SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1454-1)

This update for libxml2 fixes the following issues : - CVE-2017-9047, CVE-2017-9048: The function xmlSnprintfElementContent in valid.c was vulnerable to a stack-based buffer overflow bsc1039063, bsc1039064 - CVE-2017-9049: The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-base...

SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:1441-1)

This update for postgresql93 fixes the following issues: The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes. Bug fixes : - bsc1029547: Fix tests with timezone 2017a - CVE-2017-7486: Restrict visibility of pgusermappings.umoptions, to protect passwords stored as...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:1442-1)

Wireshark was updated to version 2.2.6, which brings several new features, enhancements and bug fixes. Thses security issues were fixed : - CVE-2017-7700: In Wireshark the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2017:1446-1)

This update for sudo fixes the following issues: CVE-2017-1000367 : - Due to incorrect assumptions in /proc/pid/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. bsc1039361 - Fix FQDN for...

SUSE SLES12 Security Update : squidGuard (SUSE-SU-2017:1411-1)

squidGuard was updated to fix one security issue : - CVE-2015-8936: Reflected cross-site scripting vulnerability because of insufficient escaping bsc985612. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:1392-1) (SambaCry)

This update for samba fixes the following issue : - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 Note that Tenable...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:1393-1) (SambaCry)

This update for samba fixes the following issue : - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 Note that Tenable...

SUSE SLES12 Security Update : samba (SUSE-SU-2017:1396-1) (SambaCry)

This update for samba fixes the following issue : - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 Note that Tenable...

SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1404-1)

This update for ghostscript fixes the following security vulnerabilities : - CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. bsc1036453 - CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misus...

SUSE SLED12 / SLES12 Security Update : pam (SUSE-SU-2017:1398-1)

This update for pam fixes the following issues : - CVE-2015-3238: pamunix in conjunction with SELinux allowed for DoS attacks bsc934920. - log a hint to syslog if /etc/nologin is present, but empty bsc1015565. - If /etc/nologin is present, but empty, log a hint to syslog. bsc1015565 - Added suppo...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2017:1386-1)

This update for java-180-ibm fixes the following issues: Version update bsc1038505 : - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number -...

SUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1379-1)

This update for libplist fixes the following issues : - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read via split encoded Apple Property List data bsc1019531. - CVE-2017-5545:...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2017:1385-1)

This update for java-171-ibm fixes the following issues : - Version update to 7.1-4.5 bsc1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative numbe...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1366-1)

This update for libxml2 fixes the following issues : - Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 - CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS bsc1017497 -...

SUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1368-1)

This update for libplist fixes the following security issues : - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read via Apple Property List data that is to...

SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2017:1367-1)

This update for libsndfile fixes the following issues : - CVE-2017-8361: Global buffer overflow in flacbuffercopy. bsc1036946 - CVE-2017-8362: Invalid memory read in flacbuffercopy. bsc1036943 - CVE-2017-8363: Heap-based buffer overflow in flacbuffercopy. bsc1036945 - CVE-2017-7585, CVE-2017-7741...

SUSE SLES12 Security Update : git (SUSE-SU-2017:1357-1)

This update for git fixes the following issues : - git 2.12.3 : - CVE-2017-8386: Fix git-shell not to escape with the starting dash name bsc1038395 - Fix for potential segv introduced in v2.11.0 and later - Misc fixes and cleanups. - git 2.12.2 : - CLI output fixes - 'Dump http' transport fixes -...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1360-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes. Notable new/improved features : - Improved support for Hyper-V - Support for the tcpwestwood TCP scheduling algorithm The following security bugs were fixed : - CVE-2017-8106: The handleinvept...

SUSE SLED12 / SLES12 Security Update : rpcbind (SUSE-SU-2017:1328-1)

This update for rpcbind fixes the following issues : - CVE-2017-8779: A crafted UDP package could lead rcpbind to remote denial-of-service bsc1037559 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLED12 / SLES12 Security Update : rpcbind (SUSE-SU-2017:1336-1)

This update for rpcbind fixes the following issues : - CVE-2017-8779: A crafted UDP package could lead rcpbind to remote denial-of-service bsc1037559 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...