news

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-php56-php security update Advisory ID: RHSA-2016:1612-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1612.html Issue date: 2016-08-11 CVE Names: CVE-2016-5385 ===================================================================== 1. Summary: An update for rh-php56-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385) Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-php56-php-5.6.5-9.el6.src.rpm x86_64: rh-php56-php-5.6.5-9.el6.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm rh-php56-php-common-5.6.5-9.el6.x86_64.rpm rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm rh-php56-php-process-5.6.5-9.el6.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-php56-php-5.6.5-9.el6.src.rpm x86_64: rh-php56-php-5.6.5-9.el6.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm rh-php56-php-common-5.6.5-9.el6.x86_64.rpm rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm rh-php56-php-process-5.6.5-9.el6.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-php56-php-5.6.5-9.el6.src.rpm x86_64: rh-php56-php-5.6.5-9.el6.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm rh-php56-php-common-5.6.5-9.el6.x86_64.rpm rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm rh-php56-php-process-5.6.5-9.el6.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-php56-php-5.6.5-9.el6.src.rpm x86_64: rh-php56-php-5.6.5-9.el6.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm rh-php56-php-common-5.6.5-9.el6.x86_64.rpm rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm rh-php56-php-process-5.6.5-9.el6.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-php56-php-5.6.5-9.el7.src.rpm x86_64: rh-php56-php-5.6.5-9.el7.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm rh-php56-php-common-5.6.5-9.el7.x86_64.rpm rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm rh-php56-php-process-5.6.5-9.el7.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: rh-php56-php-5.6.5-9.el7.src.rpm x86_64: rh-php56-php-5.6.5-9.el7.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm rh-php56-php-common-5.6.5-9.el7.x86_64.rpm rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm rh-php56-php-process-5.6.5-9.el7.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-php56-php-5.6.5-9.el7.src.rpm x86_64: rh-php56-php-5.6.5-9.el7.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm rh-php56-php-common-5.6.5-9.el7.x86_64.rpm rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm rh-php56-php-process-5.6.5-9.el7.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-php56-php-5.6.5-9.el7.src.rpm x86_64: rh-php56-php-5.6.5-9.el7.x86_64.rpm rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm rh-php56-php-common-5.6.5-9.el7.x86_64.rpm rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm rh-php56-php-process-5.6.5-9.el7.x86_64.rpm rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5385 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrPTMXlSAg2UNWIIRAiQCAJ0dfYfBJiwAbTVStw+pFUwIMP5jhwCgi+MO fr/VPvwdPqG/A0DnoFIO9PE= =7VKA -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: php security update Advisory ID: RHSA-2016:1609-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1609.html Issue date: 2016-08-11 CVE Names: CVE-2016-5385 ===================================================================== 1. Summary: An update for php is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385) Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header 6. Package List: Red Hat Enterprise Linux Desktop Optional (v. 6): Source: php-5.3.3-48.el6_8.src.rpm i386: php-5.3.3-48.el6_8.i686.rpm php-bcmath-5.3.3-48.el6_8.i686.rpm php-cli-5.3.3-48.el6_8.i686.rpm php-common-5.3.3-48.el6_8.i686.rpm php-dba-5.3.3-48.el6_8.i686.rpm php-debuginfo-5.3.3-48.el6_8.i686.rpm php-devel-5.3.3-48.el6_8.i686.rpm php-embedded-5.3.3-48.el6_8.i686.rpm php-enchant-5.3.3-48.el6_8.i686.rpm php-fpm-5.3.3-48.el6_8.i686.rpm php-gd-5.3.3-48.el6_8.i686.rpm php-imap-5.3.3-48.el6_8.i686.rpm php-intl-5.3.3-48.el6_8.i686.rpm php-ldap-5.3.3-48.el6_8.i686.rpm php-mbstring-5.3.3-48.el6_8.i686.rpm php-mysql-5.3.3-48.el6_8.i686.rpm php-odbc-5.3.3-48.el6_8.i686.rpm php-pdo-5.3.3-48.el6_8.i686.rpm php-pgsql-5.3.3-48.el6_8.i686.rpm php-process-5.3.3-48.el6_8.i686.rpm php-pspell-5.3.3-48.el6_8.i686.rpm php-recode-5.3.3-48.el6_8.i686.rpm php-snmp-5.3.3-48.el6_8.i686.rpm php-soap-5.3.3-48.el6_8.i686.rpm php-tidy-5.3.3-48.el6_8.i686.rpm php-xml-5.3.3-48.el6_8.i686.rpm php-xmlrpc-5.3.3-48.el6_8.i686.rpm php-zts-5.3.3-48.el6_8.i686.rpm x86_64: php-5.3.3-48.el6_8.x86_64.rpm php-bcmath-5.3.3-48.el6_8.x86_64.rpm php-cli-5.3.3-48.el6_8.x86_64.rpm php-common-5.3.3-48.el6_8.x86_64.rpm php-dba-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-devel-5.3.3-48.el6_8.x86_64.rpm php-embedded-5.3.3-48.el6_8.x86_64.rpm php-enchant-5.3.3-48.el6_8.x86_64.rpm php-fpm-5.3.3-48.el6_8.x86_64.rpm php-gd-5.3.3-48.el6_8.x86_64.rpm php-imap-5.3.3-48.el6_8.x86_64.rpm php-intl-5.3.3-48.el6_8.x86_64.rpm php-ldap-5.3.3-48.el6_8.x86_64.rpm php-mbstring-5.3.3-48.el6_8.x86_64.rpm php-mysql-5.3.3-48.el6_8.x86_64.rpm php-odbc-5.3.3-48.el6_8.x86_64.rpm php-pdo-5.3.3-48.el6_8.x86_64.rpm php-pgsql-5.3.3-48.el6_8.x86_64.rpm php-process-5.3.3-48.el6_8.x86_64.rpm php-pspell-5.3.3-48.el6_8.x86_64.rpm php-recode-5.3.3-48.el6_8.x86_64.rpm php-snmp-5.3.3-48.el6_8.x86_64.rpm php-soap-5.3.3-48.el6_8.x86_64.rpm php-tidy-5.3.3-48.el6_8.x86_64.rpm php-xml-5.3.3-48.el6_8.x86_64.rpm php-xmlrpc-5.3.3-48.el6_8.x86_64.rpm php-zts-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: php-5.3.3-48.el6_8.src.rpm x86_64: php-cli-5.3.3-48.el6_8.x86_64.rpm php-common-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: php-5.3.3-48.el6_8.x86_64.rpm php-bcmath-5.3.3-48.el6_8.x86_64.rpm