news

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2696-1 Rating: important References: #1007829 Cross-References: CVE-2016-8864 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following security issue: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1587=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1587=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): bind-doc-9.9.9P1-28.23.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): bind-9.9.9P1-28.23.1 bind-chrootenv-9.9.9P1-28.23.1 bind-debuginfo-9.9.9P1-28.23.1 bind-debugsource-9.9.9P1-28.23.1 bind-libs-32bit-9.9.9P1-28.23.1 bind-libs-9.9.9P1-28.23.1 bind-libs-debuginfo-32bit-9.9.9P1-28.23.1 bind-libs-debuginfo-9.9.9P1-28.23.1 bind-utils-9.9.9P1-28.23.1 bind-utils-debuginfo-9.9.9P1-28.23.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-28.23.1 bind-chrootenv-9.9.9P1-28.23.1 bind-debuginfo-9.9.9P1-28.23.1 bind-debugsource-9.9.9P1-28.23.1 bind-libs-9.9.9P1-28.23.1 bind-libs-debuginfo-9.9.9P1-28.23.1 bind-utils-9.9.9P1-28.23.1 bind-utils-debuginfo-9.9.9P1-28.23.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-28.23.1 bind-libs-debuginfo-32bit-9.9.9P1-28.23.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): bind-doc-9.9.9P1-28.23.1 References: https://www.suse.com/security/cve/CVE-2016-8864.html https://bugzilla.suse.com/1007829 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2697-1 Rating: important References: #1007829 #965748 Cross-References: CVE-2016-8864 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). - Fix BIND to return a valid hostname in response to ldapdump queries. (bsc#965748) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1588=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1588=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1588=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1588=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1588=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1588=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-devel-9.9.9P1-49.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-devel-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): bind-9.9.9P1-49.1 bind-chrootenv-9.9.9P1-49.1 bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-libs-9.9.9P1-49.1 bind-libs-debuginfo-9.9.9P1-49.1 bind-utils-9.9.9P1-49.1 bind-utils-debuginfo-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): bind-libs-32bit-9.9.9P1-49.1 bind-libs-debuginfo-32bit-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): bind-doc-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): bind-9.9.9P1-49.1 bind-chrootenv-9.9.9P1-49.1 bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-libs-9.9.9P1-49.1 bind-libs-debuginfo-9.9.9P1-49.1 bind-utils-9.9.9P1-49.1 bind-utils-debuginfo-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): bind-libs-32bit-9.9.9P1-49.1 bind-libs-debuginfo-32bit-9.9.9P1-49.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): bind-doc-9.9.9P1-49.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-libs-32bit-9.9.9P1-49.1 bind-libs-9.9.9P1-49.1 bind-libs-debuginfo-32bit-9.9.9P1-49.1 bind-libs-debuginfo-9.9.9P1-49.1 bind-utils-9.9.9P1-49.1 bind-utils-debuginfo-9.9.9P1-49.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): bind-debuginfo-9.9.9P1-49.1 bind-debugsource-9.9.9P1-49.1 bind-libs-32bit-9.9.9P1-49.1 bind-libs-9.9.9P1-49.1 bind-libs-debuginfo-32bit-9.9.9P1-49.1 bind-libs-debuginfo-9.9.9P1-49.1 bind-utils-9.9.9P1-49.1 bind-utils-debuginfo-9.9.9P1-49.1 References: https://www.suse.com/security/cve/CVE-2016-8864.html https://bugzilla.suse.com/1007829 https://bugzilla.suse.com/965748 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

** TECHSPOT ------------------------------------------------------------ ** Wallpaper resources to keep your desktop and phone home screen fresh ------------------------------------------------------------ ** http://www.techspot.com/article/1274-desktop-mobile-wallpapers/ ------------------------------------------------------------ There’s no shortage of great places to find something to revitalize your home screens, whether you are into beautiful landscapes, abstract illustrations or simple designs and patterns. If you are still rocking your device’s default wallpaper and need some inspiration to mix it up a bit here are some great resources to get you started. Thank you. Julio Franco Executive Editor | TECHSPOT (http://www.techspot.com) ( -at -) juliofranco ----------------------------------- ============================================================ Our mailing address is: TechSpot 8237 NW 68 St Miami, FL 33166 USA

http://benchmarkreviews.us10.list-manage1.com/track/click?u=9a2f239b17114c9008e3dfda9&id=2efda267c7&e=8138df6da5 ** Benchmark Reviews Presents: ------------------------------------------------------------ nzxt-s340-elite-finished-build TITLE: NZXT S340 Elite ATX Case Review (http://benchmarkreviews.us10.list-manage.com/track/click?u=9a2f239b17114c9008e3dfda9&id=989fb53120&e=8138df6da5) QUOTE: The NZXT S340 Elite computer case expands from the original S340 with its improved cable management system, VR capabilities, and a large tempered glass side panel. Because the Elite is geared towards VR, extra USB ports with an HDMI port are located on the front. Included with the S340 Elite is a magnetic cable management puck to store VR or audio headsets for easy access. A side mounted bracket for a 2.5″ SSD is located on the side of the power supply housing and the tempered glass side panel can show off the internal components. Benchmark Reviews will be taking a look at the NZXT S340 Elite in Matte Black. LINK: http://benchmarkreviews.us10.list-manage1.com/track/click?u=9a2f239b17114c9008e3dfda9&id=ddc2b1f692&e=8138df6da5 IMAGE: http://benchmarkreviews.us10.list-manage.com/track/click?u=9a2f239b17114c9008e3dfda9&id=54f042d865&e=8138df6da5 ============================================================

Title: Thermalright Le Grand Macho RT CPU Cooler Review ( -at -) NikKTech Description: Thanks to an 140mm PWM fluid-dynamic bearing fan the already excellent Le Grand Macho by Thermalright has not only gotten even better but it's still inaudible even at load. Article Link: http://www.nikktech.com/main/articles/pc-hardware/cpu-cooling/cpu-air-cooler s/7107-thermalright-le-grand-macho-rt-cpu-cooler-review Image Link: http://www.nikktech.com/main/images/pics/reviews/thermalright/le_grand_macho _rt/le_grand_macho_rta.jpg A News Post Would Be Appreciated. Thanks In Advance. Sincerely Nik Kastrantas

