-7320 CVE-2018-7321 CVE-2018-7322 CVE-2018-7323 CVE-2018-7324 CVE-2018-7325 CVE-2018-7326 CVE-2018-7327 CVE-2018-7328 CVE-2018-7329 CVE-2018-7330 CVE-2018-7331 CVE-2018-7332 CVE-2018-7333 CVE-2018-7334 CVE-2018-7335 CVE-2018-7336 CVE-2018-7337 CVE-2018-7417 CVE-2018-7418 CVE-2018-7419 CVE-2018-7420 CVE-2018-7421 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark fixes the following issues: - Update to wireshark 2.2.14, fix such issues: * bsc#1088200 VUL-0: wireshark: multiple vulnerabilities fixed in 2.2.14, 2.4.6 * CVE-2018-9256: LWAPP dissector crash * CVE-2018-9260: IEEE 802.15.4 dissector crash * CVE-2018-9261: NBAP dissector crash * CVE-2018-9262: VLAN dissector crash * CVE-2018-9263: Kerberos dissector crash * CVE-2018-9264: ADB dissector crash * CVE-2018-9265: tn3270 dissector has a memory leak * CVE-2018-9266: ISUP dissector memory leak * CVE-2018-9267: LAPD dissector memory leak * CVE-2018-9268: SMB2 dissector memory leak * CVE-2018-9269: GIOP dissector memory leak * CVE-2018-9270: OIDS dissector memory leak * CVE-2018-9271: multipart dissector memory leak * CVE-2018-9272: h223 dissector memory leak * CVE-2018-9273: pcp dissector memory leak * CVE-2018-9274: failure message memory leak * CVE-2018-9259: MP4 dissector crash Moderate SUSE bug 1088200 CVE-2018-9256 CVE-2018-9259 CVE-2018-9260 CVE-2018-9261 CVE-2018-9262 CVE-2018-9263 CVE-2018-9264 CVE-2018-9265 CVE-2018-9266 CVE-2018-9267 CVE-2018-9268 CVE-2018-9269 CVE-2018-9270 CVE-2018-9271 CVE-2018-9272 CVE-2018-9273 CVE-2018-9274 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark fixes the following issues: Security issues fixed: - bsc#1094301: Wireshark security update to 2.6.1, 2.4.7, 2.2.15 - CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, bsc#1101810) - CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, bsc#1101776) - CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, bsc#1101786) - CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, bsc#1101788) - CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, bsc#1101804) - CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, bsc#1101777) - CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, bsc#1101802) - CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, bsc#1101800) - CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, bsc#1101791) - CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, bsc#1101794) - CVE-2018-11355: Fix RTCP dissector crash (bsc#1094301). - CVE-2018-11362: Fix LDSS dissector crash (bsc#1094301). - CVE-2018-11361: Fix IEEE 802.11 dissector crash (bsc#1094301). - CVE-2018-11360: Fix GSM A DTAP dissector crash (bsc#1094301). - CVE-2018-11358: Fix Q.931 dissector crash (bsc#1094301). - CVE-2018-11359: Fix multiple dissectors crashs (bsc#1094301). - CVE-2018-11356: Fix DNS dissector crash (bsc#1094301). - CVE-2018-11357: Fix multiple dissectors that could consume excessive memory (bsc#1094301). - CVE-2018-11354: Fix IEEE 1905.1a dissector crash (bsc#1094301). Moderate SUSE bug 1094301 SUSE bug 1101776 SUSE bug 1101777 SUSE bug 1101786 SUSE bug 1101788 SUSE bug 1101791 SUSE bug 1101794 SUSE bug 1101800 SUSE bug 1101802 SUSE bug 1101804 SUSE bug 1101810 CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 CVE-2018-14339 CVE-2018-14340 CVE-2018-14341 CVE-2018-14342 CVE-2018-14343 CVE-2018-14344 CVE-2018-14367 CVE-2018-14368 CVE-2018-14369 CVE-2018-14370 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wireshark fixes the following issues: Update wireshark to version 2.2.17 (bsc#1106514): Security issues fixed: - CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44) - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45) - CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.17.html Moderate SUSE bug 1106514 CVE-2018-16056 CVE-2018-16057 CVE-2018-16058 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes a remote code execution vulnerability in wpa_supplicant's wpa_cli and hostapd_cli tools. CVE-2014-3686 has been assigned to this issue. Additionally, password based authentication with PKCS#5v2 has been enabled. Security Issues: * CVE-2014-3686 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3686> SUSE bug 868937 SUSE bug 900611 CVE-2014-3686 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA wpa_supplicant was updated to fix two security issues. These security issues were fixed: - CVE-2015-4142: Integer underflow in the WMM Action frame parser in hostapd and wpa_supplicant, when used for AP mode MLME/SME functionality, allowed remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read (bsc#930078). - CVE-2015-4141: The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), allowed remote attackers to cause a denial of service (crash) via a negative chunk length, which triggered an out-of-bounds read or heap-based buffer overflow (bsc#930077). Moderate SUSE bug 930077 SUSE bug 930078 CVE-2015-4141 CVE-2015-4142 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wpa_supplicant fixes the following issues: - Several vulnerabilities in standard conforming implementations of the WPA2 protocol have been discovered and published under the code name KRACK. This update remedies those issues in a backwards compatible manner, i.e. the updated wpa_supplicant can interface properly with both vulnerable and patched implementations of WPA2, but an attacker won't be able to exploit the KRACK weaknesses in those connections anymore even if the other party is still vulnerable. [bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088] Important SUSE bug 1056061 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13087 CVE-2017-13088 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for wpa_supplicant fixes the following issues: Security issue fixed: - CVE-2015-0210: Fix broken certificate subject check (bsc#915323.) Moderate SUSE bug 915323 CVE-2015-0210 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xalan-j2 has been updated to ensure that secure processing can't be circumvented (CVE-2014-0107). Security Issues: * CVE-2014-0107 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0107> SUSE bug 870082 CVE-2014-0107 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Xen was updated to fix two security issues and a bug: * CVE-2015-3456: A buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. * CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. * An exception in setCPUAffinity when restoring guests. (bsc#910441) Security Issues: * CVE-2015-3456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456> * CVE-2015-3340 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340> SUSE bug 910441 SUSE bug 927967 SUSE bug 929339 CVE-2015-3456 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Xen has been updated to version 4.2.5 with additional patches to fix six security issues: * Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling (CVE-2014-9030). * Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (CVE-2014-8867). * Excessive checking in compatibility mode hypercall argument translation (CVE-2014-8866). * Guest user mode triggerable VM exits not handled by hypervisor (bnc#903850). * Missing privilege level checks in x86 emulation of far branches (CVE-2014-8595). * Insufficient restrictions on certain MMU update hypercalls (CVE-2014-8594). These non-security issues have been fixed: * Xen save/restore of HVM guests cuts off disk and networking (bnc#866902). * Windows 2012 R2 fails to boot up with greater than 60 vcpus (bnc#882089). * Increase limit domUloader to 32MB (bnc#901317). * Adjust xentop column layout (bnc#896023). Security Issues: * CVE-2014-9030 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9030> * CVE-2014-8867 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8867> * CVE-2014-8866 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8866> * CVE-2014-8595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8595> * CVE-2014-8594 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8594> SUSE bug 866902 SUSE bug 882089 SUSE bug 896023 SUSE bug 901317 SUSE bug 903850 SUSE bug 903967 SUSE bug 903970 SUSE bug 905465 SUSE bug 905467 SUSE bug 906439 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xen was updated to fix the following security issues: * CVE-2015-5165: QEMU leak of uninitialized heap memory in rtl8139 device model (bsc#939712, XSA-140) * CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol (bsc#939709, XSA-139) * CVE-2015-2751: Certain domctl operations could have be used to lock up the host (bsc#922709, XSA-127) * CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137) * CVE-2015-4164: DoS through iret hypercall handler (bsc#932996, XSA-136) * CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344) Important SUSE bug 922709 SUSE bug 932996 SUSE bug 935634 SUSE bug 938344 SUSE bug 939709 SUSE bug 939712 CVE-2015-2751 CVE-2015-3259 CVE-2015-4164 CVE-2015-5154 CVE-2015-5165 CVE-2015-5166 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xen was updated to fix nine security issues. These security issues were fixed: - CVE-2015-4037: The slirp_smb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program (bsc#932267). - CVE-2014-0222: Integer overflow in the qcow_open function allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642). - CVE-2015-7835: Uncontrolled creation of large page mappings by PV guests (bsc#950367). - CVE-2015-7311: libxl in Xen did not properly handle the readonly flag on disks when using the qemu-xen device model, which allowed local guest users to write to a read-only disk image (bsc#947165). - CVE-2015-5239: Integer overflow in vnc_client_read() and protocol_client_msg() (bsc#944463). - CVE-2015-6815: With e1000 NIC emulation support it was possible to enter an infinite loop (bsc#944697). - CVE-2015-7969: Leak of main per-domain vcpu pointer array leading to denial of service (bsc#950703). - CVE-2015-7969: Leak of per-domain profiling- related vcpu pointer array leading to denial of service (bsc#950705). - CVE-2015-7971: Some pmu and profiling hypercalls log without rate limiting (bsc#950706). These non-security issues were fixed: - bsc#907514: Bus fatal error: SLES 12 sudden reboot has been observed - bsc#910258: SLES12 Xen host crashes with FATAL NMI after shutdown of guest with VT-d NIC - bsc#918984: Bus fatal error: SLES11-SP4 sudden reboot has been observed - bsc#923967: Partner-L3: Bus fatal error: SLES11-SP3 sudden reboot has been observed - bsc#941074: Device 51728 could not be connected. Hotplug scripts not working Important SUSE bug 877642 SUSE bug 907514 SUSE bug 910258 SUSE bug 918984 SUSE bug 923967 SUSE bug 932267 SUSE bug 941074 SUSE bug 944463 SUSE bug 944697 SUSE bug 947165 SUSE bug 950367 SUSE bug 950703 SUSE bug 950705 SUSE bug 950706 CVE-2014-0222 CVE-2015-4037 CVE-2015-5239 CVE-2015-6815 CVE-2015-7311 CVE-2015-7835 CVE-2015-7969 CVE-2015-7971 SUSE Linux Enterprise Server 11 SP3-LTSS xen was updated to fix 36 security issues. These security issues were fixed: - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bnc#864673). - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bnc#864678). - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bnc#864682). - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655). - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#864811). