Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:2013-1 Rating: important References: 1178630 1178703 Cross-References: CVE-2020-16013 CVE-2020-16016 CVE-2020-16017 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes three vulnerabilities ...

Security update for SDL (moderate)

openSUSE Security Update: Security update for SDL Announcement ID: openSUSE-SU-2020:1990-1 Rating: moderate References: 1141844 Cross-References: CVE-2019-13616 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for SDL fixes th...

Security update for python-waitress (moderate)

openSUSE Security Update: Security update for python-waitress Announcement ID: openSUSE-SU-2020:1922-1 Rating: moderate References: 1160790 1161088 1161089 1161670 Cross-References: CVE-2019-16785 CVE-2019-16786 CVE-2019-16789 CVE-2019-16792 Affected Products: openSUSE Leap 15.1 An update that...

Security update for singularity (moderate)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2020:1529-1 Rating: moderate References: 1176705 1176707 Cross-References: CVE-2020-25039 CVE-2020-25040 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes two vulnerabilities is now availabl...

Security update for libX11 (important)

openSUSE Security Update: Security update for libX11 Announcement ID: openSUSE-SU-2020:1182-1 Rating: important References: 1174628 Cross-References: CVE-2020-14344 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for libX11...

Security update for cairo (moderate)

openSUSE Security Update: Security update for cairo Announcement ID: openSUSE-SU-2020:1003-1 Rating: moderate References: 1049092 Cross-References: CVE-2017-9814 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for cairo fixes...

Security update for squid (important)

openSUSE Security Update: Security update for squid Announcement ID: openSUSE-SU-2020:0914-1 Rating: important References: 1173304 Cross-References: CVE-2020-14059 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for squid fix...

Security update for varnish (moderate)

openSUSE Security Update: Security update for varnish Announcement ID: openSUSE-SU-2020:0819-1 Rating: moderate References: 1169039 1169040 Cross-References: CVE-2019-20637 CVE-2020-11653 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes two vulnerabilities is now available...

Security update for libntlm (moderate)

openSUSE Security Update: Security update for libntlm Announcement ID: openSUSE-SU-2020:0806-1 Rating: moderate References: 1153669 Cross-References: CVE-2019-17455 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for libntlm...

Security update for rubygem-sprockets (moderate)

This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbiddenrequest?, which allowed remote attackers to read arbitrary files bsc1098369 This update was imported from...

Security update for xmltooling (important)

This update for xmltooling fixes the following issues: - CVE-2018-0486: Fixed a security bug when xmltooling mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD bsc1075975 This updat...

Security update for mariadb (important)

This update for mariadb fixes the following issues: - update to MariaDB 10.0.30 GA notable changes: XtraDB updated to 5.6.35-80.0 TokuDB updated to 5.6.35-80.0 PCRE updated to 8.40 MDEV-11027: better InnoDB crash recovery progress reporting MDEV-11520: improvements to how InnoDB data files are...

Security update for flash-player (important)

This update to Adobe Flash 24.0.0.194 fixes the following vulnerabilities advised under APSB17-02: - security bypass vulnerability that could lead to information disclosure CVE-2017-2938 - use-after-free vulnerabilities that could lead to code execution CVE-2017-2932, CVE-2017-2936, CVE-2017-2937...

Security update for Chromium (important)

This update to Chromium 54.0.2840.100 fixes the following vulnerabilities: - CVE-2016-5199: Heap corruption in FFmpeg boo1009892 - CVE-2016-5200: out of bounds memory access in v8 boo1009893 - CVE-2016-5201: info leak in extensions boo1009894 - CVE-2016-5202: various fixes from internal audits...

Security update for chromium (important)

This update to Chromium 54.0.2840.90: fixes the following security issues: - CVE-2016-5198: out of bounds memory access in v8 boo1008274...

Security update for ghostscript (important)

This update for ghostscript fixes the following issues: - CVE-2016-8602: Fixes a NULL dereference in .sethalftone5 boo1004237. - CVE-2013-5653, CVE-2016-7978, CVE-2016-7979: Fix multiple -dsafer related CVE's boo1001951...