php-dba-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-devel-5.3.3-48.el6_8.x86_64.rpm php-embedded-5.3.3-48.el6_8.x86_64.rpm php-enchant-5.3.3-48.el6_8.x86_64.rpm php-fpm-5.3.3-48.el6_8.x86_64.rpm php-gd-5.3.3-48.el6_8.x86_64.rpm php-imap-5.3.3-48.el6_8.x86_64.rpm php-intl-5.3.3-48.el6_8.x86_64.rpm php-ldap-5.3.3-48.el6_8.x86_64.rpm php-mbstring-5.3.3-48.el6_8.x86_64.rpm php-mysql-5.3.3-48.el6_8.x86_64.rpm php-odbc-5.3.3-48.el6_8.x86_64.rpm php-pdo-5.3.3-48.el6_8.x86_64.rpm php-pgsql-5.3.3-48.el6_8.x86_64.rpm php-process-5.3.3-48.el6_8.x86_64.rpm php-pspell-5.3.3-48.el6_8.x86_64.rpm php-recode-5.3.3-48.el6_8.x86_64.rpm php-snmp-5.3.3-48.el6_8.x86_64.rpm php-soap-5.3.3-48.el6_8.x86_64.rpm php-tidy-5.3.3-48.el6_8.x86_64.rpm php-xml-5.3.3-48.el6_8.x86_64.rpm php-xmlrpc-5.3.3-48.el6_8.x86_64.rpm php-zts-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: php-5.3.3-48.el6_8.src.rpm i386: php-5.3.3-48.el6_8.i686.rpm php-cli-5.3.3-48.el6_8.i686.rpm php-common-5.3.3-48.el6_8.i686.rpm php-debuginfo-5.3.3-48.el6_8.i686.rpm php-gd-5.3.3-48.el6_8.i686.rpm php-ldap-5.3.3-48.el6_8.i686.rpm php-mysql-5.3.3-48.el6_8.i686.rpm php-odbc-5.3.3-48.el6_8.i686.rpm php-pdo-5.3.3-48.el6_8.i686.rpm php-pgsql-5.3.3-48.el6_8.i686.rpm php-soap-5.3.3-48.el6_8.i686.rpm php-xml-5.3.3-48.el6_8.i686.rpm php-xmlrpc-5.3.3-48.el6_8.i686.rpm ppc64: php-5.3.3-48.el6_8.ppc64.rpm php-cli-5.3.3-48.el6_8.ppc64.rpm php-common-5.3.3-48.el6_8.ppc64.rpm php-debuginfo-5.3.3-48.el6_8.ppc64.rpm php-gd-5.3.3-48.el6_8.ppc64.rpm php-ldap-5.3.3-48.el6_8.ppc64.rpm php-mysql-5.3.3-48.el6_8.ppc64.rpm php-odbc-5.3.3-48.el6_8.ppc64.rpm php-pdo-5.3.3-48.el6_8.ppc64.rpm php-pgsql-5.3.3-48.el6_8.ppc64.rpm php-soap-5.3.3-48.el6_8.ppc64.rpm php-xml-5.3.3-48.el6_8.ppc64.rpm php-xmlrpc-5.3.3-48.el6_8.ppc64.rpm s390x: php-5.3.3-48.el6_8.s390x.rpm php-cli-5.3.3-48.el6_8.s390x.rpm php-common-5.3.3-48.el6_8.s390x.rpm php-debuginfo-5.3.3-48.el6_8.s390x.rpm php-gd-5.3.3-48.el6_8.s390x.rpm php-ldap-5.3.3-48.el6_8.s390x.rpm php-mysql-5.3.3-48.el6_8.s390x.rpm php-odbc-5.3.3-48.el6_8.s390x.rpm php-pdo-5.3.3-48.el6_8.s390x.rpm php-pgsql-5.3.3-48.el6_8.s390x.rpm php-soap-5.3.3-48.el6_8.s390x.rpm php-xml-5.3.3-48.el6_8.s390x.rpm php-xmlrpc-5.3.3-48.el6_8.s390x.rpm x86_64: php-5.3.3-48.el6_8.x86_64.rpm php-cli-5.3.3-48.el6_8.x86_64.rpm php-common-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-gd-5.3.3-48.el6_8.x86_64.rpm php-ldap-5.3.3-48.el6_8.x86_64.rpm php-mysql-5.3.3-48.el6_8.x86_64.rpm php-odbc-5.3.3-48.el6_8.x86_64.rpm php-pdo-5.3.3-48.el6_8.x86_64.rpm php-pgsql-5.3.3-48.el6_8.x86_64.rpm php-soap-5.3.3-48.el6_8.x86_64.rpm php-xml-5.3.3-48.el6_8.x86_64.rpm php-xmlrpc-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: php-bcmath-5.3.3-48.el6_8.i686.rpm php-dba-5.3.3-48.el6_8.i686.rpm php-debuginfo-5.3.3-48.el6_8.i686.rpm php-devel-5.3.3-48.el6_8.i686.rpm php-embedded-5.3.3-48.el6_8.i686.rpm php-enchant-5.3.3-48.el6_8.i686.rpm php-fpm-5.3.3-48.el6_8.i686.rpm php-imap-5.3.3-48.el6_8.i686.rpm php-intl-5.3.3-48.el6_8.i686.rpm php-mbstring-5.3.3-48.el6_8.i686.rpm php-process-5.3.3-48.el6_8.i686.rpm php-pspell-5.3.3-48.el6_8.i686.rpm php-recode-5.3.3-48.el6_8.i686.rpm php-snmp-5.3.3-48.el6_8.i686.rpm php-tidy-5.3.3-48.el6_8.i686.rpm php-zts-5.3.3-48.el6_8.i686.rpm ppc64: php-bcmath-5.3.3-48.el6_8.ppc64.rpm php-dba-5.3.3-48.el6_8.ppc64.rpm php-debuginfo-5.3.3-48.el6_8.ppc64.rpm php-devel-5.3.3-48.el6_8.ppc64.rpm php-embedded-5.3.3-48.el6_8.ppc64.rpm php-enchant-5.3.3-48.el6_8.ppc64.rpm php-fpm-5.3.3-48.el6_8.ppc64.rpm php-imap-5.3.3-48.el6_8.ppc64.rpm php-intl-5.3.3-48.el6_8.ppc64.rpm php-mbstring-5.3.3-48.el6_8.ppc64.rpm php-process-5.3.3-48.el6_8.ppc64.rpm php-pspell-5.3.3-48.el6_8.ppc64.rpm php-recode-5.3.3-48.el6_8.ppc64.rpm php-snmp-5.3.3-48.el6_8.ppc64.rpm php-tidy-5.3.3-48.el6_8.ppc64.rpm php-zts-5.3.3-48.el6_8.ppc64.rpm s390x: php-bcmath-5.3.3-48.el6_8.s390x.rpm php-dba-5.3.3-48.el6_8.s390x.rpm php-debuginfo-5.3.3-48.el6_8.s390x.rpm php-devel-5.3.3-48.el6_8.s390x.rpm php-embedded-5.3.3-48.el6_8.s390x.rpm php-enchant-5.3.3-48.el6_8.s390x.rpm php-fpm-5.3.3-48.el6_8.s390x.rpm php-imap-5.3.3-48.el6_8.s390x.rpm php-intl-5.3.3-48.el6_8.s390x.rpm php-mbstring-5.3.3-48.el6_8.s390x.rpm php-process-5.3.3-48.el6_8.s390x.rpm php-pspell-5.3.3-48.el6_8.s390x.rpm php-recode-5.3.3-48.el6_8.s390x.rpm php-snmp-5.3.3-48.el6_8.s390x.rpm php-tidy-5.3.3-48.el6_8.s390x.rpm php-zts-5.3.3-48.el6_8.s390x.rpm x86_64: php-bcmath-5.3.3-48.el6_8.x86_64.rpm php-dba-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-devel-5.3.3-48.el6_8.x86_64.rpm php-embedded-5.3.3-48.el6_8.x86_64.rpm php-enchant-5.3.3-48.el6_8.x86_64.rpm php-fpm-5.3.3-48.el6_8.x86_64.rpm php-imap-5.3.3-48.el6_8.x86_64.rpm php-intl-5.3.3-48.el6_8.x86_64.rpm php-mbstring-5.3.3-48.el6_8.x86_64.rpm php-process-5.3.3-48.el6_8.x86_64.rpm php-pspell-5.3.3-48.el6_8.x86_64.rpm php-recode-5.3.3-48.el6_8.x86_64.rpm php-snmp-5.3.3-48.el6_8.x86_64.rpm php-tidy-5.3.3-48.el6_8.x86_64.rpm php-zts-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: php-5.3.3-48.el6_8.src.rpm i386: php-5.3.3-48.el6_8.i686.rpm php-cli-5.3.3-48.el6_8.i686.rpm php-common-5.3.3-48.el6_8.i686.rpm php-debuginfo-5.3.3-48.el6_8.i686.rpm php-gd-5.3.3-48.el6_8.i686.rpm php-ldap-5.3.3-48.el6_8.i686.rpm php-mysql-5.3.3-48.el6_8.i686.rpm php-odbc-5.3.3-48.el6_8.i686.rpm php-pdo-5.3.3-48.el6_8.i686.rpm php-pgsql-5.3.3-48.el6_8.i686.rpm php-soap-5.3.3-48.el6_8.i686.rpm php-xml-5.3.3-48.el6_8.i686.rpm php-xmlrpc-5.3.3-48.el6_8.i686.rpm x86_64: php-5.3.3-48.el6_8.x86_64.rpm php-cli-5.3.3-48.el6_8.x86_64.rpm php-common-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-gd-5.3.3-48.el6_8.x86_64.rpm php-ldap-5.3.3-48.el6_8.x86_64.rpm php-mysql-5.3.3-48.el6_8.x86_64.rpm php-odbc-5.3.3-48.el6_8.x86_64.rpm php-pdo-5.3.3-48.el6_8.x86_64.rpm php-pgsql-5.3.3-48.el6_8.x86_64.rpm php-soap-5.3.3-48.el6_8.x86_64.rpm php-xml-5.3.3-48.el6_8.x86_64.rpm php-xmlrpc-5.3.3-48.el6_8.