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642). - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#897654). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737). - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989). - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162). - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829). - CVE-2015-8504: VNC: floating point exception (bsc#958491). - CVE-2015-8550: Paravirtualized drivers were incautious about shared memory contents (XSA-155) (bsc#957988). - CVE-2015-8554: qemu-dm buffer overrun in MSI-X handling (XSA-164) (bsc#958007). - CVE-2015-8555: Information leak in legacy x86 FPU/XMM initialization (XSA-165) (bsc#958009). - CVE-2015-8558: Infinite loop in ehci_advance_state resulted in DoS (bsc#959005). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1571: VMX: intercept issue with INVLPG on non-canonical address (XSA-168) (bsc#960862). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782). - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315). - CVE-2016-2271: VMX when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013). - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012). - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969). - CVE-2016-2841: ne2000: Infinite loop in ne2000_receive (bsc#969350). - XSA-166: ioreq handling possibly susceptible to multiple read issue (bsc#958523). These non-security issues were fixed: - bsc#954872: script block-dmmd not working as expected - bsc#959695: Missing docs for xen - bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend - bsc#959928: When DomU is in state running xm domstate returned nothing Important SUSE bug 864391 SUSE bug 864655 SUSE bug 864673 SUSE bug 864678 SUSE bug 864682 SUSE bug 864769 SUSE bug 864805 SUSE bug 864811 SUSE bug 877642 SUSE bug 897654 SUSE bug 901508 SUSE bug 902737 SUSE bug 928393 SUSE bug 945404 SUSE bug 945989 SUSE bug 954872 SUSE bug 956829 SUSE bug 957162 SUSE bug 957988 SUSE bug 958007 SUSE bug 958009 SUSE bug 958491 SUSE bug 958523 SUSE bug 959005 SUSE bug 959695 SUSE bug 959928 SUSE bug 960707 SUSE bug 960725 SUSE bug 960861 SUSE bug 960862 SUSE bug 961332 SUSE bug 961691 SUSE bug 963782 SUSE bug 965315 SUSE bug 965317 SUSE bug 967012 SUSE bug 967013 SUSE bug 967630 SUSE bug 967969 SUSE bug 969350 CVE-2013-4527 CVE-2013-4529 CVE-2013-4530 CVE-2013-4533 CVE-2013-4534 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3640 CVE-2014-3689 CVE-2014-7815 CVE-2014-9718 CVE-2015-5278 CVE-2015-6855 CVE-2015-7512 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8743 CVE-2015-8745 CVE-2016-1568 CVE-2016-1570 CVE-2016-1571 CVE-2016-1714 CVE-2016-1981 CVE-2016-2270 CVE-2016-2271 CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-5403: Unbounded memory allocation allowed a guest administrator to cause a denial of service of the host (bsc#990923) - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960) - CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225) - CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224) - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264) - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724) - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716) - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue (bsc#978164) - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295) - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038) - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188) - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130) - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138) These non-security issues were fixed: - bsc#985503: vif-route broken - bsc#978413: PV guest upgrade from sles11sp4 to sles12sp2 alpha3 failed on sles11sp4 xen host. - bsc#954872: Script block-dmmd not working as expected - libxl: error: libxl_dm.c (another modification) - bsc#961600: Poor performance when Xen HVM domU configured with max memory > current memory - bsc#963161: Windows VM getting stuck during load while a VF is assigned to it after upgrading to latest maintenance updates - bsc#976470: Xend fails to start - bsc#973631: AWS EC2 kdump issue Important SUSE bug 954872 SUSE bug 961600 SUSE bug 963161 SUSE bug 973188 SUSE bug 973631 SUSE bug 974038 SUSE bug 975130 SUSE bug 975138 SUSE bug 976470 SUSE bug 978164 SUSE bug 978295 SUSE bug 978413 SUSE bug 980716 SUSE bug 980724 SUSE bug 981264 SUSE bug 982224 SUSE bug 982225 SUSE bug 982960 SUSE bug 983984 SUSE bug 985503 SUSE bug 988675 SUSE bug 990843 SUSE bug 990923 SUSE bug 995785 SUSE bug 995792 CVE-2014-3615 CVE-2014-3672 CVE-2016-3158 CVE-2016-3159 CVE-2016-3710 CVE-2016-3712 CVE-2016-3960 CVE-2016-4001 CVE-2016-4002 CVE-2016-4439 CVE-2016-4441 CVE-2016-4453 CVE-2016-4454 CVE-2016-4480 CVE-2016-5238 CVE-2016-5338 CVE-2016-5403 CVE-2016-6258 CVE-2016-6351 CVE-2016-7092 CVE-2016-7094 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652) - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103) - CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107) - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109) - CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106) - CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157) - CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160) - CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004) - CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005) - CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030) - CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032) This non-security issue was fixed: - bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit Important SUSE bug 1000106 SUSE bug 1000893 SUSE bug 1003030 SUSE bug 1003032 SUSE bug 1005004 SUSE bug 1005005 SUSE bug 1007157 SUSE bug 1007160 SUSE bug 1009100 SUSE bug 1009103 SUSE bug 1009107 SUSE bug 1009109 SUSE bug 1009111 SUSE bug 1011652 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9386 CVE-2016-9637 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2014-3615: The VGA emulator in QEMU allowed local guest users to read host memory by setting the display to a high resolution (bsc#895528). - CVE-2016-3712: Integer overflow in the VGA module allowed local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode (bsc#978160). - CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106) - CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030) - CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032) - CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004) - CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005) - CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160) - CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157) - CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111) - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109) - CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103) - CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107) - CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100) - CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652) - CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295) - CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675) - CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792) - CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785) - CVE-2016-5403: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion (boo#990923) - CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843) - CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer (bsc#983984) - CVE-2016-5238: The get_cmd function in hw/scsi/esp.c in QEMU allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960) - CVE-2016-4453: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225) - CVE-2016-4454: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read (bsc#982224) - CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264) - CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724) - CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716) - CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue (bsc#978164) - CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038) - CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188) - CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188) - CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130) - CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138) - CVE-2016-2841: The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control (bsc#969351) - CVE-2016-2538: Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) allowed local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function (bsc#968004). - CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers (bsc#967101) - CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU did not properly validate USB configuration descriptor objects, which allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet (bsc#967090) - CVE-2016-2270: Xen allowed local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings (bsc#965315) - CVE-2016-2271: VMX in Xen, when using an Intel or Cyrix CPU, allowed local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP (bsc#965317) - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#965156). - CVE-2014-3640: The sosendto function in slirp/udp.c allowed local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket (bsc#965112) - CVE-2013-4529: Buffer overflow in hw/pci/pcie_aer.c allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image (bsc#964929). - CVE-2015-5278: Infinite loop in ne2000_receive() function allowed a privileged user inside the guest to crash the Qemu instance resulting in DoS (bsc#964947) - CVE-2013-4530: Buffer overflow in hw/ssi/pl022.