The following updates has been released for SUSE Linux Enterprise :
SUSE-SU-2017:2258-1: important: Security update for postgresql94
SUSE-SU-2017:2263-1: important: Security update for java-1_8_0-ibm
SUSE-SU-2017:2264-1: important: Security update for libzypp
SUSE-SU-2017:2258-1: important: Security update for postgresql94
SUSE-SU-2017:2263-1: important: Security update for java-1_8_0-ibm
SUSE-SU-2017:2264-1: important: Security update for libzypp
SUSE-SU-2017:2258-1: important: Security update for postgresql94
SUSE Security Update: Security update for postgresql94
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:2258-1
Rating: important
References: #1051684 #1051685 #1053259
Cross-References: CVE-2017-7546 CVE-2017-7547 CVE-2017-7548
Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise Server 11-SP3-LTSS
SUSE Linux Enterprise Point of Sale 11-SP3
SUSE Linux Enterprise Debuginfo 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
Postgresql94 was updated to 9.4.13 to fix the following issues:
* CVE-2017-7547: Further restrict visibility of
pg_user_mappings.umoptions, to protect passwords stored as user mapping
options. (bsc#1051685)
* CVE-2017-7546: Disallow empty passwords in all password-based
authentication methods. (bsc#1051684)
* CVE-2017-7548: lo_put() function ignores ACLs. (bsc#1053259)
The changelog for this release is here:
https://www.postgresql.org/docs/9.4/static/release-9-4-13.html
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11-SP4:
zypper in -t patch sdksp4-postgresql94-13247=1
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-postgresql94-13247=1
- SUSE Linux Enterprise Server 11-SP3-LTSS:
zypper in -t patch slessp3-postgresql94-13247=1
- SUSE Linux Enterprise Point of Sale 11-SP3:
zypper in -t patch sleposp3-postgresql94-13247=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-postgresql94-13247=1
- SUSE Linux Enterprise Debuginfo 11-SP3:
zypper in -t patch dbgsp3-postgresql94-13247=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):
postgresql94-devel-9.4.13-0.23.5.1
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
libecpg6-9.4.13-0.23.5.1
libpq5-9.4.13-0.23.5.1
postgresql94-9.4.13-0.23.5.1
postgresql94-contrib-9.4.13-0.23.5.1
postgresql94-docs-9.4.13-0.23.5.1
postgresql94-server-9.4.13-0.23.5.1
- SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):
libpq5-32bit-9.4.13-0.23.5.1
- SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64):
libecpg6-9.4.13-0.23.5.1
libpq5-9.4.13-0.23.5.1
postgresql94-9.4.13-0.23.5.1
postgresql94-contrib-9.4.13-0.23.5.1
postgresql94-docs-9.4.13-0.23.5.1
postgresql94-server-9.4.13-0.23.5.1
- SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64):
libpq5-32bit-9.4.13-0.23.5.1
- SUSE Linux Enterprise Point of Sale 11-SP3 (i586):
libecpg6-9.4.13-0.23.5.1
libpq5-9.4.13-0.23.5.1
postgresql94-9.4.13-0.23.5.1
postgresql94-contrib-9.4.13-0.23.5.1
postgresql94-docs-9.4.13-0.23.5.1
postgresql94-server-9.4.13-0.23.5.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
postgresql94-debuginfo-9.4.13-0.23.5.1
postgresql94-debugsource-9.4.13-0.23.5.1
postgresql94-libs-debuginfo-9.4.13-0.23.5.1
postgresql94-libs-debugsource-9.4.13-0.23.5.1
- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64):
postgresql94-debuginfo-9.4.13-0.23.5.1
postgresql94-debugsource-9.4.13-0.23.5.1
References:
https://www.suse.com/security/cve/CVE-2017-7546.html
https://www.suse.com/security/cve/CVE-2017-7547.html
https://www.suse.com/security/cve/CVE-2017-7548.html
https://bugzilla.suse.com/1051684
https://bugzilla.suse.com/1051685
https://bugzilla.suse.com/1053259
SUSE-SU-2017:2263-1: important: Security update for java-1_8_0-ibm
SUSE Security Update: Security update for java-1_8_0-ibm
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:2263-1
Rating: important
References: #1053431
Cross-References: CVE-2017-10053 CVE-2017-10067 CVE-2017-10074
CVE-2017-10078 CVE-2017-10081 CVE-2017-10087
CVE-2017-10089 CVE-2017-10090 CVE-2017-10096
CVE-2017-10101 CVE-2017-10102 CVE-2017-10105
CVE-2017-10107 CVE-2017-10108 CVE-2017-10109
CVE-2017-10110 CVE-2017-10111 CVE-2017-10115
CVE-2017-10116 CVE-2017-10125 CVE-2017-10243
Affected Products:
SUSE OpenStack Cloud 6
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Server for SAP 12-SP1
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Server 12-SP1-LTSS
______________________________________________________________________________
An update that fixes 21 vulnerabilities is now available.