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: php-bcmath-5.3.3-48.el6_8.i686.rpm php-dba-5.3.3-48.el6_8.i686.rpm php-debuginfo-5.3.3-48.el6_8.i686.rpm php-devel-5.3.3-48.el6_8.i686.rpm php-embedded-5.3.3-48.el6_8.i686.rpm php-enchant-5.3.3-48.el6_8.i686.rpm php-fpm-5.3.3-48.el6_8.i686.rpm php-imap-5.3.3-48.el6_8.i686.rpm php-intl-5.3.3-48.el6_8.i686.rpm php-mbstring-5.3.3-48.el6_8.i686.rpm php-process-5.3.3-48.el6_8.i686.rpm php-pspell-5.3.3-48.el6_8.i686.rpm php-recode-5.3.3-48.el6_8.i686.rpm php-snmp-5.3.3-48.el6_8.i686.rpm php-tidy-5.3.3-48.el6_8.i686.rpm php-zts-5.3.3-48.el6_8.i686.rpm x86_64: php-bcmath-5.3.3-48.el6_8.x86_64.rpm php-dba-5.3.3-48.el6_8.x86_64.rpm php-debuginfo-5.3.3-48.el6_8.x86_64.rpm php-devel-5.3.3-48.el6_8.x86_64.rpm php-embedded-5.3.3-48.el6_8.x86_64.rpm php-enchant-5.3.3-48.el6_8.x86_64.rpm php-fpm-5.3.3-48.el6_8.x86_64.rpm php-imap-5.3.3-48.el6_8.x86_64.rpm php-intl-5.3.3-48.el6_8.x86_64.rpm php-mbstring-5.3.3-48.el6_8.x86_64.rpm php-process-5.3.3-48.el6_8.x86_64.rpm php-pspell-5.3.3-48.el6_8.x86_64.rpm php-recode-5.3.3-48.el6_8.x86_64.rpm php-snmp-5.3.3-48.el6_8.x86_64.rpm php-tidy-5.3.3-48.el6_8.x86_64.rpm php-zts-5.3.3-48.el6_8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5385 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrPRyXlSAg2UNWIIRAjXqAJ40lhwwWqwONbSjwEE1eqXPyzEX2ACfZYmC nUz/3znErAMpqmKYHdeumVw= =X0gC -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: php security and bug fix update Advisory ID: RHSA-2016:1613-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1613.html Issue date: 2016-08-11 CVE Names: CVE-2016-5385 ===================================================================== 1. Summary: An update for php is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385) Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue. Bug Fix(es): * Previously, an incorrect logic in the SAPI header callback routine caused that the callback counter was not incremented. Consequently, when a script included a header callback, it could terminate unexpectedly with a segmentation fault. With this update, the callback counter is properly managed, and scripts with a header callback implementation work as expected. (BZ#1346758) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1346758 - Segmentation fault while header_register_callback 1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: php-5.4.16-36.3.el7_2.src.rpm x86_64: php-5.4.16-36.3.el7_2.x86_64.rpm php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm php-cli-5.4.16-36.3.el7_2.x86_64.rpm php-common-5.4.16-36.3.el7_2.x86_64.rpm php-dba-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-devel-5.4.16-36.3.el7_2.x86_64.rpm php-embedded-5.4.16-36.3.el7_2.x86_64.rpm php-enchant-5.4.16-36.3.el7_2.x86_64.rpm php-fpm-5.4.16-36.3.el7_2.x86_64.rpm php-gd-5.4.16-36.3.el7_2.x86_64.rpm php-intl-5.4.16-36.3.el7_2.x86_64.rpm php-ldap-5.4.16-36.3.el7_2.x86_64.rpm php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm php-mysql-5.4.16-36.3.el7_2.x86_64.rpm php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm php-odbc-5.4.16-36.3.el7_2.x86_64.rpm php-pdo-5.4.16-36.3.el7_2.x86_64.rpm php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm php-process-5.4.16-36.3.el7_2.x86_64.rpm php-pspell-5.4.16-36.3.el7_2.x86_64.rpm php-recode-5.4.16-36.3.el7_2.x86_64.rpm php-snmp-5.4.16-36.3.el7_2.x86_64.rpm php-soap-5.4.16-36.3.el7_2.x86_64.rpm php-xml-5.4.16-36.3.el7_2.x86_64.rpm php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: php-5.4.16-36.3.el7_2.src.rpm x86_64: php-5.4.16-36.3.el7_2.x86_64.rpm php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm php-cli-5.4.16-36.3.el7_2.x86_64.rpm php-common-5.4.16-36.3.el7_2.x86_64.rpm php-dba-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-devel-5.4.16-36.3.el7_2.x86_64.rpm php-embedded-5.4.16-36.3.el7_2.x86_64.rpm php-enchant-5.4.16-36.3.el7_2.x86_64.rpm php-fpm-5.4.16-36.3.el7_2.x86_64.rpm php-gd-5.4.16-36.3.el7_2.x86_64.rpm php-intl-5.4.16-36.3.el7_2.x86_64.rpm php-ldap-5.4.16-36.3.el7_2.x86_64.rpm php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm php-mysql-5.4.16-36.3.el7_2.x86_64.rpm php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm php-odbc-5.4.16-36.3.el7_2.x86_64.rpm php-pdo-5.4.16-36.3.el7_2.x86_64.rpm php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm php-process-5.4.16-36.3.el7_2.x86_64.rpm php-pspell-5.4.16-36.3.el7_2.x86_64.rpm php-recode-5.4.16-36.3.el7_2.x86_64.rpm php-snmp-5.4.16-36.3.el7_2.x86_64.rpm php-soap-5.4.16-36.3.el7_2.x86_64.rpm php-xml-5.4.16-36.3.el7_2.x86_64.rpm php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: php-5.4.16-36.3.el7_2.src.rpm ppc64: php-5.4.16-36.3.el7_2.ppc64.rpm php-cli-5.4.16-36.3.el7_2.ppc64.rpm php-common-5.4.16-36.3.el7_2.ppc64.rpm php-debuginfo-5.4.16-36.3.el7_2.ppc64.rpm php-gd-5.4.16-36.3.el7_2.ppc64.rpm php-ldap-5.4.16-36.3.el7_2.ppc64.rpm php-mysql-5.4.16-36.3.el7_2.ppc64.rpm php-odbc-5.4.16-36.3.el7_2.ppc64.rpm php-pdo-5.4.16-36.3.el7_2.ppc64.rpm php-pgsql-5.4.16-36.3.el7_2.ppc64.rpm php-process-5.4.16-36.3.el7_2.ppc64.rpm php-recode-5.4.16-36.3.el7_2.ppc64.rpm php-soap-5.4.16-36.3.el7_2.ppc64.rpm php-xml-5.4.16-36.3.el7_2.ppc64.rpm php-xmlrpc-5.4.16-36.3.el7_2.ppc64.rpm ppc64le: php-5.4.16-36.3.el7_2.ppc64le.rpm php-cli-5.4.16-36.3.el7_2.ppc64le.rpm php-common-5.4.16-36.3.el7_2.ppc64le.rpm php-debuginfo-5.4.16-36.3.el7_2.ppc64le.rpm php-gd-5.4.16-36.3.el7_2.ppc64le.rpm php-ldap-5.4.16-36.3.el7_2.ppc64le.rpm php-mysql-5.4.16-36.3.el7_2.ppc64le.rpm php-odbc-5.4.16-36.3.el7_2.ppc64le.rpm php-pdo-5.4.16-36.3.el7_2.ppc64le.rpm php-pgsql-5.4.16-36.3.el7_2.ppc64le.rpm php-process-5.4.16-36.3.el7_2.ppc64le.rpm php-recode-5.4.16-36.3.el7_2.ppc64le.rpm