MGASA-2015-0115 Updated firefox packages fix security vulnerabilities

A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileges of the user invoking Firefox...

MGASA-2015-0098 Updated putty and filezilla packages fix CVE-2015-2157

Updated putty and filezilla packages fix security vulnerability: PuTTY suite versions 0.51 to 0.63 fail to clear SSH-2 private key information from memory when loading and saving key files to disk, leading to potential disclosure. The issue affects keys stored on disk in encrypted and unencrypted...

SUSE-SU-2015:0529-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive various security and bugfixes. This update contains the following feature enablements: - The remote block device rbd and ceph drivers have been enabled and are now supported. FATE318350 These can be used e.g. for accessing the...

MGASA-2015-0077 Updated kernel-rt packages fix security vulnerabilities

This kernel-rt update provides as upgrade to upstream 3.14 longterm branch, currently based on 3.14.32 and fixes the following security issues: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types,...

MGASA-2015-0070 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.32 and fixes the following security issues: The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by...

SUSE-SU-2015:0306-1 Security update for java-1_6_0-ibm

java-160-ibm was updated to fix two security issues. These security issues were fixed: - CVE-2014-8892: Unspecified vulnerability bnc916265. - CVE-2014-8891: Unspecified vulnerability bnc916266...

MGASA-2015-0053 Updated vlc packages fix security vulnerabilities

Updated vlc packages fix security vulnerabilities: On 32 bit builds, parsing of update status files with a size of 4294967295 or more lead to an integer truncation caused by a cast to sizet in a call to malloc and a subsequent buffer overflow. This happened prior to checking the files' signature...

SUSE-SU-2015:0305-1 Security update for compat-openssl098

The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities: CVE-2014-3570: Bignum squaring BNsqr may produce incorrect results on some platforms, including x8664. CVE-2014-3571: Fix crash in dtls1getrecord whilst in the listen state where you get two separate rea...

SUSE-SU-2015:0288-1 Security update for jasper

jasper was updated to fix two security issues. These security issues were fixed: - CVE-2014-8157: Off-by-one error in the jpcdecprocesssot function in JasPer 1.900.1 and earlier allowed remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted JPEG 2000...

MGASA-2015-0007 Updated webmin packages fix security vulnerabilities

Updated webmin package fixes security vulnerability: The webmin package has been updated to version 1.730 to fix possible security issues that could be caused by malicious symlinks when reading mail. The updated version also has various bug fixes, translation updates, and functionality...

MGASA-2015-0006 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.27 and fixes the following security issues: arch/x86/kernel/tls.c in the Thread Local Storage TLS implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier...

[SECURITY] [DLA 129-1] polarssl security update

Package : polarssl Version : 1.2.9-1deb6u3 CVE ID : CVE-2014-8628 It was discovered that a memory leak in parsing X.509 certificates may result in denial of service...

SUSE-SU-2015:1086-4 Security update for IBM Java

java-170-ibm has been updated to version 1.7.0sr7.2 to fix 21 security issues. These security issues have been fixed: Unspecified vulnerability CVE-2014-3065. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for...

MGASA-2014-0475 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.10.60 and fixes the following security issues: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows...

MGASA-2014-0474 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.24 and fixes the following security issues: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows...

MGASA-2014-0455 Updated kernel-vserver packages fix security vulnerabilities

This kernel-vserver update provides an upgrade to the upstream 3.14 -longterm branch, currently based on 3.14.23 and fixes the following security issues: The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a...

MGASA-2014-0453 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream -longterm 3.14.23 and fixes the following security issues: The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to 1 caus...

MGASA-2014-0451 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream -longterm 3.14.23 and fixes the following security issues: The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to ...

MGASA-2014-0433 Updated zabbix package fixes security vulnerability

It was reported that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local...

MGASA-2014-0365 Updated libgcrypt packages fix CVE-2014-5270

Updated libgcrypt packages fix security vulnerability: The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270...