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image (bsc#964950). - CVE-2015-8345: The i8255x (PRO100) emulation support was vulnerable to an infinite loop issue that allowed a privileged (CAP_SYS_RAWIO) user inside guest to crash the Qemu instance resulting in DoS (bsc#956832) - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#964644) - CVE-2013-4527: Buffer overflow in hw/timer/hpet.c might have allowed remote attackers to execute arbitrary code via vectors related to the number of timers (bsc#964746). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#964925) - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#964431). - CVE-2013-4534: Buffer overflow in hw/intc/openpic.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements (bsc#964452) - CVE-2016-1981: A:infinite loop in start_xmit and e1000_receive_iov routines allowed a privileged user inside the guest to crash the Qemu instance resulting in DoS (bsc#963783) - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#962758) - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#962642) - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#962627) - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#962611) - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#962335) - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#962360) - CVE-2016-1714: The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c when built with the Firmware Configuration device emulation support, allowed guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration (bsc#961692) - CVE-2016-1568: Use-after-free vulnerability in hw/ide/ahci.c, when built with IDE AHCI Emulation support, allowed guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command (bsc#961332). - CVE-2016-1571: The paging_invlpg function in include/asm-x86/paging.h in Xen when using shadow mode paging or nested virtualization is enabled, allowed local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check (bsc#960862) - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2015-8743: A OOB memory access in ioport r/w functions allowed a privileged (CAP_SYS_RAWIO) user/process to use this flaw to leak or corrupt Qemu memory bytes (bsc#960726) - CVE-2015-8550: Xen, when used on a system providing PV backends, allowed local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability (bsc#957988) - CVE-2015-8558: The ehci_process_itd function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list (bsc#959006). - CVE-2015-8504: The VNC display driver support was vulnerable to an arithmetic exception flaw that allowed a privileged remote client to crash the guest resulting in DoS (bsc#958493) - CVE-2015-8554: Buffer overflow in hw/pt-msi.c in Xen, when using the qemu-xen-traditional (aka qemu-dm) device model, allowed local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." (bsc#958007) - CVE-2015-8555: Xen did not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allowed local guest domains to obtain sensitive information from other domains via unspecified vectors (bsc#958009) - CVE-2016-9932: CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. - CVE-2016-10013: A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. - bsc#958523: ioreq handling possibly susceptible to multiple read issue leading to DoS or worse, depending on the configuration - CVE-2016-10024: bsc#1014298: PV guests may have been able to mask interrupts causing a Denial of Service. These non-security issues were fixed: - bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit - bsc#954872: script block-dmmd not working as expected - bsc#959928: xm domstate - when DomU is in state running xm domstate returned nothing - bsc#959695: Added missing docs for xen - bsc#967630: Fixed discrepancy in reported memory size with correction XSA-153 for xend - bsc#963161: Windows VM was getting stuck during load while a VF was assigned to it - bsc#976470: Xend failed to start - bsc#961600: Fixed poor performance when Xen HVM domU configured with max memory greater than current memory - bsc#978413: PV guest upgrade from SLES11SP4 to SLES12SP2 alpha3 failed on SLES11SP4 xen host. - bsc#985503: vif-route broken Important SUSE bug 1000106 SUSE bug 1000893 SUSE bug 1003030 SUSE bug 1003032 SUSE bug 1005004 SUSE bug 1005005 SUSE bug 1007157 SUSE bug 1007160 SUSE bug 1009100 SUSE bug 1009103 SUSE bug 1009107 SUSE bug 1009109 SUSE bug 1009111 SUSE bug 1011652 SUSE bug 1012651 SUSE bug 1014298 SUSE bug 1016340 SUSE bug 895528 SUSE bug 954872 SUSE bug 956832 SUSE bug 957988 SUSE bug 958007 SUSE bug 958009 SUSE bug 958493 SUSE bug 958523 SUSE bug 959006 SUSE bug 959695 SUSE bug 959928 SUSE bug 960726 SUSE bug 960861 SUSE bug 960862 SUSE bug 961332 SUSE bug 961600 SUSE bug 961692 SUSE bug 962335 SUSE bug 962360 SUSE bug 962611 SUSE bug 962627 SUSE bug 962642 SUSE bug 962758 SUSE bug 963161 SUSE bug 963783 SUSE bug 964431 SUSE bug 964452 SUSE bug 964644 SUSE bug 964746 SUSE bug 964925 SUSE bug 964929 SUSE bug 964947 SUSE bug 964950 SUSE bug 965112 SUSE bug 965156 SUSE bug 965315 SUSE bug 965317 SUSE bug 967090 SUSE bug 967101 SUSE bug 967630 SUSE bug 968004 SUSE bug 969351 SUSE bug 973188 SUSE bug 973631 SUSE bug 974038 SUSE bug 975130 SUSE bug 975138 SUSE bug 976470 SUSE bug 978160 SUSE bug 978164 SUSE bug 978295 SUSE bug 978413 SUSE bug 980716 SUSE bug 980724 SUSE bug 981264 SUSE bug 982224 SUSE bug 982225 SUSE bug 982960 SUSE bug 983984 SUSE bug 985503 SUSE bug 988675 SUSE bug 990843 SUSE bug 990923 SUSE bug 995785 SUSE bug 995792 CVE-2013-4527 CVE-2013-4529 CVE-2013-4530 CVE-2013-4533 CVE-2013-4534 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3615 CVE-2014-3640 CVE-2014-3672 CVE-2014-3689 CVE-2014-7815 CVE-2014-9718 CVE-2015-5278 CVE-2015-6855 CVE-2015-7512 CVE-2015-8345 CVE-2015-8504 CVE-2015-8550 CVE-2015-8554 CVE-2015-8555 CVE-2015-8558 CVE-2015-8743 CVE-2016-10013 CVE-2016-10024 CVE-2016-1568 CVE-2016-1570 CVE-2016-1571 CVE-2016-1714 CVE-2016-1981 CVE-2016-2270 CVE-2016-2271 CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841 CVE-2016-3158 CVE-2016-3159 CVE-2016-3710 CVE-2016-3712 CVE-2016-3960 CVE-2016-4001 CVE-2016-4002 CVE-2016-4439 CVE-2016-4441 CVE-2016-4453 CVE-2016-4454 CVE-2016-4480 CVE-2016-5238 CVE-2016-5338 CVE-2016-5403 CVE-2016-6258 CVE-2016-6351 CVE-2016-7092 CVE-2016-7094 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9386 CVE-2016-9637 CVE-2016-9932 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-10013: Xen allowed local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation (bsc#1016340). - CVE-2016-9932: CMPXCHG8B emulation on x86 systems allowed local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix (bsc#1012651). - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-10024: Xen allowed local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations (bsc#1014298) This non-security issue was fixed: - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd Important SUSE bug 1002496 SUSE bug 1012651 SUSE bug 1013657 SUSE bug 1013668 SUSE bug 1014298 SUSE bug 1014507 SUSE bug 1015169 SUSE bug 1016340 SUSE bug 1022871 SUSE bug 1023004 SUSE bug 1024183 SUSE bug 1024834 SUSE bug 907805 CVE-2014-8106 CVE-2016-10013 CVE-2016-10024 CVE-2016-10155 CVE-2016-9101 CVE-2016-9776 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2016-9932 CVE-2017-2615 CVE-2017-2620 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) This non-security issue was fixed: - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd Important SUSE bug 1002496 SUSE bug 1013657 SUSE bug 1013668 SUSE bug 1014507 SUSE bug 1015169 SUSE bug 1022871 SUSE bug 1023004 SUSE bug 1024183 SUSE bug 1024834 SUSE bug 907805 CVE-2014-8106 CVE-2016-10155 CVE-2016-9101 CVE-2016-9776 CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 CVE-2017-2615 CVE-2017-2620 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes the following security issues: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). Important SUSE bug 1027570 SUSE bug 1028235 SUSE bug 1030442 CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes the following security issues: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). Important SUSE bug 1027570 SUSE bug 1028235 SUSE bug 1030442 CVE-2017-6414 CVE-2017-6505 CVE-2017-7228 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes the following security issues: - CVE-2017-7980: An out-of-bounds r/w access issues in the Cirrus CLGD 54xx VGA Emulator support allowed privileged user inside guest to use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on a host with privileges of Qemu process on the host (bsc#1035483). - A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch (XSA-213, bsc#1034843) - A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks because of a missing check when transfering pages via GNTTABOP_transfer (XSA-214, bsc#1034844). - Incorrect checks when handling exceptions allowed a malicious or buggy 64-bit PV guest to modify part of a physical memory page not belonging to it, potentially allowing for all of privilege escalation, host or other guest crashes, and information leaks (XSA-215, bsc#1034845) - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034994). - CVE-2017-7995: Incorrect address range validation potentially allowing PV guests to access MMIO memory with read side effects (bsc#1033948). - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655) Important SUSE bug 1028655 SUSE bug 1033948 SUSE bug 1034843 SUSE bug 1034844 SUSE bug 1034845 SUSE bug 1034994 SUSE bug 1035483 CVE-2016-9603 CVE-2017-7718 CVE-2017-7980 CVE-2017-7995 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several security issues: - A malicious 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch (XSA-213, bsc#1034843) - A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks because of a missing check when transfering pages via GNTTABOP_transfer (XSA-214, bsc#1034844). - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034994). - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655) Important SUSE bug 1028655 