php-soap-5.4.16-36.3.el7_2.ppc64le.rpm php-xml-5.4.16-36.3.el7_2.ppc64le.rpm php-xmlrpc-5.4.16-36.3.el7_2.ppc64le.rpm s390x: php-5.4.16-36.3.el7_2.s390x.rpm php-cli-5.4.16-36.3.el7_2.s390x.rpm php-common-5.4.16-36.3.el7_2.s390x.rpm php-debuginfo-5.4.16-36.3.el7_2.s390x.rpm php-gd-5.4.16-36.3.el7_2.s390x.rpm php-ldap-5.4.16-36.3.el7_2.s390x.rpm php-mysql-5.4.16-36.3.el7_2.s390x.rpm php-odbc-5.4.16-36.3.el7_2.s390x.rpm php-pdo-5.4.16-36.3.el7_2.s390x.rpm php-pgsql-5.4.16-36.3.el7_2.s390x.rpm php-process-5.4.16-36.3.el7_2.s390x.rpm php-recode-5.4.16-36.3.el7_2.s390x.rpm php-soap-5.4.16-36.3.el7_2.s390x.rpm php-xml-5.4.16-36.3.el7_2.s390x.rpm php-xmlrpc-5.4.16-36.3.el7_2.s390x.rpm x86_64: php-5.4.16-36.3.el7_2.x86_64.rpm php-cli-5.4.16-36.3.el7_2.x86_64.rpm php-common-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-gd-5.4.16-36.3.el7_2.x86_64.rpm php-ldap-5.4.16-36.3.el7_2.x86_64.rpm php-mysql-5.4.16-36.3.el7_2.x86_64.rpm php-odbc-5.4.16-36.3.el7_2.x86_64.rpm php-pdo-5.4.16-36.3.el7_2.x86_64.rpm php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm php-process-5.4.16-36.3.el7_2.x86_64.rpm php-recode-5.4.16-36.3.el7_2.x86_64.rpm php-soap-5.4.16-36.3.el7_2.x86_64.rpm php-xml-5.4.16-36.3.el7_2.x86_64.rpm php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: php-bcmath-5.4.16-36.3.el7_2.ppc64.rpm php-dba-5.4.16-36.3.el7_2.ppc64.rpm php-debuginfo-5.4.16-36.3.el7_2.ppc64.rpm php-devel-5.4.16-36.3.el7_2.ppc64.rpm php-embedded-5.4.16-36.3.el7_2.ppc64.rpm php-enchant-5.4.16-36.3.el7_2.ppc64.rpm php-fpm-5.4.16-36.3.el7_2.ppc64.rpm php-intl-5.4.16-36.3.el7_2.ppc64.rpm php-mbstring-5.4.16-36.3.el7_2.ppc64.rpm php-mysqlnd-5.4.16-36.3.el7_2.ppc64.rpm php-pspell-5.4.16-36.3.el7_2.ppc64.rpm php-snmp-5.4.16-36.3.el7_2.ppc64.rpm ppc64le: php-bcmath-5.4.16-36.3.el7_2.ppc64le.rpm php-dba-5.4.16-36.3.el7_2.ppc64le.rpm php-debuginfo-5.4.16-36.3.el7_2.ppc64le.rpm php-devel-5.4.16-36.3.el7_2.ppc64le.rpm php-embedded-5.4.16-36.3.el7_2.ppc64le.rpm php-enchant-5.4.16-36.3.el7_2.ppc64le.rpm php-fpm-5.4.16-36.3.el7_2.ppc64le.rpm php-intl-5.4.16-36.3.el7_2.ppc64le.rpm php-mbstring-5.4.16-36.3.el7_2.ppc64le.rpm php-mysqlnd-5.4.16-36.3.el7_2.ppc64le.rpm php-pspell-5.4.16-36.3.el7_2.ppc64le.rpm php-snmp-5.4.16-36.3.el7_2.ppc64le.rpm s390x: php-bcmath-5.4.16-36.3.el7_2.s390x.rpm php-dba-5.4.16-36.3.el7_2.s390x.rpm php-debuginfo-5.4.16-36.3.el7_2.s390x.rpm php-devel-5.4.16-36.3.el7_2.s390x.rpm php-embedded-5.4.16-36.3.el7_2.s390x.rpm php-enchant-5.4.16-36.3.el7_2.s390x.rpm php-fpm-5.4.16-36.3.el7_2.s390x.rpm php-intl-5.4.16-36.3.el7_2.s390x.rpm php-mbstring-5.4.16-36.3.el7_2.s390x.rpm php-mysqlnd-5.4.16-36.3.el7_2.s390x.rpm php-pspell-5.4.16-36.3.el7_2.s390x.rpm php-snmp-5.4.16-36.3.el7_2.s390x.rpm x86_64: php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm php-dba-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-devel-5.4.16-36.3.el7_2.x86_64.rpm php-embedded-5.4.16-36.3.el7_2.x86_64.rpm php-enchant-5.4.16-36.3.el7_2.x86_64.rpm php-fpm-5.4.16-36.3.el7_2.x86_64.rpm php-intl-5.4.16-36.3.el7_2.x86_64.rpm php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm php-pspell-5.4.16-36.3.el7_2.x86_64.rpm php-snmp-5.4.16-36.3.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: php-5.4.16-36.3.el7_2.src.rpm x86_64: php-5.4.16-36.3.el7_2.x86_64.rpm php-cli-5.4.16-36.3.el7_2.x86_64.rpm php-common-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-gd-5.4.16-36.3.el7_2.x86_64.rpm php-ldap-5.4.16-36.3.el7_2.x86_64.rpm php-mysql-5.4.16-36.3.el7_2.x86_64.rpm php-odbc-5.4.16-36.3.el7_2.x86_64.rpm php-pdo-5.4.16-36.3.el7_2.x86_64.rpm php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm php-process-5.4.16-36.3.el7_2.x86_64.rpm php-recode-5.4.16-36.3.el7_2.x86_64.rpm php-soap-5.4.16-36.3.el7_2.x86_64.rpm php-xml-5.4.16-36.3.el7_2.x86_64.rpm php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm php-dba-5.4.16-36.3.el7_2.x86_64.rpm php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm php-devel-5.4.16-36.3.el7_2.x86_64.rpm php-embedded-5.4.16-36.3.el7_2.x86_64.rpm php-enchant-5.4.16-36.3.el7_2.x86_64.rpm php-fpm-5.4.16-36.3.el7_2.x86_64.rpm php-intl-5.4.16-36.3.el7_2.x86_64.rpm php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm php-pspell-5.4.16-36.3.el7_2.x86_64.rpm php-snmp-5.4.16-36.3.el7_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5385 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrPgaXlSAg2UNWIIRAjn0AJ9+uobkj268+7awLhgQLyNGujzgkgCgp8+D ggdX4EUo7inKwJDZgGYrNok= =Zn6M -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: php54-php security update Advisory ID: RHSA-2016:1610-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1610.html Issue date: 2016-08-11 CVE Names: CVE-2016-5385 ===================================================================== 1. Summary: An update for php54-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385) Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: php54-php-5.4.40-4.el6.src.rpm x86_64: php54-php-5.4.40-4.el6.x86_64.rpm php54-php-bcmath-5.4.40-4.el6.x86_64.rpm php54-php-cli-5.4.40-4.el6.x86_64.rpm php54-php-common-5.4.40-4.el6.x86_64.rpm php54-php-dba-5.4.40-4.el6.x86_64.rpm php54-php-debuginfo-5.4.40-4.el6.x86_64.rpm php54-php-devel-5.4.40-4.el6.x86_64.rpm php54-php-enchant-5.4.40-4.el6.x86_64.rpm php54-php-fpm-5.4.40-4.el6.x86_64.rpm php54-php-gd-5.4.40-4.el6.x86_64.rpm php54-php-imap-5.4.40-4.el6.x86_64.rpm php54-php-intl-5.4.40-4.el6.x86_64.rpm php54-php-ldap-5.4.40-4.el6.x86_64.rpm php54-php-mbstring-5.4.40-4.el6.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el6.x86_64.rpm php54-php-odbc-5.4.40-4.el6.x86_64.rpm php54-php-pdo-5.4.40-4.el6.x86_64.rpm php54-php-pgsql-5.4.40-4.el6.x86_64.rpm php54-php-process-5.4.40-4.el6.x86_64.rpm php54-php-pspell-5.4.40-4.el6.x86_64.rpm php54-php-recode-5.4.40-4.el6.x86_64.rpm php54-php-snmp-5.4.40-4.el6.x86_64.rpm php54-php-soap-5.4.40-4.el6.x86_64.rpm php54-php-tidy-5.4.40-4.el6.x86_64.rpm php54-php-xml-5.4.40-4.el6.