Hi, I just uploaded OpenSSL 1.1.0 to unstable. There are still many packages that fail to build using OpenSSL 1.1.0. For most packages it should be easy to migrate 1.1.0. The most common problems when going to OpenSSL 1.1.0 are: - configure trying to detect a function that's now a macro. - Accessing members of structures that have now become opaque. You now need to use function to get or set them. The changes required are ussually very easy and do not take a long time to implement. Many upstream projects have already done the work or are working on it. Fedora is also doing the OpenSSL 1.1.0 migration. So both places are a good place to look at to see if they have already done the work. There might also be packages for which the changes are more involved and that can't be fixed in time for the release. If you want to stay with OpenSSL 1.0.2 you need to change your Build-Depends from libssl-dev to libssl1.0-dev. I would like to encourage that at least the packages that are making use of libssl and not just libcrypto move to OpenSSL 1.1.0 because it contains important new features. It adds support for among other things of: - Extended master secret: This fixes the triple handshake problem in TLS. - Chacha20-poly1305 - X25519 If you have any problems feel free to contact us. Kurt

Dear Editors, we just posted a new article which might be interesting to your readers. A post in your news section would be appreciated. Title: HiFiMAN HE-1000 V2 Planar Magnetic Headphones Link: http://www.techpowerup.com/reviews/HiFiMAN/HE-1000_v2 Brief: The HiFiMAN HE-1000 V2 is the newest über-high-end offering from the company that spawned the newest generation of high-end planar magnetic headphones. The HE-1000 V2 shares most of its DNA with the V1, but there are several significant updates to pads, cable, and headband.

View this email in your browser (http://us3.campaign-archive2.com/?u=efc4c507c2cf964fc2462caca&id=4ded4e88d1&e=0c004f9c13) Dell's Alienware division stepped up today with a new, compact and powerful weapon in its laptop arsenal with the announcement of the redesigned Alienware 13 notebook. Now, before you get all misty about the headline, we understand Apple's latest MacBook isn't optimized for gaming, but the comparison of what can be done in a 13-inch notebook frame can still be made. We're just having a little fun with it... It's built with some of the highest-end notebook components on the market currently, save for perhaps its GPU, which is more of a desktop-class graphics chip, actually. In addition, Alienware's delicious OLED display option returns in to machine with 400 nits of brightness, a QHD 2560X1440 resolution and gobs of saturation and pop. Alienware 13 R3 With GeForce 10 And OLED Eats MacBook Pros For Lunch (Hands-On) (http://hothardware.us3.list-manage2.com/track/click?u=efc4c507c2cf964fc2462caca&id=0c85d9ff1a&e=0c004f9c13) http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=3b7c7e58b6&e=0c004f9c13 http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=aea9a3fa4c&e=0c004f9c13 Best Regards, HotHardware.com (http://hothardware.us3.list-manage1.com/track/click?u=efc4c507c2cf964fc2462caca&id=8059501ab2&e=0c004f9c13) http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=d1c83f2375&e=0c004f9c13 http://hothardware.us3.list-manage2.com/track/click?u=efc4c507c2cf964fc2462caca&id=c2cc9c9287&e=0c004f9c13 http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=b137257f3e&e=0c004f9c13 ============================================================

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: Red Hat Enterprise Linux 6.6 Extended Update Support Retirement Notice Advisory ID: RHSA-2016:2135-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2135.html Issue date: 2016-11-01 ===================================================================== 1. Summary: This is the final notification for the retirement of Red Hat Enterprise Linux 6.6 Extended Update Support (EUS). This notification applies only to those customers subscribed to the Extended Update Support (EUS) channel for Red Hat Enterprise Linux 6.6. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server EUS (v. 6.6) - i386, ppc64, s390x, x86_64 3. Description: In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 6.6 was retired on October 31, 2016, and active support is no longer provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 6.6 EUS after October 31, 2016. In addition, technical support through Red Hat's Global Support Services will be limited as described under "non-current minor releases" in the Knowledge Base article located at https://access.redhat.com/articles/64664 after this date. We encourage customers to migrate from Red Hat Enterprise Linux 6.6 to a more recent version of Red Hat Enterprise Linux. As a benefit of the Red Hat subscription model, customers can use their active subscriptions to entitle any system on any currently supported Red Hat Enterprise Linux release. Details of the Red Hat Enterprise Linux life cycle can be found here: https://access.redhat.com/support/policy/updates/errata/ 4. Solution: This erratum contains an updated redhat-release-server package that provides a copy of this retirement notice in the "/usr/share/doc/" directory. 5. Package List: Red Hat Enterprise Linux Server EUS (v. 6.6): Source: redhat-release-server-6Server-6.6.0.5.el6_6.src.rpm i386: redhat-release-server-6Server-6.6.0.5.el6_6.i686.rpm ppc64: redhat-release-server-6Server-6.6.0.5.el6_6.ppc64.rpm s390x: redhat-release-server-6Server-6.6.0.5.el6_6.s390x.rpm x86_64: redhat-release-server-6Server-6.6.0.5.el6_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 6. References: https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/articles/64664 https://access.redhat.com/support/policy/updates/errata/ 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGOoSXlSAg2UNWIIRAmp+AKC8ZMA74fsu4wUQKi2A52BrF2cOCwCfc/tp DVh0OZUNDYK/BSZkpxDO5vI= =Ckvo -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: Red Hat Enterprise Developer Toolset Version 3.x Retirement Notice Advisory ID: RHSA-2016:2134-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2134.html Issue date: 2016-11-01 ===================================================================== 1. Summary: This is the final notification for the retirement of Red Hat Developer Toolset Version 3.x. This notification applies only to those customers subscribed to the channel for Red Hat Developer Toolset Version 3.x. 2. Description: In accordance with the Red Hat Enterprise Developer Toolset Life Cycle policy, the Red Hat Developer Toolset Version 3.x offering was retired on October 31, 2016, and active support is no longer provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or Urgent priority bug fixes, for Developer Toolset Version 3.x after October 31, 2016. In addition, technical support through Red Hat's Global Support Services will be limited as described under "non-current minor releases" in the Knowledge Base article located at https://access.redhat.com/articles/64664 after this date. We encourage customers using Red Hat Enterprise Developer Toolset Version 3.x to migrate to a more recent release of Red Hat Developer Toolset. As a benefit of the Red Hat subscription model, customers can use their active Red Hat Developer Toolset subscriptions to entitle any system on a currently supported version of this product. Details of the Red Hat Enterprise Developer Toolset life cycle can be found here: https://access.redhat.com/support/policy/updates/dts/ 3. Solution: Red Hat Enterprise Developer Toolset Version 3.x was retired on October 31, 2016. Customers using Red Hat Enterprise Developer Toolset Version 3.x are encouraged to migrate to a newer release of Red Hat Enterprise Developer Toolset, and can find additional details on the Red Hat Enterprise Developer Toolset life cycle page at https://access.redhat.com/support/policy/updates/dts/ 4. References: https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/support/policy/updates/dts/ 5. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGMaZXlSAg2UNWIIRAoOeAJ9c7OjaipfqhnqBHl5zgRg9cy+mrQCgvMUu TNwgpaY7orEMZhSI+phAle8= =7O35 -----END PGP SIGNATURE----- --

SUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2470-2 Rating: important References: #1001652 #985201 Cross-References: CVE-2016-2178 CVE-2016-2183 CVE-2016-5325 CVE-2016-6304 CVE-2016-6306 CVE-2016-7052 CVE-2016-7099 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues: * Nodejs embedded openssl version update + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178, CVE-2016-6306, CVE-2016-7052) + remove support for dynamic 3rd party engine modules * http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. (CVE-2016-5325, bsc#985201) * tls: properly validate wildcard certificates (CVE-2016-7099, bsc#1001652) * buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1439=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64): nodejs4-4.6.0-8.1 nodejs4-debuginfo-4.6.0-8.1 nodejs4-debugsource-4.6.0-8.1 nodejs4-devel-4.6.0-8.1 npm4-4.6.0-8.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): nodejs4-docs-4.6.0-8.1 References: https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-5325.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://www.suse.com/security/cve/CVE-2016-7052.html https://www.suse.com/security/cve/CVE-2016-7099.html https://bugzilla.suse.com/1001652 https://bugzilla.suse.com/985201 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

SUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2460-2 Rating: important References: #1001950 #987580 #988032 #991422 #991424 #991426 #991427 #991428 #991429 #991430 #991434 #991437 #995512 #997206 #997207 #997208 #997210 #997211 #997220 #997225 #997230 #997247 #997248 #997257 #999313 #999679 #999680 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-4473 CVE-2016-5399 CVE-2016-6128 CVE-2016-6161 CVE-2016-6207 CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127 CVE-2016-7128 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-7133 CVE-2016-7134 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that solves 29 vulnerabilities and has two fixes is now available. Description: This update for php7 fixes the following security issues: * CVE-2016-6128: Invalid color index not properly handled [bsc#987580] * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] * CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422] * CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] * CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] * CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] * CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] * CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] * CVE-2016-5399: Improper error handling in bzread() [bsc#991430] * CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] * CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file() * CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization * CVE-2016-7125: PHP Session Data Injection Vulnerability * CVE-2016-7126: select_colors write out-of-bounds * CVE-2016-7127: imagegammacorrect allowed arbitrary write access * CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF * CVE-2016-7129: wddx_deserialize allowed illegal memory access * CVE-2016-7131: wddx_deserialize null dereference with invalid xml * CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element * CVE-2016-7133: memory allocator fails to realloc small block to large one * CVE-2016-7134: Heap overflow in the function curl_escape * CVE-2016-7130: wddx_deserialize null dereference * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7418: Null pointer dereference in php_wddx_push_element * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1434=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64): apache2-mod_php7-7.0.7-15.1 apache2-mod_php7-debuginfo-7.0.7-15.1 php7-7.0.7-15.1 php7-bcmath-7.0.7-15.1 php7-bcmath-debuginfo-7.0.7-15.1 php7-bz2-7.0.7-15.1 php7-bz2-debuginfo-7.0.7-15.1 php7-calendar-7.0.7-15.1 php7-calendar-debuginfo-7.0.7-15.1 php7-ctype-7.0.7-15.1 php7-ctype-debuginfo-7.0.7-15.1 php7-curl-7.0.7-15.1 php7-curl-debuginfo-7.0.7-15.1 php7-dba-7.0.7-15.1 php7-dba-debuginfo-7.0.7-15.1 php7-debuginfo-7.0.7-15.1 php7-debugsource-7.0.7-15.1 php7-dom-7.0.7-15.1 php7-dom-debuginfo-7.0.7-15.1 php7-enchant-7.0.7-15.1 php7-enchant-debuginfo-7.0.7-15.1 php7-exif-7.0.7-15.1 php7-exif-debuginfo-7.0.7-15.1 php7-fastcgi-7.0.7-15.1 php7-fastcgi-debuginfo-7.0.7-15.1 php7-fileinfo-7.0.7-15.1 