Description:
This update for java-1_8_0-ibm fixes the following issues:
- Version update to 8.0-4.10 [bsc#1053431] CVE-2017-10111, CVE-2017-10110,
CVE-2017-10107, CVE-2017-10101, CVE-2017-10096, CVE-2017-10090,
CVE-2017-10089, CVE-2017-10087, CVE-2017-10102, CVE-2017-10116,
CVE-2017-10074, CVE-2017-10078, CVE-2017-10115, CVE-2017-10067,
CVE-2017-10125, CVE-2017-10243, CVE-2017-10109, CVE-2017-10108,
CVE-2017-10053, CVE-2017-10105, CVE-2017-10081: Multiple unspecified
vulnerabilities in multiple Java components could lead to code execution
or sandbox escape
More information can be found here:
https://developer.ibm.com/javasdk/support/security-vulnerabilities/#Oracle_
July_18_2017_CPU
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE OpenStack Cloud 6:
zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1389=1
- SUSE Linux Enterprise Software Development Kit 12-SP3:
zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1389=1
- SUSE Linux Enterprise Software Development Kit 12-SP2:
zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1389=1
- SUSE Linux Enterprise Server for SAP 12-SP1:
zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1389=1
- SUSE Linux Enterprise Server 12-SP3:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1389=1
- SUSE Linux Enterprise Server 12-SP2:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1389=1
- SUSE Linux Enterprise Server 12-SP1-LTSS:
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1389=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE OpenStack Cloud 6 (x86_64):
java-1_8_0-ibm-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Software Development Kit 12-SP3 (ppc64le s390x x86_64):
java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Software Development Kit 12-SP2 (ppc64le s390x x86_64):
java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64):
java-1_8_0-ibm-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64):
java-1_8_0-ibm-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP3 (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64):
java-1_8_0-ibm-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP2 (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64):
java-1_8_0-ibm-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5.1
- SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64):
java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5.1
java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5.1
References:
https://www.suse.com/security/cve/CVE-2017-10053.html
https://www.suse.com/security/cve/CVE-2017-10067.html
https://www.suse.com/security/cve/CVE-2017-10074.html
https://www.suse.com/security/cve/CVE-2017-10078.html
https://www.suse.com/security/cve/CVE-2017-10081.html
https://www.suse.com/security/cve/CVE-2017-10087.html
https://www.suse.com/security/cve/CVE-2017-10089.html
https://www.suse.com/security/cve/CVE-2017-10090.html
https://www.suse.com/security/cve/CVE-2017-10096.html
https://www.suse.com/security/cve/CVE-2017-10101.html
https://www.suse.com/security/cve/CVE-2017-10102.html
https://www.suse.com/security/cve/CVE-2017-10105.html
https://www.suse.com/security/cve/CVE-2017-10107.html
https://www.suse.com/security/cve/CVE-2017-10108.html
https://www.suse.com/security/cve/CVE-2017-10109.html
https://www.suse.com/security/cve/CVE-2017-10110.html
https://www.suse.com/security/cve/CVE-2017-10111.html
https://www.suse.com/security/cve/CVE-2017-10115.html
https://www.suse.com/security/cve/CVE-2017-10116.html
https://www.suse.com/security/cve/CVE-2017-10125.html
https://www.suse.com/security/cve/CVE-2017-10243.html
https://bugzilla.suse.com/1053431
SUSE-SU-2017:2264-1: important: Security update for libzypp
SUSE Security Update: Security update for libzypp
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:2264-1
Rating: important
References: #1009745 #1036659 #1038984 #1043218 #1045735
#1046417 #1047785 #1048315
Cross-References: CVE-2017-7435 CVE-2017-7436 CVE-2017-9269
Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________
An update that solves three vulnerabilities and has 5 fixes
is now available.
Description:
The Software Update Stack was updated to receive fixes and enhancements.
libzypp:
- CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows,
mainly for unsigned repositories and packages. (bsc#1045735, bsc#1038984)
- Fix gpg-pubkey release (creation time) computation. (bsc#1036659)
- Update lsof blacklist. (bsc#1046417)
- Re-probe on refresh if the repository type changes. (bsc#1048315)
- Propagate proper error code to DownloadProgressReport. (bsc#1047785)
- Allow to trigger an appdata refresh unconditionally. (bsc#1009745)
- Support custom repo variables defined in /etc/zypp/vars.d.
yast2-pkg-bindings:
- Do not crash when the repository URL is not defined. (bsc#1043218)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 12-SP3:
zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1390=1
- SUSE Linux Enterprise Server 12-SP3:
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1390=1
- SUSE Linux Enterprise Desktop 12-SP3:
zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1390=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):
libzypp-debuginfo-16.15.3-2.3.1
libzypp-debugsource-16.15.3-2.3.1
libzypp-devel-16.15.3-2.3.1
libzypp-devel-doc-16.15.3-2.3.1
- SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch):
yast2-pkg-bindings-devel-doc-3.2.4-2.3.1
- SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):
libzypp-16.15.3-2.3.1
libzypp-debuginfo-16.15.3-2.3.1
libzypp-debugsource-16.15.3-2.3.1
yast2-pkg-bindings-3.2.4-2.3.1
yast2-pkg-bindings-debuginfo-3.2.4-2.3.1
yast2-pkg-bindings-debugsource-3.2.4-2.3.1
- SUSE Linux Enterprise Desktop 12-SP3 (x86_64):
libzypp-16.15.3-2.3.1
libzypp-debuginfo-16.15.3-2.3.1
libzypp-debugsource-16.15.3-2.3.1
yast2-pkg-bindings-3.2.4-2.3.1
yast2-pkg-bindings-debuginfo-3.2.4-2.3.1
yast2-pkg-bindings-debugsource-3.2.4-2.3.1
References:
https://www.suse.com/security/cve/CVE-2017-7435.html
https://www.suse.com/security/cve/CVE-2017-7436.html
https://www.suse.com/security/cve/CVE-2017-9269.html
https://bugzilla.suse.com/1009745
https://bugzilla.suse.com/1036659
https://bugzilla.suse.com/1038984
https://bugzilla.suse.com/1043218
https://bugzilla.suse.com/1045735
https://bugzilla.suse.com/1046417
https://bugzilla.suse.com/1047785
https://bugzilla.suse.com/1048315