SUSE bug 1033948 SUSE bug 1034843 SUSE bug 1034844 SUSE bug 1034845 SUSE bug 1034994 SUSE bug 1035483 CVE-2016-9603 CVE-2017-7718 CVE-2017-7980 CVE-2017-7995 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes the following security issues: - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests (XSA-216, bsc#1042863) - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) - CVE-2017-8905: Xen a failsafe callback, which might have allowed PV guest OS users to execute arbitrary code on the host OS (XSA-215, bsc#1034845). Important SUSE bug 1034845 SUSE bug 1037243 SUSE bug 1042160 SUSE bug 1042863 SUSE bug 1042882 SUSE bug 1042893 SUSE bug 1042915 SUSE bug 1042931 SUSE bug 1042938 CVE-2017-8309 CVE-2017-8905 CVE-2017-9330 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes the following security issues: - blkif responses leaked backend stack data, which allowed unprivileged guest to obtain sensitive information from the host or other guests (XSA-216, bsc#1042863) - Page transfer might have allowed PV guest to elevate privilege (XSA-217, bsc#1042882) - Races in the grant table unmap code allowed for informations leaks and potentially privilege escalation (XSA-218, bsc#1042893) - Insufficient reference counts during shadow emulation allowed a malicious pair of guest to elevate their privileges to the privileges that XEN runs under (XSA-219, bsc#1042915) - Stale P2M mappings due to insufficient error checking allowed malicious guest to leak information or elevate privileges (XSA-222, bsc#1042931) - Grant table operations mishandled reference counts allowing malicious guests to escape (XSA-224, bsc#1042938) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042160) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037243) Important SUSE bug 1037243 SUSE bug 1042160 SUSE bug 1042863 SUSE bug 1042882 SUSE bug 1042893 SUSE bug 1042915 SUSE bug 1042931 SUSE bug 1042938 CVE-2017-8309 CVE-2017-9330 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787). - CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788). - CVE-2017-11334: The address_space_write_continue function in exec.c allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048920). - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578). - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046637). - CVE-2017-8905: Fixed a memory corruption via a failsafe callback, which might have allowed PV guest OS users to execute arbitrary code on the host OS (XSA-215, bsc#1034845). - CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to potentially leaking sensitive information (XSA-230, bsc#1052686). Important SUSE bug 1034845 SUSE bug 1046637 SUSE bug 1048920 SUSE bug 1049578 SUSE bug 1051787 SUSE bug 1051788 SUSE bug 1052686 CVE-2017-10664 CVE-2017-11334 CVE-2017-11434 CVE-2017-12135 CVE-2017-12137 CVE-2017-12855 CVE-2017-8905 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes the following issues: - CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to potentially leaking sensitive information (XSA-230, bsc#1052686). - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information (XSA-226, bsc#1051787). - CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for privilege escalation (XSA-227, bsc#1051788). - CVE-2017-11334: The address_space_write_continue function in exec.c allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048920). - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049578). - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046637). Important SUSE bug 1046637 SUSE bug 1048920 SUSE bug 1049578 SUSE bug 1051787 SUSE bug 1051788 SUSE bug 1052686 CVE-2017-10664 CVE-2017-11334 CVE-2017-11434 CVE-2017-12135 CVE-2017-12137 CVE-2017-12855 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2017-14316: Missing bound check in function `alloc_heap_pages` for an internal array allowed attackers using crafted hypercalls to execute arbitrary code within Xen (XSA-231, bsc#1056278) - CVE-2017-14317: A race in cxenstored may have cause a double-free allowind for DoS of the xenstored daemon (XSA-233, bsc#1056281). - CVE-2017-14319: An error while handling grant mappings allowed malicious or buggy x86 PV guest to escalate its privileges or crash the hypervisor (XSA-234, bsc#1056282). Important SUSE bug 1056278 SUSE bug 1056281 SUSE bug 1056282 CVE-2017-14316 CVE-2017-14317 CVE-2017-14319 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2017-14316: Missing bound check in function `alloc_heap_pages` for an internal array allowed attackers using crafted hypercalls to execute arbitrary code within Xen (XSA-231, bsc#1056278) - CVE-2017-14317: A race in cxenstored may have cause a double-free allowind for DoS of the xenstored daemon (XSA-233, bsc#1056281). - CVE-2017-14319: An error while handling grant mappings allowed malicious or buggy x86 PV guest to escalate its privileges or crash the hypervisor (XSA-234, bsc#1056282). Important SUSE bug 1056278 SUSE bug 1056281 SUSE bug 1056282 CVE-2017-14316 CVE-2017-14317 CVE-2017-14319 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1059777) - CVE-2017-15593: Missing cleanup in the page type system allowed a malicious or buggy PV guest to cause DoS (XSA-242 bsc#1061084) - CVE-2017-15592: A problem in the shadow pagetable code allowed a malicious or buggy HVM guest to cause DoS or cause hypervisor memory corruption potentially allowing the guest to escalate its privilege (XSA-243 bsc#1061086) - CVE-2017-15594: Problematic handling of the selector fields in the Interrupt Descriptor Table (IDT) allowed a malicious or buggy x86 PV guest to escalate its privileges or cause DoS (XSA-244 bsc#1061087) - CVE-2017-15589: Intercepted I/O write operations with less than a full machine word's worth of data were not properly handled, which allowed a malicious unprivileged x86 HVM guest to obtain sensitive information from the host or other guests (XSA-239 bsc#1061080) - CVE-2017-15595: In certain configurations of linear page tables a stack overflow might have occured that allowed a malicious or buggy PV guest to cause DoS and potentially privilege escalation and information leaks (XSA-240 bsc#1061081) - CVE-2017-15588: Under certain conditions x86 PV guests could have caused the hypervisor to miss a necessary TLB flush for a page. This allowed a malicious x86 PV guest to access all of system memory, allowing for privilege escalation, DoS, and information leaks (XSA-241 bsc#1061082) - CVE-2017-15590: Multiple issues existed with the setup of PCI MSI interrupts that allowed a malicious or buggy guest to cause DoS and potentially privilege escalation and information leaks (XSA-237 bsc#1061076) Important SUSE bug 1059777 SUSE bug 1061076 SUSE bug 1061080 SUSE bug 1061081 SUSE bug 1061082 SUSE bug 1061084 SUSE bug 1061086 SUSE bug 1061087 CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595 CVE-2017-5526 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1059777) - CVE-2017-15593: Missing cleanup in the page type system allowed a malicious or buggy PV guest to cause DoS (XSA-242 bsc#1061084) - CVE-2017-15592: A problem in the shadow pagetable code allowed a malicious or buggy HVM guest to cause DoS or cause hypervisor memory corruption potentially allowing the guest to escalate its privilege (XSA-243 bsc#1061086) - CVE-2017-15594: Problematic handling of the selector fields in the Interrupt Descriptor Table (IDT) allowed a malicious or buggy x86 PV guest to escalate its privileges or cause DoS (XSA-244 bsc#1061087) - CVE-2017-15589: Intercepted I/O write operations with less than a full machine word's worth of data were not properly handled, which allowed a malicious unprivileged x86 HVM guest to obtain sensitive information from the host or other guests (XSA-239 bsc#1061080) - CVE-2017-15595: In certain configurations of linear page tables a stack overflow might have occured that allowed a malicious or buggy PV guest to cause DoS and potentially privilege escalation and information leaks (XSA-240 bsc#1061081) - CVE-2017-15588: Under certain conditions x86 PV guests could have caused the hypervisor to miss a necessary TLB flush for a page. This allowed a malicious x86 PV guest to access all of system memory, allowing for privilege escalation, DoS, and information leaks (XSA-241 bsc#1061082) - CVE-2017-15590: Multiple issues existed with the setup of PCI MSI interrupts that allowed a malicious or buggy guest to cause DoS and potentially privilege escalation and information leaks (XSA-237 bsc#1061076) Important SUSE bug 1059777 SUSE bug 1061076 SUSE bug 1061080 SUSE bug 1061081 SUSE bug 1061082 SUSE bug 1061084 SUSE bug 1061086 SUSE bug 1061087 CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595 CVE-2017-5526 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). Important SUSE bug 1061075 SUSE bug 1061081 SUSE bug 1061086 SUSE bug 1063123 SUSE bug 1068187 SUSE bug 1068191 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). Important SUSE bug 1061075 SUSE bug 1061081 SUSE bug 1061086 SUSE bug 1063123 SUSE bug 1068187 SUSE bug 1068191 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - Unprivileged domains could have issued well-timed writes to xenstore which conflict with transactions to stall progress of the control domain or driver domain, possibly leading to DoS (bsc#1030144, XSA-206). Important SUSE bug 1024307 SUSE bug 1030144 SUSE bug 1061081 SUSE bug 1068032 SUSE bug 1070158 SUSE bug 1070159 SUSE bug 1070160 SUSE bug 1070163 SUSE bug 1074562 SUSE bug 1076116 SUSE bug 1076180 SUSE bug 1080635 SUSE bug 1080662 CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-5898 CVE-2018-5683 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka "Spectre" and "Meltdown" attacks (bsc#1074562, bsc#1068032) - CVE-2018-5683: The vga_draw_text function allowed local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation (bsc#1076116). - CVE-2017-18030: The cirrus_invalidate_region function allowed local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch (bsc#1076180). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081) - CVE-2017-17566: Prevent PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page (bsc#1070158). - CVE-2017-17563: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode (bsc#1070159). - CVE-2017-17564: Prevent guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode (bsc#1070160). - CVE-2017-17565: Prevent PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P (bsc#1070163). - Added missing intermediate preemption checks for guest requesting removal of memory. This allowed malicious guest administrator to cause denial of service due to the high cost of this operation (bsc#1080635). - Because of XEN not returning the proper error messages when transitioning grant tables from v2 to v1 a malicious guest was able to cause DoS or potentially allowed for privilege escalation as well as information leaks (bsc#1080662). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - Unprivileged domains could have issued well-timed writes to xenstore which conflict with transactions to stall progress of the control domain or driver domain, possibly leading to DoS (bsc#1030144, XSA-206). Important SUSE bug 1024307 SUSE bug 1030144 SUSE bug 1061081 SUSE bug 1068032 SUSE bug 1070158 SUSE bug 1070159 SUSE bug 1070160 SUSE bug 1070163 SUSE bug 1074562 SUSE bug 1076116 SUSE bug 1076180 SUSE bug 1080635 SUSE bug 1080662 CVE-2017-11334 CVE-2017-15595 CVE-2017-17563 CVE-2017-17564 CVE-2017-17565 CVE-2017-17566 CVE-2017-18030 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2017-5898 CVE-2018-5683 CVE-2018-7540 CVE-2018-7541 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes several issues. These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820) - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822) - Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823) - CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152). - CVE-2018-10471: x86 PV guest OS users were able to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754 (bsc#1089635). - CVE-2018-7550: The load_multiboot function allowed local guest OS users to execute arbitrary code on the host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access (bsc#1083292). Important SUSE bug 1083292 SUSE bug 1089152 SUSE bug 1089635 SUSE bug 1090820 SUSE bug 1090822 SUSE bug 1090823 CVE-2018-10471 CVE-2018-10472 CVE-2018-7550 CVE-2018-8897 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes several issues. These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 (XSA-260, bsc#1090820) - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially privilege escalation/information leaks (XSA-261, bsc#1090822) - Prevent unbounded loop, induced by qemu allowing an attacker to permanently keep a physical CPU core busy (XSA-262, bsc#1090823) - CVE-2018-10472: x86 HVM guest OS users (in certain configurations) were able to read arbitrary dom0 files via QMP live insertion of a CDROM, in conjunction with specifying the target file as the backing file of a snapshot (bsc#1089152). - CVE-2018-10471: x86 PV guest OS users were able to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754 (bsc#1089635). - CVE-2018-7550: The load_multiboot function allowed local guest OS users to execute arbitrary code on the host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access (bsc#1083292). Important SUSE bug 1083292 SUSE bug 1089152 SUSE bug 1089635 SUSE bug 1090820 SUSE bug 1090822 SUSE bug 1090823 CVE-2018-10471 CVE-2018-10472 CVE-2018-7550 CVE-2018-8897 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes the following issues: These security issue were fixed: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - CVE-2018-12617: An integer overflow that could cause a segmentation fault in qmp_guest_file_read() with g_malloc() in qemu-guest-agent was fixed (bsc#1098744) - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. (bsc#1095242) - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. (bsc#1092631) - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. (bsc#1074562) - CVE-2018-12891: Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. (bsc#1097521) - CVE-2018-12893: One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users. (bsc#1097522) - CVE-2018-11806: m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. (bsc#1096224) - CVE-2018-10982: An issue was discovered in Xen allowed x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection. (bsc#1090822) - CVE-2018-10981: An issue was discovered in Xen that allowed x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request. (bsc#1090823) Following bugs were fixed: - After updating to kernel 3.0.101-0.47.106.32-xen system crashes in check_bugs() (bsc#1097206) - bsc#1079730 - in xen-kmp, unplug emulated devices after migration This is required since xen-4.10 and/or qemu-2.10 because the state of unplug is not propagated from one dom0 to another. Without this unplug qemu's block-backend will be unable to open qcow2 disks on the receiving dom0 Important SUSE bug 1027519 SUSE bug 1074562 SUSE bug 1079730 SUSE bug 1090822 SUSE bug 1090823 SUSE bug 1091107 SUSE bug 1092631 SUSE bug 1095242 SUSE bug 1096224 SUSE bug 1097206 SUSE bug 1097521 SUSE bug 1097522 SUSE bug 1098744 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-10981 CVE-2018-10982 CVE-2018-11806 CVE-2018-12617 CVE-2018-12891 CVE-2018-12893 CVE-2018-3639 CVE-2018-3646 CVE-2018-3665 SUSE Linux Enterprise Server 11 SP3-LTSS This update for xen fixes the following issues: These security issue were fixed: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - CVE-2018-12617: An integer overflow that could cause a segmentation fault in qmp_guest_file_read() with g_malloc() in qemu-guest-agent was fixed (bsc#1098744) - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. (bsc#1095242) - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. (bsc#1092631) - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. (bsc#1074562) - CVE-2018-12891: Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. (bsc#1097521) - CVE-2018-12893: One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users. (bsc#1097522) - CVE-2018-11806: m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. (bsc#1096224) - CVE-2018-10982: An issue was discovered in Xen allowed x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection. (bsc#1090822) - CVE-2018-10981: An issue was discovered in Xen that allowed x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request. (bsc#1090823) Following bugs were fixed: - After updating to kernel 3.0.101-0.47.106.32-xen system crashes in check_bugs() (bsc#1097206) - bsc#1079730 - in xen-kmp, unplug emulated devices after migration This is required since xen-4.10 and/or qemu-2.10 because the state of unplug is not propagated from one dom0 to another. Without this unplug qemu's block-backend will be unable to open qcow2 disks on the receiving dom0 Important SUSE bug 1027519 SUSE bug 1074562 SUSE bug 1079730 SUSE bug 1090822 SUSE bug 1090823 SUSE bug 1091107 SUSE bug 1092631 SUSE bug 1095242 SUSE bug 1096224 SUSE bug 1097206 SUSE bug 1097521 SUSE bug 1097522 SUSE bug 1098744 CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 CVE-2018-10981 CVE-2018-10982 CVE-2018-11806 CVE-2018-12617 CVE-2018-12891 CVE-2018-12893 CVE-2018-3639 CVE-2018-3646 CVE-2018-3665 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xen fixes the following issues: Security issues fixed: - CVE-2018-19965: Fixed an issue related to the INVPCID instruction in case non-canonical addresses are accessed, which may allow a guest to cause Xen to crash, resulting in a Denial of Service (DoS) affecting the entire host. (XSA-279) (bsc#1115045) - CVE-2018-18849: Fixed an out of bounds memory access issue was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin (bsc#1114423). - CVE-2018-19665: Fixed an integer overflow resulting in memory corruption in various Bluetooth functions, allowing this to crash qemu process resulting in Denial of Service (DoS). (bsc#1117756). - CVE-2018-18438: Fixed an integer overflow in ccid_card_vscard_read function which could allow memory corruption (bsc#1112188). - CVE-2018-17962: Fixed an integer overflow leading to a buffer overflow in the pcnet component (bsc#1111011). - CVE-2018-19961, CVE-2018-19962: Fixed an issue related to insufficient TLB flushing with AMD IOMMUs, which potentially allowed a guest to escalate its privileges, may cause a Denial of Service (DoS) affecting the entire host, or may be able to access data it is not supposed to access. (XSA-275) (bsc#1115040). - CVE-2018-17963: Fixed an integer overflow in relation to large packet sizes, leading to a denial of service (DoS) (bsc#1111014). - Fixed an issue which could allow a malicious or buggy x86 PV guest kernels can mount a Denial of Service attack affecting the whole system (bsc#1126196). - CVE-2018-17958: Fixed an integer overflow which could lead to buffer overflow (bsc#1111007). - CVE-2018-10839: Fixed an integer overflow leading to a buffer overflow in the ne2000 component (bsc#1110924). - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() found in slirp (bsc#1123157). - CVE-2018-19966: Fixed issue introduced by XSA-240 that could have caused conflicts with shadow paging (XSA-280)(bsc#1115047). - CVE-2018-19967: Fixed HLE constructs that allowed guests to lock up the host, resulting in a Denial of Service (DoS). (XSA-282) (bsc#1114988). - Fixed multiple access violations introduced by XENMEM_exchange hypercall which could allow a single PV guest to leak arbitrary amounts of memory, leading to a denial of service (bsc#1126192). - Fixed an issue which could allow malicious or buggy guests with passed through PCI devices to be able to escalate their privileges, crash the host, or access data belonging to other guests. Additionally memory leaks were also possible (bsc#1126140). - Fixed a race condition issue which could allow malicious PV guests to escalate their privilege to that of the hypervisor (bsc#1126141). - CVE-2019-9824: Fixed an information leak in SLiRP networking implementation which could allow a user/process to read uninitialised stack memory contents (bsc#1129623). Important SUSE bug 1110924 SUSE bug 1111007 SUSE bug 1111011 SUSE bug 1111014 SUSE bug 1112188 SUSE bug 1114423 SUSE bug 1114988 SUSE bug 1115040 SUSE bug 1115045 SUSE bug 1115047 SUSE bug 1117756 SUSE bug 1123157 SUSE bug 1126140 SUSE bug 1126141 SUSE bug 1126192 SUSE bug 1126195 SUSE bug 1126196 SUSE bug 1129623 CVE-2018-10839 CVE-2018-17958 CVE-2018-17962 CVE-2018-17963 CVE-2018-18438 CVE-2018-18849 CVE-2018-19665 CVE-2018-19961 CVE-2018-19962 CVE-2018-19965 CVE-2018-19966 CVE-2018-19967 