php7-fileinfo-debuginfo-7.0.7-15.1 php7-fpm-7.0.7-15.1 php7-fpm-debuginfo-7.0.7-15.1 php7-ftp-7.0.7-15.1 php7-ftp-debuginfo-7.0.7-15.1 php7-gd-7.0.7-15.1 php7-gd-debuginfo-7.0.7-15.1 php7-gettext-7.0.7-15.1 php7-gettext-debuginfo-7.0.7-15.1 php7-gmp-7.0.7-15.1 php7-gmp-debuginfo-7.0.7-15.1 php7-iconv-7.0.7-15.1 php7-iconv-debuginfo-7.0.7-15.1 php7-imap-7.0.7-15.1 php7-imap-debuginfo-7.0.7-15.1 php7-intl-7.0.7-15.1 php7-intl-debuginfo-7.0.7-15.1 php7-json-7.0.7-15.1 php7-json-debuginfo-7.0.7-15.1 php7-ldap-7.0.7-15.1 php7-ldap-debuginfo-7.0.7-15.1 php7-mbstring-7.0.7-15.1 php7-mbstring-debuginfo-7.0.7-15.1 php7-mcrypt-7.0.7-15.1 php7-mcrypt-debuginfo-7.0.7-15.1 php7-mysql-7.0.7-15.1 php7-mysql-debuginfo-7.0.7-15.1 php7-odbc-7.0.7-15.1 php7-odbc-debuginfo-7.0.7-15.1 php7-opcache-7.0.7-15.1 php7-opcache-debuginfo-7.0.7-15.1 php7-openssl-7.0.7-15.1 php7-openssl-debuginfo-7.0.7-15.1 php7-pcntl-7.0.7-15.1 php7-pcntl-debuginfo-7.0.7-15.1 php7-pdo-7.0.7-15.1 php7-pdo-debuginfo-7.0.7-15.1 php7-pgsql-7.0.7-15.1 php7-pgsql-debuginfo-7.0.7-15.1 php7-phar-7.0.7-15.1 php7-phar-debuginfo-7.0.7-15.1 php7-posix-7.0.7-15.1 php7-posix-debuginfo-7.0.7-15.1 php7-pspell-7.0.7-15.1 php7-pspell-debuginfo-7.0.7-15.1 php7-shmop-7.0.7-15.1 php7-shmop-debuginfo-7.0.7-15.1 php7-snmp-7.0.7-15.1 php7-snmp-debuginfo-7.0.7-15.1 php7-soap-7.0.7-15.1 php7-soap-debuginfo-7.0.7-15.1 php7-sockets-7.0.7-15.1 php7-sockets-debuginfo-7.0.7-15.1 php7-sqlite-7.0.7-15.1 php7-sqlite-debuginfo-7.0.7-15.1 php7-sysvmsg-7.0.7-15.1 php7-sysvmsg-debuginfo-7.0.7-15.1 php7-sysvsem-7.0.7-15.1 php7-sysvsem-debuginfo-7.0.7-15.1 php7-sysvshm-7.0.7-15.1 php7-sysvshm-debuginfo-7.0.7-15.1 php7-tokenizer-7.0.7-15.1 php7-tokenizer-debuginfo-7.0.7-15.1 php7-wddx-7.0.7-15.1 php7-wddx-debuginfo-7.0.7-15.1 php7-xmlreader-7.0.7-15.1 php7-xmlreader-debuginfo-7.0.7-15.1 php7-xmlrpc-7.0.7-15.1 php7-xmlrpc-debuginfo-7.0.7-15.1 php7-xmlwriter-7.0.7-15.1 php7-xmlwriter-debuginfo-7.0.7-15.1 php7-xsl-7.0.7-15.1 php7-xsl-debuginfo-7.0.7-15.1 php7-zip-7.0.7-15.1 php7-zip-debuginfo-7.0.7-15.1 php7-zlib-7.0.7-15.1 php7-zlib-debuginfo-7.0.7-15.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php7-pear-7.0.7-15.1 php7-pear-Archive_Tar-7.0.7-15.1 References: https://www.suse.com/security/cve/CVE-2016-4473.html https://www.suse.com/security/cve/CVE-2016-5399.html https://www.suse.com/security/cve/CVE-2016-6128.html https://www.suse.com/security/cve/CVE-2016-6161.html https://www.suse.com/security/cve/CVE-2016-6207.html https://www.suse.com/security/cve/CVE-2016-6289.html https://www.suse.com/security/cve/CVE-2016-6290.html https://www.suse.com/security/cve/CVE-2016-6291.html https://www.suse.com/security/cve/CVE-2016-6292.html https://www.suse.com/security/cve/CVE-2016-6295.html https://www.suse.com/security/cve/CVE-2016-6296.html https://www.suse.com/security/cve/CVE-2016-6297.html https://www.suse.com/security/cve/CVE-2016-7124.html https://www.suse.com/security/cve/CVE-2016-7125.html https://www.suse.com/security/cve/CVE-2016-7126.html https://www.suse.com/security/cve/CVE-2016-7127.html https://www.suse.com/security/cve/CVE-2016-7128.html https://www.suse.com/security/cve/CVE-2016-7129.html https://www.suse.com/security/cve/CVE-2016-7130.html https://www.suse.com/security/cve/CVE-2016-7131.html https://www.suse.com/security/cve/CVE-2016-7132.html https://www.suse.com/security/cve/CVE-2016-7133.html https://www.suse.com/security/cve/CVE-2016-7134.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/1001950 https://bugzilla.suse.com/987580 https://bugzilla.suse.com/988032 https://bugzilla.suse.com/991422 https://bugzilla.suse.com/991424 https://bugzilla.suse.com/991426 https://bugzilla.suse.com/991427 https://bugzilla.suse.com/991428 https://bugzilla.suse.com/991429 https://bugzilla.suse.com/991430 https://bugzilla.suse.com/991434 https://bugzilla.suse.com/991437 https://bugzilla.suse.com/995512 https://bugzilla.suse.com/997206 https://bugzilla.suse.com/997207 https://bugzilla.suse.com/997208 https://bugzilla.suse.com/997210 https://bugzilla.suse.com/997211 https://bugzilla.suse.com/997220 https://bugzilla.suse.com/997225 https://bugzilla.suse.com/997230 https://bugzilla.suse.com/997247 https://bugzilla.suse.com/997248 https://bugzilla.suse.com/997257 https://bugzilla.suse.com/999313 https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

SUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2683-2 Rating: important References: #1001900 #1004924 #1005274 Cross-References: CVE-2016-6911 CVE-2016-7568 CVE-2016-8670 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php7 fixes the following security issue: - CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900) - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1576=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64): apache2-mod_php7-7.0.7-20.1 apache2-mod_php7-debuginfo-7.0.7-20.1 php7-7.0.7-20.1 php7-bcmath-7.0.7-20.1 php7-bcmath-debuginfo-7.0.7-20.1 php7-bz2-7.0.7-20.1 php7-bz2-debuginfo-7.0.7-20.1 php7-calendar-7.0.7-20.1 php7-calendar-debuginfo-7.0.7-20.1 php7-ctype-7.0.7-20.1 php7-ctype-debuginfo-7.0.7-20.1 php7-curl-7.0.7-20.1 php7-curl-debuginfo-7.0.7-20.1 php7-dba-7.0.7-20.1 php7-dba-debuginfo-7.0.7-20.1 php7-debuginfo-7.0.7-20.1 php7-debugsource-7.0.7-20.1 php7-dom-7.0.7-20.1 php7-dom-debuginfo-7.0.7-20.1 php7-enchant-7.0.7-20.1 php7-enchant-debuginfo-7.0.7-20.1 php7-exif-7.0.7-20.1 php7-exif-debuginfo-7.0.7-20.1 php7-fastcgi-7.0.7-20.1 php7-fastcgi-debuginfo-7.0.7-20.1 php7-fileinfo-7.0.7-20.1 php7-fileinfo-debuginfo-7.0.7-20.1 php7-fpm-7.0.7-20.1 php7-fpm-debuginfo-7.0.7-20.1 php7-ftp-7.0.7-20.1 php7-ftp-debuginfo-7.0.7-20.1 php7-gd-7.0.7-20.1 php7-gd-debuginfo-7.0.7-20.1 php7-gettext-7.0.7-20.1 php7-gettext-debuginfo-7.0.7-20.1 php7-gmp-7.0.7-20.1 php7-gmp-debuginfo-7.0.7-20.1 php7-iconv-7.0.7-20.1 php7-iconv-debuginfo-7.0.7-20.1 php7-imap-7.0.7-20.1 php7-imap-debuginfo-7.0.7-20.1 php7-intl-7.0.7-20.1 php7-intl-debuginfo-7.0.7-20.1 php7-json-7.0.7-20.1 php7-json-debuginfo-7.0.7-20.1 php7-ldap-7.0.7-20.1 php7-ldap-debuginfo-7.0.7-20.1 php7-mbstring-7.0.7-20.1 php7-mbstring-debuginfo-7.0.7-20.1 php7-mcrypt-7.0.7-20.1 php7-mcrypt-debuginfo-7.0.7-20.1 php7-mysql-7.0.7-20.1 php7-mysql-debuginfo-7.0.7-20.1 php7-odbc-7.0.7-20.1 php7-odbc-debuginfo-7.0.7-20.1 php7-opcache-7.0.7-20.1 php7-opcache-debuginfo-7.0.7-20.1 php7-openssl-7.0.7-20.1 php7-openssl-debuginfo-7.0.7-20.1 php7-pcntl-7.0.7-20.1 php7-pcntl-debuginfo-7.0.7-20.1 php7-pdo-7.0.7-20.1 php7-pdo-debuginfo-7.0.7-20.1 php7-pgsql-7.0.7-20.1 php7-pgsql-debuginfo-7.0.7-20.1 php7-phar-7.0.7-20.1 php7-phar-debuginfo-7.0.7-20.1 php7-posix-7.0.7-20.1 php7-posix-debuginfo-7.0.7-20.1 php7-pspell-7.0.7-20.1 php7-pspell-debuginfo-7.0.7-20.1 php7-shmop-7.0.7-20.1 php7-shmop-debuginfo-7.0.7-20.1 php7-snmp-7.0.7-20.1 php7-snmp-debuginfo-7.0.7-20.1 php7-soap-7.0.7-20.1 php7-soap-debuginfo-7.0.7-20.1 php7-sockets-7.0.7-20.1 php7-sockets-debuginfo-7.0.7-20.1 php7-sqlite-7.0.7-20.1 php7-sqlite-debuginfo-7.0.7-20.1 php7-sysvmsg-7.0.7-20.1 php7-sysvmsg-debuginfo-7.0.7-20.1 php7-sysvsem-7.0.7-20.1 php7-sysvsem-debuginfo-7.0.7-20.1 php7-sysvshm-7.0.7-20.1 php7-sysvshm-debuginfo-7.0.7-20.1 php7-tokenizer-7.0.7-20.1 php7-tokenizer-debuginfo-7.0.7-20.1 php7-wddx-7.0.7-20.1 php7-wddx-debuginfo-7.0.7-20.1 php7-xmlreader-7.0.7-20.1 php7-xmlreader-debuginfo-7.0.7-20.1 php7-xmlrpc-7.0.7-20.1 php7-xmlrpc-debuginfo-7.0.7-20.1 php7-xmlwriter-7.0.7-20.1 php7-xmlwriter-debuginfo-7.0.7-20.1 php7-xsl-7.0.7-20.1 php7-xsl-debuginfo-7.0.7-20.1 php7-zip-7.0.7-20.1 php7-zip-debuginfo-7.0.7-20.1 php7-zlib-7.0.7-20.1 php7-zlib-debuginfo-7.0.7-20.