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: php54-php-5.4.40-4.el6.src.rpm x86_64: php54-php-5.4.40-4.el6.x86_64.rpm php54-php-bcmath-5.4.40-4.el6.x86_64.rpm php54-php-cli-5.4.40-4.el6.x86_64.rpm php54-php-common-5.4.40-4.el6.x86_64.rpm php54-php-dba-5.4.40-4.el6.x86_64.rpm php54-php-debuginfo-5.4.40-4.el6.x86_64.rpm php54-php-devel-5.4.40-4.el6.x86_64.rpm php54-php-enchant-5.4.40-4.el6.x86_64.rpm php54-php-fpm-5.4.40-4.el6.x86_64.rpm php54-php-gd-5.4.40-4.el6.x86_64.rpm php54-php-imap-5.4.40-4.el6.x86_64.rpm php54-php-intl-5.4.40-4.el6.x86_64.rpm php54-php-ldap-5.4.40-4.el6.x86_64.rpm php54-php-mbstring-5.4.40-4.el6.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el6.x86_64.rpm php54-php-odbc-5.4.40-4.el6.x86_64.rpm php54-php-pdo-5.4.40-4.el6.x86_64.rpm php54-php-pgsql-5.4.40-4.el6.x86_64.rpm php54-php-process-5.4.40-4.el6.x86_64.rpm php54-php-pspell-5.4.40-4.el6.x86_64.rpm php54-php-recode-5.4.40-4.el6.x86_64.rpm php54-php-snmp-5.4.40-4.el6.x86_64.rpm php54-php-soap-5.4.40-4.el6.x86_64.rpm php54-php-tidy-5.4.40-4.el6.x86_64.rpm php54-php-xml-5.4.40-4.el6.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: php54-php-5.4.40-4.el6.src.rpm x86_64: php54-php-5.4.40-4.el6.x86_64.rpm php54-php-bcmath-5.4.40-4.el6.x86_64.rpm php54-php-cli-5.4.40-4.el6.x86_64.rpm php54-php-common-5.4.40-4.el6.x86_64.rpm php54-php-dba-5.4.40-4.el6.x86_64.rpm php54-php-debuginfo-5.4.40-4.el6.x86_64.rpm php54-php-devel-5.4.40-4.el6.x86_64.rpm php54-php-enchant-5.4.40-4.el6.x86_64.rpm php54-php-fpm-5.4.40-4.el6.x86_64.rpm php54-php-gd-5.4.40-4.el6.x86_64.rpm php54-php-imap-5.4.40-4.el6.x86_64.rpm php54-php-intl-5.4.40-4.el6.x86_64.rpm php54-php-ldap-5.4.40-4.el6.x86_64.rpm php54-php-mbstring-5.4.40-4.el6.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el6.x86_64.rpm php54-php-odbc-5.4.40-4.el6.x86_64.rpm php54-php-pdo-5.4.40-4.el6.x86_64.rpm php54-php-pgsql-5.4.40-4.el6.x86_64.rpm php54-php-process-5.4.40-4.el6.x86_64.rpm php54-php-pspell-5.4.40-4.el6.x86_64.rpm php54-php-recode-5.4.40-4.el6.x86_64.rpm php54-php-snmp-5.4.40-4.el6.x86_64.rpm php54-php-soap-5.4.40-4.el6.x86_64.rpm php54-php-tidy-5.4.40-4.el6.x86_64.rpm php54-php-xml-5.4.40-4.el6.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: php54-php-5.4.40-4.el6.src.rpm x86_64: php54-php-5.4.40-4.el6.x86_64.rpm php54-php-bcmath-5.4.40-4.el6.x86_64.rpm php54-php-cli-5.4.40-4.el6.x86_64.rpm php54-php-common-5.4.40-4.el6.x86_64.rpm php54-php-dba-5.4.40-4.el6.x86_64.rpm php54-php-debuginfo-5.4.40-4.el6.x86_64.rpm php54-php-devel-5.4.40-4.el6.x86_64.rpm php54-php-enchant-5.4.40-4.el6.x86_64.rpm php54-php-fpm-5.4.40-4.el6.x86_64.rpm php54-php-gd-5.4.40-4.el6.x86_64.rpm php54-php-imap-5.4.40-4.el6.x86_64.rpm php54-php-intl-5.4.40-4.el6.x86_64.rpm php54-php-ldap-5.4.40-4.el6.x86_64.rpm php54-php-mbstring-5.4.40-4.el6.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el6.x86_64.rpm php54-php-odbc-5.4.40-4.el6.x86_64.rpm php54-php-pdo-5.4.40-4.el6.x86_64.rpm php54-php-pgsql-5.4.40-4.el6.x86_64.rpm php54-php-process-5.4.40-4.el6.x86_64.rpm php54-php-pspell-5.4.40-4.el6.x86_64.rpm php54-php-recode-5.4.40-4.el6.x86_64.rpm php54-php-snmp-5.4.40-4.el6.x86_64.rpm php54-php-soap-5.4.40-4.el6.x86_64.rpm php54-php-tidy-5.4.40-4.el6.x86_64.rpm php54-php-xml-5.4.40-4.el6.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: php54-php-5.4.40-4.el7.src.rpm x86_64: php54-php-5.4.40-4.el7.x86_64.rpm php54-php-bcmath-5.4.40-4.el7.x86_64.rpm php54-php-cli-5.4.40-4.el7.x86_64.rpm php54-php-common-5.4.40-4.el7.x86_64.rpm php54-php-dba-5.4.40-4.el7.x86_64.rpm php54-php-debuginfo-5.4.40-4.el7.x86_64.rpm php54-php-devel-5.4.40-4.el7.x86_64.rpm php54-php-enchant-5.4.40-4.el7.x86_64.rpm php54-php-fpm-5.4.40-4.el7.x86_64.rpm php54-php-gd-5.4.40-4.el7.x86_64.rpm php54-php-intl-5.4.40-4.el7.x86_64.rpm php54-php-ldap-5.4.40-4.el7.x86_64.rpm php54-php-mbstring-5.4.40-4.el7.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el7.x86_64.rpm php54-php-odbc-5.4.40-4.el7.x86_64.rpm php54-php-pdo-5.4.40-4.el7.x86_64.rpm php54-php-pgsql-5.4.40-4.el7.x86_64.rpm php54-php-process-5.4.40-4.el7.x86_64.rpm php54-php-pspell-5.4.40-4.el7.x86_64.rpm php54-php-recode-5.4.40-4.el7.x86_64.rpm php54-php-snmp-5.4.40-4.el7.x86_64.rpm php54-php-soap-5.4.40-4.el7.x86_64.rpm php54-php-xml-5.4.40-4.el7.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: php54-php-5.4.40-4.el7.src.rpm x86_64: php54-php-5.4.40-4.el7.x86_64.rpm php54-php-bcmath-5.4.40-4.el7.x86_64.rpm php54-php-cli-5.4.40-4.el7.x86_64.rpm php54-php-common-5.4.40-4.el7.x86_64.rpm php54-php-dba-5.4.40-4.el7.x86_64.rpm php54-php-debuginfo-5.4.40-4.el7.x86_64.rpm php54-php-devel-5.4.40-4.el7.x86_64.rpm php54-php-enchant-5.4.40-4.el7.x86_64.rpm php54-php-fpm-5.4.40-4.el7.x86_64.rpm php54-php-gd-5.4.40-4.el7.x86_64.rpm php54-php-intl-5.4.40-4.el7.x86_64.rpm php54-php-ldap-5.4.40-4.el7.x86_64.rpm php54-php-mbstring-5.4.40-4.el7.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el7.x86_64.rpm php54-php-odbc-5.4.40-4.el7.x86_64.rpm php54-php-pdo-5.4.40-4.el7.x86_64.rpm php54-php-pgsql-5.4.40-4.el7.x86_64.rpm php54-php-process-5.4.40-4.el7.x86_64.rpm php54-php-pspell-5.4.40-4.el7.x86_64.rpm php54-php-recode-5.4.40-4.el7.x86_64.rpm php54-php-snmp-5.4.40-4.el7.x86_64.rpm php54-php-soap-5.4.40-4.el7.x86_64.rpm php54-php-xml-5.4.40-4.el7.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: php54-php-5.4.40-4.el7.src.rpm x86_64: php54-php-5.4.40-4.el7.x86_64.rpm php54-php-bcmath-5.4.40-4.el7.x86_64.rpm php54-php-cli-5.4.40-4.el7.x86_64.rpm php54-php-common-5.4.40-4.el7.x86_64.rpm php54-php-dba-5.4.40-4.el7.x86_64.rpm php54-php-debuginfo-5.4.40-4.el7.x86_64.rpm php54-php-devel-5.4.40-4.el7.x86_64.rpm php54-php-enchant-5.4.40-4.el7.x86_64.rpm php54-php-fpm-5.4.40-4.el7.x86_64.rpm php54-php-gd-5.4.40-4.el7.x86_64.rpm php54-php-intl-5.4.40-4.el7.x86_64.rpm php54-php-ldap-5.4.40-4.el7.x86_64.rpm php54-php-mbstring-5.4.40-4.el7.