CVE-2019-6778 CVE-2019-9824 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues: The following security issues have been addressed: * CVE-2013-2194: Various integer overflows in the ELF loader were fixed. (XSA-55) * CVE-2013-2195: Various pointer dereferences issues in the ELF loader were fixed. (XSA-55) * CVE-2013-2196: Various other problems in the ELF loader were fixed. (XSA-55) * CVE-2013-2078: A Hypervisor crash due to missing exception recovery on XSETBV was fixed. (XSA-54) * CVE-2013-2077: A Hypervisor crash due to missing exception recovery on XRSTOR was fixed. (XSA-53) * CVE-2013-2211: libxl allowed guest write access to sensitive console related xenstore keys. (XSA-57) * CVE-2013-2076: An information leak on XSAVE/XRSTOR capable AMD CPUs (XSA-52) was fixed, where parts of this state could leak to other VMs. Also the following bugs have been fixed: * performance issues in mirror lvm (bnc#801663) * aacraid driver panics mapping INT A when booting kernel-xen (bnc#808085) * Fully Virtualized Windows VM install failed on Ivy Bridge platforms with Xen kernel (bnc#808269) * Did not boot with i915 graphics controller with VT-d enabled (bnc#817210) Security Issue references: * CVE-2013-2194 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2194> * CVE-2013-2195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2195> * CVE-2013-2196 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2196> SUSE bug 801663 SUSE bug 808085 SUSE bug 808269 SUSE bug 817210 SUSE bug 820917 SUSE bug 820919 SUSE bug 820920 SUSE bug 823011 SUSE bug 823608 CVE-2013-2194 CVE-2013-2195 CVE-2013-2196 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA XEN has been updated to version 4.2.3 c/s 26170, fixing various bugs and security issues. * CVE-2013-4416: XSA-72: Fixed ocaml xenstored that mishandled oversized message replies * CVE-2013-4355: XSA-63: Fixed information leaks through I/O instruction emulation * CVE-2013-4361: XSA-66: Fixed information leak through fbld instruction emulation * CVE-2013-4368: XSA-67: Fixed information leak through outs instruction emulation * CVE-2013-4369: XSA-68: Fixed possible null dereference when parsing vif ratelimiting info * CVE-2013-4370: XSA-69: Fixed misplaced free in ocaml xc_vcpu_getaffinity stub * CVE-2013-4371: XSA-70: Fixed use-after-free in libxl_list_cpupool under memory pressure * CVE-2013-4375: XSA-71: xen: qemu disk backend (qdisk) resource leak * CVE-2013-1442: XSA-62: Fixed information leak on AVX and/or LWP capable CPUs * CVE-2013-1432: XSA-58: Page reference counting error due to XSA-45/CVE-2013-1918 fixes. Various bugs have also been fixed: * Boot failure with xen kernel in UEFI mode with error "No memory for trampoline" (bnc#833483) * Improvements to block-dmmd script (bnc#828623) * MTU size on Dom0 gets reset when booting DomU with e1000 device (bnc#840196) * In HP's UEFI x86_64 platform and with xen environment, in booting stage, xen hypervisor will panic. (bnc#833251) * Xen: migration broken from xsave-capable to xsave-incapable host (bnc#833796) * In xen, "shutdown -y 0 -h" cannot power off system (bnc#834751) * In HP's UEFI x86_64 platform with xen environment, xen hypervisor will panic on multiple blades nPar. (bnc#839600) * vcpus not started after upgrading Dom0 from SLES 11 SP2 to SP3 (bnc#835896) * SLES 11 SP3 Xen security patch does not automatically update UEFI boot binary (bnc#836239) * Failed to setup devices for vm instance when start multiple vms simultaneously (bnc#824676) * SLES 9 SP4 guest fails to start after upgrading to SLES 11 SP3 (bnc#817799) * Various upstream fixes have been included. Security Issues: * CVE-2013-1432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1432> * CVE-2013-1442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1442> * CVE-2013-1918 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1918> * CVE-2013-4355 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4355> * CVE-2013-4361 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4361> * CVE-2013-4368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4368> * CVE-2013-4369 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4369> * CVE-2013-4370 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4370> * CVE-2013-4371 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4371> * CVE-2013-4375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4375> * CVE-2013-4416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4416> SUSE bug 817799 SUSE bug 824676 SUSE bug 826882 SUSE bug 828623 SUSE bug 833251 SUSE bug 833483 SUSE bug 833796 SUSE bug 834751 SUSE bug 835896 SUSE bug 836239 SUSE bug 839596 SUSE bug 839600 SUSE bug 840196 SUSE bug 840592 SUSE bug 841766 SUSE bug 842511 SUSE bug 842512 SUSE bug 842513 SUSE bug 842514 SUSE bug 842515 SUSE bug 845520 CVE-2013-1432 CVE-2013-1442 CVE-2013-1918 CVE-2013-4355 CVE-2013-4361 CVE-2013-4368 CVE-2013-4369 CVE-2013-4370 CVE-2013-4371 CVE-2013-4375 CVE-2013-4416 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The Xen hypervisor and tool-suite have been updated to fix security issues and bugs: * CVE-2013-4494: XSA-73: A lock order reversal between page allocation and grant table locks could lead to host crashes or even host code execution. * CVE-2013-4553: XSA-74: A lock order reversal between page_alloc_lock and mm_rwlock could lead to deadlocks. * CVE-2013-4554: XSA-76: Hypercalls exposed to privilege rings 1 and 2 of HVM guests which might lead to Hypervisor escalation under specific circumstances. * CVE-2013-6375: XSA-78: Insufficient TLB flushing in VT-d (iommu) code could lead to access of memory that was revoked. * CVE-2013-4551: XSA-75: A host crash due to guest VMX instruction execution was fixed. Non-security bugs have also been fixed: * bnc#840997: It is possible to start a VM twice on the same node. * bnc#842417: In HP's UEFI x86_64 platform and SLES 11-SP3, dom0 will could lock-up on multiple blades nPar. * bnc#848014: Xen Hypervisor panics on 8-blades nPar with 46-bit memory addressing. * bnc#846849: Soft lock-up with PCI pass-through and many VCPUs. * bnc#833483: Boot Failure with Xen kernel in UEFI mode with error "No memory for trampoline". * Increase the maximum supported CPUs in the Hypervisor to 512. Security Issues: * CVE-2013-1922 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1922> * CVE-2013-2007 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007> * CVE-2013-4375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4375> * CVE-2013-4416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4416> * CVE-2013-4494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4494> * CVE-2013-4551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4551> * CVE-2013-4553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4553> * CVE-2013-4554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4554> SUSE bug 833483 SUSE bug 840997 SUSE bug 842417 SUSE bug 846849 SUSE bug 848014 SUSE bug 848657 SUSE bug 849665 SUSE bug 849667 SUSE bug 849668 SUSE bug 851386 CVE-2013-1922 CVE-2013-2007 CVE-2013-4375 CVE-2013-4416 CVE-2013-4494 CVE-2013-4551 CVE-2013-4553 CVE-2013-4554 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise Server 11 Service Pack 3 Xen hypervisor and toolset has been updated to 4.2.4 to fix various bugs and security issues: The following security issues have been addressed: * XSA-60: CVE-2013-2212: The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling chaches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range. (bnc#831120) * XSA-80: CVE-2013-6400: Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors. (bnc#853048) * XSA-82: CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#853049) * XSA-83: CVE-2014-1642: The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free. (bnc#860092) * XSA-84: CVE-2014-1891: The FLASK_{GET,SET}BOOL, FLASK_USER and FLASK_CONTEXT_TO_SID suboperations of the flask hypercall are vulnerable to an integer overflow on the input size. The hypercalls attempt to allocate a buffer which is 1 larger than this size and is therefore vulnerable to integer overflow and an attempt to allocate then access a zero byte buffer. (bnc#860163) * XSA-84: CVE-2014-1892 CVE-2014-1893: Xen 3.3 through 4.1, while not affected by the above overflow, have a different overflow issue on FLASK_{GET,SET}BOOL and expose unreasonably large memory allocation to aribitrary guests. (bnc#860163) * XSA-84: CVE-2014-1894: Xen 3.2 (and presumably earlier) exhibit both problems with the overflow issue being present for more than just the suboperations listed above. (bnc#860163) * XSA-85: CVE-2014-1895: The FLASK_AVC_CACHESTAT hypercall, which provides access to per-cpu statistics on the Flask security policy, incorrectly validates the CPU for which statistics are being requested. (bnc#860165) * XSA-86: CVE-2014-1896: libvchan (a library for inter-domain communication) does not correctly handle unusual or malicious contents in the xenstore ring. A malicious guest can exploit this to cause a libvchan-using facility to read or write past the end of the ring. (bnc#860300) * XSA-87: CVE-2014-1666: The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors. (bnc#860302) * XSA-88: CVE-2014-1950: Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors. (bnc#861256) Also the following non-security bugs have been fixed: * Fixed boot problems with Xen kernel. "(XEN) setup 0000:00:18.0 for d0 failed (-19)" (bnc#858311) * Fixed Xen hypervisor panic on 8-blades nPar with 46-bit memory addressing. (bnc#848014) * Fixed Xen hypervisor panic in HP's UEFI x86_64 platform and with xen environment, in booting stage. (bnc#833251) * xend/pvscsi: recognize also SCSI CDROM devices (bnc#863297) * pygrub: Support (/dev/xvda) style disk specifications Security Issue references: * CVE-2013-2212 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2212> * CVE-2013-6400 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6400> * CVE-2013-6885 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6885> * CVE-2014-1642 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1642> * CVE-2014-1666 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1666> * CVE-2014-1891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1891> * CVE-2014-1892 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1892> * CVE-2014-1893 