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php7-pear-7.0.7-20.1 php7-pear-Archive_Tar-7.0.7-20.1 References: https://www.suse.com/security/cve/CVE-2016-6911.html https://www.suse.com/security/cve/CVE-2016-7568.html https://www.suse.com/security/cve/CVE-2016-8670.html https://bugzilla.suse.com/1001900 https://bugzilla.suse.com/1004924 https://bugzilla.suse.com/1005274 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2477-2 Rating: important References: #999679 #999680 #999682 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1446=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64): apache2-mod_php5-5.5.14-78.1 apache2-mod_php5-debuginfo-5.5.14-78.1 php5-5.5.14-78.1 php5-bcmath-5.5.14-78.1 php5-bcmath-debuginfo-5.5.14-78.1 php5-bz2-5.5.14-78.1 php5-bz2-debuginfo-5.5.14-78.1 php5-calendar-5.5.14-78.1 php5-calendar-debuginfo-5.5.14-78.1 php5-ctype-5.5.14-78.1 php5-ctype-debuginfo-5.5.14-78.1 php5-curl-5.5.14-78.1 php5-curl-debuginfo-5.5.14-78.1 php5-dba-5.5.14-78.1 php5-dba-debuginfo-5.5.14-78.1 php5-debuginfo-5.5.14-78.1 php5-debugsource-5.5.14-78.1 php5-dom-5.5.14-78.1 php5-dom-debuginfo-5.5.14-78.1 php5-enchant-5.5.14-78.1 php5-enchant-debuginfo-5.5.14-78.1 php5-exif-5.5.14-78.1 php5-exif-debuginfo-5.5.14-78.1 php5-fastcgi-5.5.14-78.1 php5-fastcgi-debuginfo-5.5.14-78.1 php5-fileinfo-5.5.14-78.1 php5-fileinfo-debuginfo-5.5.14-78.1 php5-fpm-5.5.14-78.1 php5-fpm-debuginfo-5.5.14-78.1 php5-ftp-5.5.14-78.1 php5-ftp-debuginfo-5.5.14-78.1 php5-gd-5.5.14-78.1 php5-gd-debuginfo-5.5.14-78.1 php5-gettext-5.5.14-78.1 php5-gettext-debuginfo-5.5.14-78.1 php5-gmp-5.5.14-78.1 php5-gmp-debuginfo-5.5.14-78.1 php5-iconv-5.5.14-78.1 php5-iconv-debuginfo-5.5.14-78.1 php5-imap-5.5.14-78.1 php5-imap-debuginfo-5.5.14-78.1 php5-intl-5.5.14-78.1 php5-intl-debuginfo-5.5.14-78.1 php5-json-5.5.14-78.1 php5-json-debuginfo-5.5.14-78.1 php5-ldap-5.5.14-78.1 php5-ldap-debuginfo-5.5.14-78.1 php5-mbstring-5.5.14-78.1 php5-mbstring-debuginfo-5.5.14-78.1 php5-mcrypt-5.5.14-78.1 php5-mcrypt-debuginfo-5.5.14-78.1 php5-mysql-5.5.14-78.1 php5-mysql-debuginfo-5.5.14-78.1 php5-odbc-5.5.14-78.1 php5-odbc-debuginfo-5.5.14-78.1 php5-opcache-5.5.14-78.1 php5-opcache-debuginfo-5.5.14-78.1 php5-openssl-5.5.14-78.1 php5-openssl-debuginfo-5.5.14-78.1 php5-pcntl-5.5.14-78.1 php5-pcntl-debuginfo-5.5.14-78.1 php5-pdo-5.5.14-78.1 php5-pdo-debuginfo-5.5.14-78.1 php5-pgsql-5.5.14-78.1 php5-pgsql-debuginfo-5.5.14-78.1 php5-phar-5.5.14-78.1 php5-phar-debuginfo-5.5.14-78.1 php5-posix-5.5.14-78.1 php5-posix-debuginfo-5.5.14-78.1 php5-pspell-5.5.14-78.1 php5-pspell-debuginfo-5.5.14-78.1 php5-shmop-5.5.14-78.1 php5-shmop-debuginfo-5.5.14-78.1 php5-snmp-5.5.14-78.1 php5-snmp-debuginfo-5.5.14-78.1 php5-soap-5.5.14-78.1 php5-soap-debuginfo-5.5.14-78.1 php5-sockets-5.5.14-78.1 php5-sockets-debuginfo-5.5.14-78.1 php5-sqlite-5.5.14-78.1 php5-sqlite-debuginfo-5.5.14-78.1 php5-suhosin-5.5.14-78.1 php5-suhosin-debuginfo-5.5.14-78.1 php5-sysvmsg-5.5.14-78.1 php5-sysvmsg-debuginfo-5.5.14-78.1 php5-sysvsem-5.5.14-78.1 php5-sysvsem-debuginfo-5.5.14-78.1 php5-sysvshm-5.5.14-78.1 php5-sysvshm-debuginfo-5.5.14-78.1 php5-tokenizer-5.5.14-78.1 php5-tokenizer-debuginfo-5.5.14-78.1 php5-wddx-5.5.14-78.1 php5-wddx-debuginfo-5.5.14-78.1 php5-xmlreader-5.5.14-78.1 php5-xmlreader-debuginfo-5.5.14-78.1 php5-xmlrpc-5.5.14-78.1 php5-xmlrpc-debuginfo-5.5.14-78.1 php5-xmlwriter-5.5.14-78.1 php5-xmlwriter-debuginfo-5.5.14-78.1 php5-xsl-5.5.14-78.1 php5-xsl-debuginfo-5.5.14-78.1 php5-zip-5.5.14-78.1 php5-zip-debuginfo-5.5.14-78.1 php5-zlib-5.5.14-78.1 php5-zlib-debuginfo-5.5.14-78.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-78.1 References: https://www.suse.com/security/cve/CVE-2016-7411.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999682 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