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el7.x86_64.rpm php54-php-odbc-5.4.40-4.el7.x86_64.rpm php54-php-pdo-5.4.40-4.el7.x86_64.rpm php54-php-pgsql-5.4.40-4.el7.x86_64.rpm php54-php-process-5.4.40-4.el7.x86_64.rpm php54-php-pspell-5.4.40-4.el7.x86_64.rpm php54-php-recode-5.4.40-4.el7.x86_64.rpm php54-php-snmp-5.4.40-4.el7.x86_64.rpm php54-php-soap-5.4.40-4.el7.x86_64.rpm php54-php-xml-5.4.40-4.el7.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: php54-php-5.4.40-4.el7.src.rpm x86_64: php54-php-5.4.40-4.el7.x86_64.rpm php54-php-bcmath-5.4.40-4.el7.x86_64.rpm php54-php-cli-5.4.40-4.el7.x86_64.rpm php54-php-common-5.4.40-4.el7.x86_64.rpm php54-php-dba-5.4.40-4.el7.x86_64.rpm php54-php-debuginfo-5.4.40-4.el7.x86_64.rpm php54-php-devel-5.4.40-4.el7.x86_64.rpm php54-php-enchant-5.4.40-4.el7.x86_64.rpm php54-php-fpm-5.4.40-4.el7.x86_64.rpm php54-php-gd-5.4.40-4.el7.x86_64.rpm php54-php-intl-5.4.40-4.el7.x86_64.rpm php54-php-ldap-5.4.40-4.el7.x86_64.rpm php54-php-mbstring-5.4.40-4.el7.x86_64.rpm php54-php-mysqlnd-5.4.40-4.el7.x86_64.rpm php54-php-odbc-5.4.40-4.el7.x86_64.rpm php54-php-pdo-5.4.40-4.el7.x86_64.rpm php54-php-pgsql-5.4.40-4.el7.x86_64.rpm php54-php-process-5.4.40-4.el7.x86_64.rpm php54-php-pspell-5.4.40-4.el7.x86_64.rpm php54-php-recode-5.4.40-4.el7.x86_64.rpm php54-php-snmp-5.4.40-4.el7.x86_64.rpm php54-php-soap-5.4.40-4.el7.x86_64.rpm php54-php-xml-5.4.40-4.el7.x86_64.rpm php54-php-xmlrpc-5.4.40-4.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5385 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrPSRXlSAg2UNWIIRAm7eAJ46bwD5dNGjO2qoFKsoL92xftbbTgCgkeMg 3r5SaIOUCU9fw1VuBLjTlPI= =fzN3 -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: qemu-kvm security update Advisory ID: RHSA-2016:1606-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1606.html Issue date: 2016-08-11 CVE Names: CVE-2016-5126 CVE-2016-5403 ===================================================================== 1. Summary: An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. Security Fix(es): * Quick Emulator(Qemu) built with the Block driver for iSCSI images support (virtio-blk) is vulnerable to a heap buffer overflow issue. It could occur while processing iSCSI asynchronous I/O ioctl(2) calls. A user inside guest could use this flaw to crash the Qemu process resulting in DoS or potentially leverage it to execute arbitrary code with privileges of the Qemu process on the host. (CVE-2016-5126) * Quick emulator(Qemu) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation on the host controlled by the guest. (CVE-2016-5403) Red Hat would like to thank hongzhenhao (Marvel Team) for reporting CVE-2016-5403. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1340924 - CVE-2016-5126 Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl 1358359 - CVE-2016-5403 Qemu: virtio: unbounded memory allocation on host via guest leading to DoS 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: qemu-kvm-1.5.3-105.el7_2.7.src.rpm x86_64: libcacard-1.5.3-105.el7_2.7.i686.rpm libcacard-1.5.3-105.el7_2.7.x86_64.rpm qemu-img-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-common-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-tools-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: libcacard-devel-1.5.3-105.el7_2.7.i686.rpm libcacard-devel-1.5.3-105.el7_2.7.x86_64.rpm libcacard-tools-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: qemu-kvm-1.5.3-105.el7_2.7.src.rpm x86_64: libcacard-1.5.3-105.el7_2.7.i686.rpm libcacard-1.5.3-105.el7_2.7.x86_64.rpm libcacard-devel-1.5.3-105.el7_2.7.i686.rpm libcacard-devel-1.5.3-105.el7_2.7.x86_64.rpm libcacard-tools-1.5.3-105.el7_2.7.x86_64.rpm qemu-img-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-common-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-tools-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: qemu-kvm-1.5.3-105.el7_2.7.src.rpm ppc64: qemu-img-1.5.3-105.el7_2.7.ppc64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.ppc64.rpm ppc64le: qemu-img-1.5.3-105.el7_2.7.ppc64le.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.ppc64le.rpm x86_64: libcacard-1.5.3-105.el7_2.7.i686.rpm libcacard-1.5.3-105.el7_2.7.x86_64.rpm qemu-img-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-common-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-tools-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: libcacard-1.5.3-105.el7_2.7.ppc.rpm libcacard-1.5.3-105.el7_2.7.ppc64.rpm libcacard-devel-1.5.3-105.el7_2.7.ppc.rpm libcacard-devel-1.5.3-105.el7_2.7.ppc64.rpm libcacard-tools-1.5.3-105.el7_2.7.ppc64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.ppc.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.ppc64.rpm ppc64le: libcacard-1.5.3-105.el7_2.7.ppc64le.rpm libcacard-devel-1.5.3-105.el7_2.7.ppc64le.rpm libcacard-tools-1.5.3-105.el7_2.7.ppc64le.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.ppc64le.rpm x86_64: libcacard-devel-1.5.3-105.el7_2.7.i686.rpm libcacard-devel-1.5.3-105.el7_2.7.x86_64.rpm libcacard-tools-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: qemu-kvm-1.5.3-105.el7_2.7.src.rpm x86_64: libcacard-1.5.3-105.el7_2.7.i686.rpm libcacard-1.5.3-105.el7_2.7.x86_64.rpm qemu-img-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-common-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-tools-1.5.3-105.el7_2.7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: libcacard-devel-1.5.3-105.el7_2.7.i686.rpm libcacard-devel-1.5.3-105.el7_2.7.x86_64.rpm libcacard-tools-1.5.3-105.el7_2.7.x86_64.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.i686.rpm qemu-kvm-debuginfo-1.5.3-105.el7_2.7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5126 https://access.redhat.com/security/cve/CVE-2016-5403 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrNF2XlSAg2UNWIIRAgRvAJ0e6TgscGucAAkwGTvgxuKgZJU/aACfdDJW GiYkCcoaHP1vg5zFTtXede4= =UDUO -----END PGP SIGNATURE----- --