Security update for systemd (important)

This update for systemd fixes the following security issue: - CVE-2016-7796: A zero-length message received over systemd's notification socket could make managerdispatchnotifyfd return an error and, as a side effect, disable the notification handler completely. As the notification socket is...

Security update for postgresql93 (important)

The postgresql server postgresql93 was updated to 9.3.14 fixes the following issues: Update to version 9.3.14: Fix possible mis-evaluation of nested CASE-WHEN expressions CVE-2016-5423, boo993454 Fix client programs' handling of special characters in database and role names CVE-2016-5424, boo9934...

Recommended update for flash-player (important)

This update for flash-player fixes the following security issues APSB16-29, boo998589: integer overflow vulnerability that could lead to code execution CVE-2016-4287. use-after-free vulnerabilities that could lead to code execution CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923,...

Security update for Chromium (important)

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities: - CVE-2016-1704: Various fixes from internal audits, fuzzing and other initiatives shared identifier boo985397...

Security update for mercurial (important)

mercurial was updated to fix three security issues. These security issues were fixed: - CVE-2016-3069: Arbitrary code execution when converting Git repos bsc973176. - CVE-2016-3068: Arbitrary code execution with Git subrepos bsc973177. - CVE-2016-3630: Remote code execution in binary delta decodi...

Security update for java-1_8_0-openjdk (important)

This update for java-180-openjdk to version jdk8u77-b03 fixes the following security issue: CVE-2016-0636: Improve MethodHandle consistency, which had allowed attackers to execute code. bsc972468 This update was imported from the SUSE:SLE-12-SP1:Update update project...

Security update for flash-player (important)

flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2016-1019: Adobe Flash Player earlier allowed remote attackers to cause a denial of service application crash or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016...

Security update for Chromium (important)

Chromium was updated to 49.0.2623.110 to fix the following security issues: - CVE-2016-1646: Out-of-bounds read in V8 - CVE-2016-1647: Use-after-free in Navigation - CVE-2016-1648: Use-after-free in Extensions - CVE-2016-1649: Buffer overflow in libANGLE - CVE-2016-1650: Various fixes from intern...

Security update for bind (important)

This update for bind fixes the following issues: CVE-2016-1285: remote DoS caused by malformed data on control channel CVE-2016-1286: remote DoS via assertion failure in parsing of signature records for DNAME records...

Security update for git (important)

This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code CVE-2016-2315, CVE-2016-2324, bsc971328...

Security update for Chromium (important)

Chromium was updated to 49.0.2623.75 to fix the following security issues: boo969333 - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free i...

Security update for Mozilla Firefox (important)

This update fixes the following security related issues by updating packages to a more recent version: Update of NSPR to 4.11 Update of NSS to 3.21 Update of Firefox to 44.0 MFSA 2016-01/CVE-2016-1930/CVE-2016-1931 Miscellaneous memory safety hazards MFSA 2016-02/CVE-2016-1933 bmo1231761 Out of...

Security update for grub2 (important)

This update for grub2 fixes the following issue: Changes in grub2: - CVE-2015-8370: Fix for overflow in grubpasswordget and grubuserget functions bnc956631...

Security update for xen (important)

xen was updated to fix 12 security issues. These security issues were fixed: - CVE-2015-7972: Populate-on-demand balloon size inaccuracy can crash guests bsc951845. - CVE-2015-7969: Leak of main per-domain vcpu pointer array DoS bsc950703. - CVE-2015-7969: Leak of per-domain profiling-related vcp...

Security update for MozillaThunderbird (important)

MozillaThunderbird was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4509: Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to execute arbitrary code via crafte...

Security update for bind (important)

bind was updated to fix one security issue. This security issue was fixed: - CVE-2015-5477: Remote DoS via TKEY queries boo939567 Exposure to this issue can not be prevented by either ACLs or configuration options limiting or denying service because the exploitable code occurs early in the packet...