Bigbruin.com is running a contest that may be of interest to your readers. A post on your site would be greatly appreciated. Title: Win a Kingston MobileLite Wireless Pro 64GB Mobile Backup at Bigbruin.com Link: http://bigbruin.com/footballpool Quote: Are you ready for some football? Up for grabs in week nine of Bigbruin.com's Pro Football Pick 'Em is a brand new Kingston MobileLite Wireless Pro 64GB Mobile Backup! Thank you. Best regards, Jason www.bigbruin.com --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2016:2133-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2133.html Issue date: 2016-11-01 CVE Names: CVE-2016-4470 CVE-2016-5195 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 6.4) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.4) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important) * A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation. (CVE-2016-4470, Important) Red Hat would like to thank Phil Oester for reporting CVE-2016-5195. The CVE-2016-4470 issue was discovered by David Howells (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1341716 - CVE-2016-4470 kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path 1384344 - CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage 6. Package List: Red Hat Enterprise Linux Server AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm noarch: kernel-doc-2.6.32-358.75.1.el6.noarch.rpm kernel-firmware-2.6.32-358.75.1.el6.noarch.rpm x86_64: kernel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm kernel-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-headers-2.6.32-358.75.1.el6.x86_64.rpm perf-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm x86_64: kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4470 https://access.redhat.com/security/cve/CVE-2016-5195 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGJggXlSAg2UNWIIRAmjIAJ9Hv+CFW/7G9pWkwyCccCUjLGWYaQCgkVuO VBItM1/0m2DIAPJoL6l4Gkg= =mjf6 -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2016:2133-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2133.html Issue date: 2016-11-01 CVE Names: CVE-2016-4470 CVE-2016-5195 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 6.4) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.4) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important) * A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation. (CVE-2016-4470, Important) Red Hat would like to thank Phil Oester for reporting CVE-2016-5195. The CVE-2016-4470 issue was discovered by David Howells (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1341716 - CVE-2016-4470 kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path 1384344 - CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage 6. Package List: Red Hat Enterprise Linux Server AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm noarch: kernel-doc-2.6.32-358.75.1.el6.noarch.rpm kernel-firmware-2.6.32-358.75.1.el6.noarch.rpm x86_64: kernel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm kernel-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-headers-2.6.32-358.75.1.el6.x86_64.rpm perf-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm x86_64: kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4470 https://access.redhat.com/security/cve/CVE-2016-5195 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGJggXlSAg2UNWIIRAmjIAJ9Hv+CFW/7G9pWkwyCccCUjLGWYaQCgkVuO VBItM1/0m2DIAPJoL6l4Gkg= =mjf6 -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2016:2133-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2133.html Issue date: 2016-11-01 CVE Names: CVE-2016-4470 CVE-2016-5195 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 6.4) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.4) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important) * A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation. (CVE-2016-4470, Important) Red Hat would like to thank Phil Oester for reporting CVE-2016-5195. The CVE-2016-4470 issue was discovered by David Howells (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1341716 - CVE-2016-4470 kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path 1384344 - CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage 6. Package List: Red Hat Enterprise Linux Server AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm noarch: kernel-doc-2.6.32-358.75.1.el6.noarch.rpm kernel-firmware-2.6.32-358.75.1.el6.noarch.rpm x86_64: kernel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm kernel-devel-2.6.32-358.75.1.el6.x86_64.rpm kernel-headers-2.6.32-358.75.1.el6.x86_64.rpm perf-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.4): Source: kernel-2.6.32-358.75.1.el6.src.rpm x86_64: kernel-debug-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-358.75.1.el6.x86_64.rpm perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm python-perf-2.6.32-358.75.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-358.75.1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-4470 https://access.redhat.com/security/cve/CVE-2016-5195 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGJggXlSAg2UNWIIRAmjIAJ9Hv+CFW/7G9pWkwyCccCUjLGWYaQCgkVuO VBItM1/0m2DIAPJoL6l4Gkg= =mjf6 -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2016:2132-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2132.html Issue date: 2016-11-01 CVE Names: CVE-2016-5195 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 6.2) - noarch, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.2) - x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important) Red Hat would like to thank Phil Oester for reporting this issue. Bug Fix(es): * Previously, the BUG_ON() signal appeared in the fs_clear_inode() function where the nfs_have_writebacks() function reported a positive value for nfs_inode->npages. As a consequence, a kernel panic occurred. The provided patch performs a serialization by holding the inode i_lock over the check of PagePrivate and locking the request, which fixes this bug. (BZ#1365157) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1384344 - CVE-2016-5195 kernel: mm: privilege escalation via MAP_PRIVATE COW breakage 6. Package List: Red Hat Enterprise Linux Server AUS (v. 6.2): Source: kernel-2.6.32-220.68.1.el6.src.rpm noarch: kernel-doc-2.6.32-220.68.1.el6.noarch.rpm kernel-firmware-2.6.32-220.68.1.el6.noarch.rpm x86_64: kernel-2.6.32-220.68.1.el6.x86_64.rpm kernel-debug-2.6.32-220.68.1.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm kernel-debug-devel-2.6.32-220.68.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-220.68.1.el6.x86_64.rpm kernel-devel-2.6.32-220.68.1.el6.x86_64.rpm kernel-headers-2.6.32-220.68.1.el6.x86_64.rpm perf-2.6.32-220.68.1.el6.x86_64.rpm perf-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.2): Source: kernel-2.6.32-220.68.1.el6.src.rpm x86_64: kernel-debug-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm kernel-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-220.68.1.el6.x86_64.rpm perf-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm python-perf-2.6.32-220.68.1.el6.x86_64.rpm python-perf-debuginfo-2.6.32-220.68.1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5195 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYGJgSXlSAg2UNWIIRAjSsAKDBZosbNG/fp+RvGldspm5VwF17KQCdFfuL a6xl/AAR6Sp4dNXHQtW5xgI= =cYAw -----END PGP SIGNATURE----- --