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2051-1 Rating: important References: #984684 #987895 #988651 #989721 #989722 #989723 #989725 #989726 #989727 #989728 #989729 #989730 #989731 #989732 #989733 #989734 Cross-References: CVE-2016-3458 CVE-2016-3485 CVE-2016-3498 CVE-2016-3500 CVE-2016-3503 CVE-2016-3508 CVE-2016-3511 CVE-2016-3550 CVE-2016-3552 CVE-2016-3587 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has three fixes is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Upgrade to version jdk8u101 (icedtea 3.1.0) - New in release 3.1.0 (2016-07-25): * Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732) - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734) - S8146514: Enforce GCM limits - S8147771: Construction of static protection domains under Javax custom policy - S8148872, CVE-2016-3500: Complete name checking (bsc#989730) - S8149070: Enforce update ordering - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731) - S8150752: Share Class Data - S8151925: Font reference improvements - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733) - S8153312: Constrain AppCDS behavior - S8154475, CVE-2016-3587: Clean up lookup visibility (bsc#989721) - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722) - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723) - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725) - CVE-2016-3552 (bsc#989726) - CVE-2016-3511 (bsc#989727) - CVE-2016-3503 (bsc#989728) - CVE-2016-3498 (bsc#989729) * New features - S8145547, PR1061: [AWT/Swing] Conditional support for GTK 3 on Linux - PR2821: Support building OpenJDK with --disable-headful - PR2931, G478960: Provide Infinality Support via fontconfig - PR3079: Provide option to build Shenandoah on x86_64 * Import of OpenJDK 8 u92 build 14 - S6869327: Add new C2 flag to keep safepoints in counted loops. - S8022865: [TESTBUG] Compressed Oops testing needs to be revised - S8029630: Thread id should be displayed as a hex number in error report - S8029726: On OS X some dtrace probe names are mismatched with Solaris - S8029727: On OS X dtrace probes CallMethodA/CallMethodV are not fired. - S8029728: On OS X dtrace probes SetStaticBooleanField are not fired - S8038184: XMLSignature throws StringIndexOutOfBound[censored]ception if ID attribute value is empty String - S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits - S8041501: ImageIO reader is not capable of reading JPEGs without JFIF header - S8041900: [macosx] Java forces the use of discrete GPU - S8044363: Remove special build options for unpack200 executable - S8046471: Use OPENJDK_TARGET_CPU_ARCH instead of legacy value for hotspot ARCH - S8046611: Build errors with gcc on sparc/fastdebug - S8047763: Recognize sparc64 as a sparc platform - S8048232: Fix for 8046471 breaks PPC64 build - S8052396: Catch exceptions resulting from missing font cmap - S8058563: InstanceKlass::_dependencies list isn't cleared from empty nmethodBucket entries - S8061624: [TESTBUG] Some tests cannot be ran under compact profiles and therefore shall be excluded - S8062901: Iterators is spelled incorrectly in the Javadoc for Spliterator - S8064330: Remove SHA224 from the default support list if SunMSCAPI enabled - S8065579: WB method to start G1 concurrent mark cycle should be introduced - S8065986: Compiler fails to NullPointerException when calling super with Object() - S8066974: Compiler doesn't infer method's generic type information in lambda body - S8067800: Clarify java.time.chrono.Chronology.isLeapYear for out of range years - S8068033: JNI exception pending in jdk/src/share/bin/java.c - S8068042: Check jdk/src/share/native/sun/misc/URLClassPath.c for JNI pending - S8068162: jvmtiRedefineClasses.cpp: guarantee(false) failed: OLD and/or OBSOLETE method(s) found - S8068254: Method reference uses wrong qualifying type - S8074696: Remote debugging session hangs for several minutes when calling findBootType - S8074935: jdk8 keytool doesn't validate pem files for RFC 1421 correctness, as jdk7 did - S8078423: [TESTBUG] javax/print/PrintSEUmlauts/PrintSEUmlauts.java relies on system locale - S8080492: [Parfait] Uninitialised variable in jdk/src/java/desktop/windows/native/libawt/ - S8080650: Enable stubs to use frame pointers correctly - S8122944: perfdata used is seen as too high on sparc zone with jdk1.9 and causes a test failure - S8129348: Debugger hangs in trace mode with TRACE_SENDS - S8129847: Compiling methods generated by Nashorn triggers high memory usage in C2 - S8130506: javac AssertionError when invoking MethodHandle.invoke with lambda parameter - S8130910: hsperfdata file is created in wrong directory and not cleaned up if /tmp/hsperfdata_ has wrong permissions - S8131129: Attempt to define a duplicate BMH$Species class - S8131665: Bad exception message in HandshakeHash.getFinishedHash - S8131782: C1 Class.cast optimization breaks when Class is loaded from static final - S8132503: [macosx] Chinese full stop symbol cannot be entered with Pinyin IM on OS X - S8133207: ParallelProbes.java test fails after changes for JDK-8080115 - S8133924: NPE may be thrown when xsltc select a non-existing node after JDK-8062518 - S8134007: Improve string folding - S8134759: jdb: Incorrect stepping inside finally block - S8134963: [Newtest] New stress test for changing the coarseness level of G1 remembered set - S8136442: Don't tie Certificate signature algorithms to ciphersuites - S8137106: EUDC (End User Defined Characters) are not