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1893> * CVE-2014-1894 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1894> * CVE-2014-1895 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1895> * CVE-2014-1896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1896> * CVE-2014-1950 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1950> SUSE bug 831120 SUSE bug 833251 SUSE bug 848014 SUSE bug 853048 SUSE bug 853049 SUSE bug 858311 SUSE bug 860092 SUSE bug 860163 SUSE bug 860165 SUSE bug 860300 SUSE bug 860302 SUSE bug 861256 SUSE bug 863297 CVE-2013-2212 CVE-2013-6400 CVE-2013-6885 CVE-2014-1642 CVE-2014-1666 CVE-2014-1891 CVE-2014-1892 CVE-2014-1893 CVE-2014-1894 CVE-2014-1895 CVE-2014-1896 CVE-2014-1950 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues. The following security issues have been fixed: * XSA-108: CVE-2014-7188: Improper MSR range used for x2APIC emulation (bnc#897657) * XSA-106: CVE-2014-7156: Missing privilege level checks in x86 emulation of software interrupts (bnc#895802) * XSA-105: CVE-2014-7155: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation (bnc#895799) * XSA-104: CVE-2014-7154: Race condition in HVMOP_track_dirty_vram (bnc#895798) * XSA-100: CVE-2014-4021: Hypervisor heap contents leaked to guests (bnc#880751) * XSA-96: CVE-2014-3967, CVE-2014-3968: Vulnerabilities in HVM MSI injection (bnc#878841) * XSA-89: CVE-2014-2599: HVMOP_set_mem_access is not preemptible (bnc#867910) * XSA-65: CVE-2013-4344: qemu SCSI REPORT LUNS buffer overflow (bnc#842006) * CVE-2013-4540: qemu: zaurus: buffer overrun on invalid state load (bnc#864801) The following non-security issues have been fixed: * xend: Fix netif convertToDeviceNumber for running domains (bnc#891539) * Installing SLES12 as a VM on SLES11 SP3 fails because of btrfs in the VM (bnc#882092) * XEN kernel panic do_device_not_available() (bnc#881900) * Boot Failure with xen kernel in UEFI mode with error "No memory for trampoline" (bnc#833483) * SLES 11 SP3 vm-install should get RHEL 7 support when released (bnc#862608) * SLES 11 SP3 XEN kiso version cause softlockup on 8 blades npar(480 cpu) (bnc#858178) * Local attach support for PHY backends using scripts local_attach_support_for_phy.patch (bnc#865682) * Improve multipath support for npiv devices block-npiv (bnc#798770) Security Issues: * CVE-2013-4344 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4344> * CVE-2013-4540 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4540> * CVE-2014-2599 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2599> * CVE-2014-3967 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3967> * CVE-2014-3968 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3968> * CVE-2014-4021 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4021> * CVE-2014-7154 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7154> * CVE-2014-7155 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7155> * CVE-2014-7156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7156> * CVE-2014-7188 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7188> SUSE bug 798770 SUSE bug 833483 SUSE bug 842006 SUSE bug 858178 SUSE bug 862608 SUSE bug 864801 SUSE bug 865682 SUSE bug 867910 SUSE bug 878841 SUSE bug 880751 SUSE bug 881900 SUSE bug 882092 SUSE bug 891539 SUSE bug 895798 SUSE bug 895799 SUSE bug 895802 SUSE bug 897657 CVE-2013-4344 CVE-2013-4540 CVE-2014-2599 CVE-2014-3967 CVE-2014-3968 CVE-2014-4021 CVE-2014-7154 CVE-2014-7155 CVE-2014-7156 CVE-2014-7188 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The Virtualization service XEN was updated to fix various bugs and security issues. The following security issues have been fixed: * CVE-2015-2756: XSA-126: Unmediated PCI command register access in qemu could have lead to denial of service attacks against the host, if PCI cards are passed through to guests. * XSA-125: Long latency MMIO mapping operations were not preemptible. * CVE-2015-2151: XSA-123: Instructions with register operands ignored eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override could have, however, corrupted a pointer used subsequently to store the result of the instruction. * CVE-2015-2045: XSA-122: The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall failed to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest. * CVE-2015-2044: XSA-121: Emulation routines in the hypervisor dealing with certain system devices checked whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents were copied into the destination of the operation, thus becoming visible to the guest. Also fixed: * Fully virtualized guest install from network source failed with 'cannot find guest domain' in XEN. (bsc#919341) Security Issues: * CVE-2015-2044 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2044> * CVE-2015-2045 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2045> * CVE-2015-2151 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2151> * CVE-2015-2756 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2756> SUSE bug 918995 SUSE bug 918998 SUSE bug 919341 SUSE bug 919464 SUSE bug 922705 SUSE bug 922706 CVE-2015-2044 CVE-2015-2045 CVE-2015-2151 CVE-2015-2756 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA Xen was updated to fix seven security vulnerabilities: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bnc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bnc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bnc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bnc#931628) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior. (XSA-134, bnc#932790) * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bnc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bnc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> SUSE bug 931625 SUSE bug 931626 SUSE bug 931627 SUSE bug 931628 SUSE bug 932770 SUSE bug 932790 SUSE bug 932996 CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issues: - bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list - bsc#956592 - xen: virtual PMU is unsupported (XSA-163) - bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159) - bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160) - bsc#956411 - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162) - bsc#947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142) - bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception - bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156) - bsc#950704 - CVE-2015-7970: xen: x86: Long latency populate-on-demand operation is not preemptible (XSA-150) - bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand balloon size inaccuracy can crash guests (XSA-153) - bsc#950703 - CVE-2015-7969: xen: leak of main per-domain vcpu pointer array (DoS) (XSA-149) - bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain profiling-related vcpu pointer array (DoS) (XSA-151) - bsc#950706 - CVE-2015-7971: xen: x86: some pmu and profiling hypercalls log without rate limiting (XSA-152) Moderate SUSE bug 947165 SUSE bug 950703 SUSE bug 950704 SUSE bug 950705 SUSE bug 950706 SUSE bug 951845 SUSE bug 954018 SUSE bug 954405 SUSE bug 956408 SUSE bug 956409 SUSE bug 956411 SUSE bug 956592 SUSE bug 956832 CVE-2015-5307 CVE-2015-7311 CVE-2015-7504 CVE-2015-7969 CVE-2015-7970 CVE-2015-7971 CVE-2015-7972 CVE-2015-8104 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 CVE-2015-8345 SUSE Linux Enterprise Server 11 SP3-TERADATA xerces-j2 was updated to fix several issues. This security issue was fixed: - bsc#814241: Prevent possible DoS through very long attribute names This non-security issue was fixed: - Prevent StackOverflowError when applying a pattern restriction on long strings while trying to validate an XML file against a schema (bsc#1047536, bsc#879138) Moderate SUSE bug 1047536 SUSE bug 814241 SUSE bug 879138 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xfsprogs was updated to fix one security vulnerability and several bugs. - Handle unwanted data disclosure in xfs_metadump (bsc#939367, CVE-2012-2150) - Fix segfault during xfs_repair run (bsc#911866) - Fix definition of leaf attribute block to avoid gcc optimization xfsprogs-fix-leaf-block-definition Moderate SUSE bug 911866 SUSE bug 939367 CVE-2012-2150 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The multiplexing system xinetd was updated to fix security issues and a bug. Security issues fixed: * CVE-2013-4342: xinetd ignores user and group directives for tcpmux services. * CVE-2012-0862: xinetd enables all services when tcp multiplexing is used. Bug fixed: * Services started by xinetd were limited to 1024 open file descriptors. (bnc#855685) Security Issues references: * CVE-2012-0862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0862> * CVE-2013-4342 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4342> SUSE bug 762294 SUSE bug 844230 SUSE bug 855685 CVE-2012-0862 CVE-2013-4342 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update fixes the following security issue with xorg-x11-server: * bnc#853846: integer underflow when handling trapezoids (CVE-2013-6424) Security Issue reference: * CVE-2013-6424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6424> SUSE bug 853846 CVE-2013-6424 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xorg-x11-libs was patched to fix the following security issues: * Integer overflow of allocations in font metadata file parsing. (CVE-2014-0209) * libxfont not validating length fields when parsing xfs protocol replies. (CVE-2014-0210) * Integer overflows causing miscalculating memory needs for xfs replies. (CVE-2014-0211) Further information is available at http://lists.x.org/archives/xorg-announce/2014-May/002431.html <http://lists.x.org/archives/xorg-announce/2014-May/002431.html> . Security Issues references: * CVE-2014-0209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209> * CVE-2014-0210 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210> * CVE-2014-0211 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211> SUSE bug 857544 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libICE fixes the following issues: - CVE-2017-2626: Creation of the ICE auth session cookies used insufficient randomness, making these cookies predictable. A more random generation method has been implemented. (boo#1025068) Moderate SUSE bug 1025068 CVE-2017-2626 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libX11 