*MSI GeForce GTX 1070 Quick Silver 8G OC review* MSI today releases a new GeForce GTX 1070, the Quick Silver OC edition sits in the Gaming series of products. Basically this GeForce GTX 1070 is a Gaming X model in a different jacket. This GTX 1070 has been fitted with Micron GDDR5 memory, as such we'll put tweaking stability to the test with the new BIOS. Next to that we upgraded our software suite and added game benchmarks with Battlefield 1, Deus Ex, Mafia III and Gears of War 4. You can read the full * review right here <http://www.guru3d.com/articles-pages/msi-geforce-gtx-1070-quick-silver-8g-oc-review,1.html>'>http://www.guru3d.com/articles-pages/msi-geforce-gtx-1070-quick-silver-8g-oc-review,1.html> *. URL: http://www.guru3d.com/articles-pages/msi-geforce-gtx-1070-quick-silver-8g-oc-review,1.html <http://www.guru3d.com/articles-pages/msi-geforce-gtx-1070-quick-silver-8g-oc-review,1.html> --

ASUS is one of the most recognizable names in the enthusiast community, with a product line that covers nearly every aspect of computer hardware, including motherboards, graphics cards, monitors, networking devices and many other product lines. One of their most well known product lines is their award winning motherboards. When a new chipset is released, they are ready with new motherboards, designed to fit almost any budget and user type. When the Intel Z170 chipset first came out, ASUS provided us the opportunity to take a look at one of their flagship motherboards the Maximus VIII Extreme. Which while one of the best motherboards available, it has a price tag to match. Now, we have a chance to take a look at one of their mid-tier motherboards, the Sabertooth Z170 S; with a price tag of $169.99 with free shipping, it is better priced to meet the budget of most enthusiasts. Article Title: ASUS Sabertooth Z170 S Motherboard Review ( -at -) Legit Reviews Article URL: http://www.legitreviews.com/asus-sabertooth-z170-s-motherboard-review_186547 Unsubscribe: http://adserv.legitreviews.com/cgi-bin/dada/mail.cgi/u/legitpr/news// =

** TECHSPOT ------------------------------------------------------------ ** The Best Monitors ------------------------------------------------------------ ** http://www.techspot.com/bestof/monitors/ ------------------------------------------------------------ With today's cutting-edge PC hardware, a top quality monitor has never been more important. As features such as high refresh rates, 4K displays, ultrawide screens, and syncing technologies become more common, users need to choose wisely. To make picking the right monitor easier, here are our favorites in a handful of distinct categories. Thank you. Julio Franco Executive Editor | TECHSPOT ( -at -) juliofranco ----------------------------------- ============================================================ Our mailing address is: TechSpot 8237 NW 68 St Miami, FL 33166 USA

*MSI Core Frozr L CPU cooler review* We test and review the MSI Core Frozr L processor cooler. MSI is placing the cooler in the market, likely made with the same designers and fab that manufacturers their TwiNFrozr GPU cooler. The end results of the first ever MSI processor cooler even baffled us, as it is really good. Read the full review here <http://www.guru3d.com/articles-pages/msi-core-frozr-l-cpu-cooler-review,1.html>'>http://www.guru3d.com/articles-pages/msi-core-frozr-l-cpu-cooler-review,1.html> . URL: http://www.guru3d.com/articles-pages/msi-core-frozr-l-cpu-cooler-review,1.html <http://www.guru3d.com/articles-pages/msi-core-frozr-l-cpu-cooler-review,1.html> --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2016-305-04) New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/php-5.6.27-i586-1_slack14.2.txz: Upgraded. This release fixes bugs and security issues. For more information, see: https://php.net/ChangeLog-5.php#5.6.27 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/php-5.6.27-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/php-5.6.27-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/php-5.6.27-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/php-5.6.27-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/php-5.6.27-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/php-5.6.27-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-5.6.27-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/php-5.6.27-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.0 package: 80e383984078b79e4d85461855cd706e php-5.6.27-i486-1_slack14.0.txz Slackware x86_64 14.0 package: de9e695b496cc99c9b6a00697ceda3a3 php-5.6.27-x86_64-1_slack14.0.txz Slackware 14.1 package: 7a69288547fe90f489f9c849b07b2c07 php-5.6.27-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 0fb724b7f45714f30071223f164d5227 php-5.6.27-x86_64-1_slack14.1.txz Slackware 14.2 package: f16857f74ec283048bea7cfc12ef4392 php-5.6.27-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 0b5c2fbcd78127e86ad7761ddf4f3070 php-5.6.27-x86_64-1_slack14.2.txz Slackware -current package: c6425b48591fe85e0e4588431124525f n/php-5.6.27-i586-1.txz Slackware x86_64 -current package: 22cf1cdfaebcd4df70b7a3e42652e5ac n/php-5.6.27-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.6.27-i586-1_slack14.2.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mariadb (SSA:2016-305-03) New mariadb packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/mariadb-10.0.28-i586-1_slack14.2.txz: Upgraded. This update fixes several security issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5616 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5624 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5626 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5629 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8283 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7440 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5584 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6663 (* Security fix *) patches/packages/mariadb-10.0.28-i586-1_slack14.2.txz: Upgraded. This update fixes several security issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5616 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5624 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5626 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5629 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8283 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7440 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5584 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6663 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.53-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.53-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mariadb-10.0.28-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mariadb-10.0.28-x86_64-1_slack14.2.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-10.0.28-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-10.0.28-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.1 package: f35d96e4eeb5e2b06cf91864a2761dc9 mariadb-5.5.53-i486-1_slack14.1.txz Slackware x86_64 14.1 package: e0385be13012155e0db9df331279d5c2 mariadb-5.5.53-x86_64-1_slack14.1.txz Slackware 14.2 package: df3be509f54385d5ab0fd7f646ec9d88 mariadb-10.0.28-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 0d6c22025351c0c82f3454700326ca3f mariadb-10.0.28-x86_64-1_slack14.2.txz Slackware -current package: eccd4ad87dec3c55ce6f815dc1238e04 ap/mariadb-10.0.28-i586-1.txz Slackware x86_64 -current package: c3a298678c98073a69e9058026a2b703 ap/mariadb-10.0.28-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg mariadb-10.0.28-i586-1_slack14.2.txz Then, restart the database server: # sh /etc/rc.d/rc.mysqld restart +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+