Security update for Adobe Flash Player (important)

Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed: CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution bsc935701, APSB15-14...

Security update for xen (important)

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs. The following vulnerabilities were fixed: CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu XSA-128 boo931625 CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests XSA-129...

Security update for Adobe Flash Player (important)

Adobe Flash Player was updated to 11.2.202.457 to fix several security issues that could lead to remote code execution. An exploit for CVE-2015-3043 was reported to exist in the wild. The following vulnerabilities were fixed: Memory corruption vulnerabilities that could lead to code execution...

Security update for chromium (important)

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities. These security issues were fixed: - CVE-2015-1209: Use-after-free in DOM bnc916841. - CVE-2015-1210: Cross-origin-bypass in V8 bindings bnc916843. - CVE-2015-1211: Privilege escalation using service workers bnc916838. -...

Security update for ntp (critical)

The network timeservice ntp was updated to fix critical security issues bnc910764, CERT VU852879 A potential remote code execution problem was found inside ntpd. The functions cryptorecv when using autokey authentication, ctlputdata, and configure where updated to avoid buffer overflows that coul...

xen: security and bugfix update (important)

XEN was updated to fix various bugs and security issues. Security issues fixed: - bnc897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc895799 - CVE-2014-715...

update for flash-player (critical)

This critical flash-player update fixes the following CVEs: - Security update to 11.2.202.400 bnc891688: APSB14-18, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545...

update for flash-player (critical)

This flash-player update fixes a critical buffer overflow vulnerability that leads to arbitrary code execution. The flash-player package was updated to version 11.2.202.356. bnc875577, APSB14-13, CVE-2014-0515...

gnutls (critical)

The gnutls library was updated to fix SSL certificate validation. Remote man-in-the-middle attackers were able to make the verification believe that a SSL certificate is valid even though it was not. Also the TLS-CBC timing attack vulnerability was fixed...

flash-player to 11.2.202.327 (important)

Adobe Flash Player was updated to 11.2.202.327: bnc850220 APSB13-26, CVE-2013-5329, CVE-2013-5330...

xulrunner to 17.0.6esr (important)

Mozilla xulrunner was updated to 17.0.6esr bnc819204 MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards MFSA 2013-42/CVE-2013-1670 bmo853709 Privileged access for content level constructor MFSA 2013-46/CVE-2013-1674 bmo860971 Use-after-free with video and onresize event...

NRPE metacharacter filtering omission (important)

NRPE the Nagios Remote Plug-In Executor allows the passing of $ to plugins/scripts which, if run under bash, will execute that shell command under a subprocess and pass the output as a parameter to the called script. Using this, it is possible to get called scripts, such as checkhttp, to execute...

libvirt to fix use-after-free in virNetMessageFree() (important)

libvirt was updated to fix some bugs and security issues: Security issues fixed: - Fix crash on error paths of message dispatching, CVE-2013-0170 bnc800976 - security: Fix libvirtd crash possibility CVE-2012-4423 bnc780432 Also bugs were fixed: - qemu: Fix probing for guest capabilities bnc772586...

exim: overflow in DKIM handling fixed (critical)

This update fixes a remotely exploitable overflow in DKIM handling...

Security Update for Xen (important)

Security Update for Xen Following bug and security fixes were applied: - bnc776995 - attaching scsi control luns with pvscsi - xend/pvscsi: fix passing of SCSI control LUNs xen-bug776995-pvscsi-no-devname.patch - xend/pvscsi: fix usage of persistant device names for SCSI devices...

freetype2 (important)

This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts CVE-2011-3256, CVE-2011-3439...

freetype2 (important)

This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts CVE-2011-3256, CVE-2011-3439...

pam: fixing stack overflow (CVE-2011-3148) and DoS (CVE-2011-3149) (important)

The pamenv module is vulnerable to a stack overflow CVE-2011-3148 and a DoS condition CVE-2011-3149 when parsing users .pamenvironment files...