fixes several security issues. Bug 815451/821664 CVE-2013-1981 CVE-2013-1997 CVE-2013-2004 Security Issues: * CVE-2013-1981 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1981> * CVE-2013-1997 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1997> * CVE-2013-2004 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2004> SUSE bug 815451 SUSE bug 821664 CVE-2013-1981 CVE-2013-1997 CVE-2013-2004 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA xorg-x11-libX11 was updated to fix one security issue. This security issue was fixed: - CVE-2013-7439: Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allowed remote attackers to have unspecified impact via a crafted request, which triggered a buffer overflow (bsc#927220). Moderate SUSE bug 927220 CVE-2013-7439 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libX11 fixes the following issues: - plug a memory leak (bsc#1002991, CVE-2016-7942) - insufficient validation of data from the X server can cause out of boundary memory read (XGetImage()) or write (XListFonts()) (bsc#1002991, CVE-2016-7942) Moderate SUSE bug 1002991 CVE-2016-7942 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libX11 fixes the following issues: - a regression introduced by the security fix for CVE-2013-1997 (bnc#824294). Keyboard mappings for special characters on Non-English keyboards might have been broken. (bnc#1019642) Moderate SUSE bug 1019642 CVE-2013-1997 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libX11 fixes the following issues: - CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062) - CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068) - CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073) Moderate SUSE bug 1102062 SUSE bug 1102068 SUSE bug 1102073 CVE-2018-14598 CVE-2018-14599 CVE-2018-14600 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable (bsc#1025046) Moderate SUSE bug 1025046 CVE-2017-2625 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXext fixes several integer overflow issues. Bug 815451/821665 CVE-2013-1982 Security Issues: * CVE-2013-1982 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1982> SUSE bug 815451 SUSE bug 821665 CVE-2013-1982 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXfixes fixed a integer overflow issue. Bug 815451/821667 CVE-2013-1983 Security Issues: * CVE-2013-1983 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1983> SUSE bug 815451 SUSE bug 821667 CVE-2013-1983 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libXfixes fixes the following issues: - insufficient validation of data from the X server can cause an integer overflow on 32 bit architectures (bsc#1002995, CVE-2016-7944) Moderate SUSE bug 1002995 CVE-2016-7944 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXp fixes several integer overflow issues. Bug 815451/821668 CVE-2013-2062 Security Issues: * CVE-2013-2062 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2062> SUSE bug 815451 SUSE bug 821668 CVE-2013-2062 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libXpm fixes the following security issue: - A heap overflow in XPM handling could be used by attackers supplying XPM files to crash or potentially execute code. (bsc#1021315) Moderate SUSE bug 1021315 CVE-2016-10164 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXrender fixes several integer overflow issues. Bug 815451/821669 CVE-2013-1987 Security Issues: * CVE-2013-1987 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1987> SUSE bug 815451 SUSE bug 821669 CVE-2013-1987 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libXrender fixes the following issues: - insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003002, CVE-2016-7949, CVE-2016-7950) Moderate SUSE bug 1003002 CVE-2016-7949 CVE-2016-7950 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXt fixes several integer and buffer overflow issues. Bug 815451/821670 CVE-2013-2002/CVE-2013-2005 Security Issues: * CVE-2013-2002 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2002> * CVE-2013-2005 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2005> SUSE bug 815451 SUSE bug 821670 CVE-2013-2002 CVE-2013-2005 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA This update of xorg-x11-libXv fixes several integer and buffer overflow issues. Bug 815451/821671 CVE-2013-1989/CVE-2013-2066 Security Issues: * CVE-2013-1989 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1989> * CVE-2013-2066 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2066> SUSE bug 815451 SUSE bug 821671 CVE-2013-1989 CVE-2013-2066 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libXv fixes the following issues: - insufficient validation of data from the X server can cause memory corruption (bsc#1003017, CVE-2016-5407) Moderate SUSE bug 1003017 CVE-2016-5407 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libs fixes the following issues: - insufficient validation of data from the X server can cause a one byte buffer read underrun (bsc#1003023, CVE-2016-7953) - insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service) (bsc#1003012, CVE-2016-7951, CVE-2016-7952) - insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003000, CVE-2016-7947, CVE-2016-7948) - insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service). (bsc#1002998, CVE-2016-7945, CVE-2016-7946) Moderate SUSE bug 1002998 SUSE bug 1003000 SUSE bug 1003012 SUSE bug 1003023 CVE-2016-7945 CVE-2016-7946 CVE-2016-7947 CVE-2016-7948 CVE-2016-7951 CVE-2016-7952 CVE-2016-7953 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libs fixes several issues. These security issues were fixed: - CVE-2017-16612: Heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments (bsc#1065386). - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459) Moderate SUSE bug 1049692 SUSE bug 1050459 SUSE bug 1054285 SUSE bug 1065386 CVE-2017-13720 CVE-2017-13722 CVE-2017-16612 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-libs fixes the following security issue: - CVE-2015-9262: _XcursorThemeInherits allowed remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow (bsc#1103511) Moderate SUSE bug 1103511 CVE-2015-9262 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-server fixes the following issues: Security issues: - CVE-2017-2624: Prevent timing attack against MIT cookie. (bsc#1025029, CVE-2017-2624) Non security issues: - Use arc4random to generate cookies. (bsc#1025084) - XDrawArc performance improvement (bsc#1019649) - Fix byte swapping for gradeint stops (bsc#981044). - Remove unused function with use-after-free issue. (bsc#1025035) Moderate SUSE bug 1019649 SUSE bug 1025029 SUSE bug 1025035 SUSE bug 1025084 SUSE bug 981044 CVE-2017-2624 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. (bnc#1035283) - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize the xEvent eventT with zeros to avoid information leakage. Important SUSE bug 1035283 CVE-2017-10971 CVE-2017-10972 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-server provides several fixes. These security issues were fixed: - CVE-2017-13723: Prevent local DoS via unusual characters in XkbAtomText and XkbStringText (bsc#1051150). - Improve the entropy when generating random data used in X.org server authorization cookies generation by using getentropy() and getrandom() when available (bsc#1025084) - CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed unvalidated lengths in multiple extensions (bsc#1063034) - CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES extension. (bsc#1063035) - CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions (bsc#1063037) - CVE-2017-12179: Fixed an integer overflow and unvalidated length in (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038) - CVE-2017-12178: Fixed a wrong extra length check in ProcXIChangeHierarchy in Xi (bsc#1063039) - CVE-2017-12177: Fixed an unvalidated variable-length request in ProcDbeGetVisualInfo (bsc#1063040) - CVE-2017-12176: Fixed an unvalidated extra length in ProcEstablishConnection (bsc#1063041) Moderate SUSE bug 1025084 SUSE bug 1051150 SUSE bug 1063034 SUSE bug 1063035 SUSE bug 1063037 SUSE bug 1063038 SUSE bug 1063039 SUSE bug 1063040 SUSE bug 1063041 CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12179 CVE-2017-12180 CVE-2017-12181 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 CVE-2017-12186 CVE-2017-12187 CVE-2017-13723 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA This update for xorg-x11-server provides the following fix: Security issue fixed: - CVE-2018-14665: Local attackers could overwrite system files in any directory using the -logfile option and gain privileges (bsc#1111697) Non security issues fixed: - Do not write past the allocated buffer. (bsc#1078383) Important SUSE bug 1078383 SUSE bug 1111697 CVE-2018-14665 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA The xscreensaver package was updated to fix the following security and non security issues: - CVE-2015-8025: Fixed a crash when hot-swapping monitors while locked (bsc#952062). - Added xscreensaver-in_signal_handler_p.patch needed for fix of signal handling. - Refresh xscreensaver-stars.patch. Moderate SUSE bug 952062 CVE-2015-8025 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for yast2-storage to version 2.17.147.1 fixes the following issues: - Use stdin, not tmp files for passwords (bsc#986971, CVE-2016-5746) - fixed setting disk label on multipath devices (bsc#898525) - fixed used-by information for multipath with LVM (bsc#888838) Moderate SUSE bug 888838 SUSE bug 898525 SUSE bug 986971 CVE-2016-5746 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for zlib fixes the following issues: * Incompatible declarations for external linkage function deflate (bnc#1003577) * CVE-2016-9842: Undefined Left Shift of Negative Number (bnc#1003580) * CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c (bnc#1003579) * CVE-2016-9843: Big-endian out-of-bounds pointer Moderate SUSE bug 1003577 SUSE bug 1003579 SUSE bug 1003580 SUSE bug 1013882 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 SUSE Linux Enterprise Server 11 SP3-TERADATA This update for zsh fixes the following issues: - CVE-2018-1100: Fixed a buffer overflow in utils.c:checkmailpath() that could lead to local arbitrary code execution ( bsc#1089030) Moderate SUSE bug 1089030 CVE-2018-1100