displayed on Windows with Java 8u60+ - S8138745: Implement ExitOnOutOfMemory and CrashOnOutOfMemory in HotSpot - S8138764: In some cases the usage of TreeLock can be replaced by other synchronization - S8139373: [TEST_BUG] java/net/MulticastSocket/MultiDead.java failed with timeout - S8139424: SIGSEGV, Problematic frame: # V [libjvm.so+0xd0c0cc] void InstanceKlass::oop_oop_iterate_oop_maps_specialized - S8139436: sun.security.mscapi.KeyStore might load incomplete data - S8139751: Javac crash with -XDallowStringFolding=false - S8139863: [TESTBUG] Need to port tests for JDK-8134903 to 8u-dev - S8139985: JNI exception pending in jdk/src/jdk/hprof/agent/share/native/libhprof - S8140031: SA: Searching for a value in Threads does not work - S8140249: JVM Crashing During startUp If Flight Recording is enabled - S8140344: add support for 3 digit update release numbers - S8140587: Atomic*FieldUpdaters should use Class.isInstance instead of direct class check - S8141260: isReachable crash in windows xp - S8143297: Nashorn compilation time reported in nanoseconds - S8143397: It looks like InetAddress.isReachable(timeout) works incorrectly - S8143855: Bad printf formatting in frame_zero.cpp - S8143896: java.lang.Long is implicitly converted to double - S8143963: improve ClassLoader::trace_class_path to accept an additional outputStream* arg - S8144020: Remove long as an internal numeric type - S8144131: ArrayData.getInt implementations do not convert to int32 - S8144483: One long Safepoint pause directly after each GC log rotation - S8144487: PhaseIdealLoop::build_and_optimize() must restore major_progress flag if skip_loop_opts is true - S8144885: agent/src/os/linux/libproc.h needs to support Linux/SPARC builds - S8144935: C2: safepoint is pruned from a non-counted loop - S8144937: [TEST_BUG] testlibrary_tests should be excluded for compact1 and compact2 execution - S8145017: Add support for 3 digit hotspot minor version numbers - S8145099: Better error message when SA can't attach to a process - S8145442: Add the facility to verify remembered sets for G1 - S8145466: javac: No line numbers in compilation error - S8145539: (coll) AbstractMap.keySet and .values should not be volatile - S8145550: Megamorphic invoke should use CompiledFunction variants without any LinkLogic - S8145669: apply2call optimized callsite fails after becoming megamorphic - S8145722: NullPointerException in javadoc - S8145754: PhaseIdealLoop::is_scaled_iv_plus_offset() does not match AddI - S8146147: Java linker indexed property getter does not work for computed nashorn string - S8146566: OpenJDK build can't handle commas in LDFLAGS - S8146725: Issues with SignatureAndHashAlgorithm.getSupportedAlgorithms - S8146979: Backport of 8046471 breaks ppc64 build in jdk8u because 8072383 was badly backported before - S8147087: Race when reusing PerRegionTable bitmaps may result in dropped remembered set entries - S8147630: Wrong test result pushed to 8u-dev - S8147845: Varargs Array functions still leaking longs - S8147857: RMIConnector logs attribute names incorrectly - S8148353: [linux-sparc] Crash in libawt.so on Linux SPARC - S8150791: 8u76 L10n resource file translation update * Import of OpenJDK 8 u101 build 13 - S6483657: MSCAPI provider does not create unique alias names - S6675699: need comprehensive fix for unconstrained ConvI2L with narrowed type - S8037557: test SessionCacheSizeTests.java timeout - S8038837: Add support to jarsigner for specifying timestamp hash algorithm - S8081778: Use Intel x64 CPU instructions for RSA acceleration - S8130150: Implement BigInteger.montgomeryMultiply intrinsic - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts - S8143913: MSCAPI keystore should accept Certificate[] in setEntry() - S8144313: Test SessionTimeOutTests can be timeout - S8146240: Three nashorn files contain "GNU General Public License" header - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out - S8146669: Test SessionTimeOutTests fails intermittently - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811 - S8147994: [macosx] JScrollPane jitters up/down during trackpad scrolling on MacOS/Aqua - S8151522: Disable 8130150 and 8081778 intrinsics by default - S8151876: (tz) Support tzdata2016d - S8152098: Fix 8151522 caused test compiler/intrinsics/squaretolen/TestSquareToLen.java to fail - S8157077: 8u101 L10n resource file updates * Backports - S6260348, PR3066: GTK+ L&F JTextComponent not respecting desktop caret blink rate - S6778087, PR1061: getLocationOnScreen() always returns (0, 0) for mouse wheel events - S6961123, PR2972: setWMClass fails to null-terminate WM_CLASS string - S8008657, PR3077: JSpinner setComponentOrientation doesn't affect on text orientation - S8014212, PR2866: Robot captures black screen - S8029339, PR1061: Custom MultiResolution image support on HiDPI displays - S8031145, PR3077: Re-examine closed i18n tests to see it they can be moved to the jdk repository. - S8034856, PR3095: gcc warnings compiling src/solaris/native/sun/security/pkcs11 - S8034857, PR3095: gcc warnings compiling src/solaris/native/sun/management - S8035054, PR3095: JarFacade.c should not include ctype.h - S8035287, PR3095: gcc warnings compiling various libraries files - S8038631, PR3077: Create wrapper for awt.Robot with additional functionality - S8039279, PR3077: Move awt tests to openjdk repository - S8041561, PR3077: Inconsistent opacity behaviour between JCheckBox and JRadioButton - S8041592, PR3077: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk - S8041915, PR3077: Move 8 awt tests to OpenJDK regression tests tree - S8043126, PR3077: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository - S8043131, PR3077: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree - S8044157, PR3077: [TEST_BUG] Improve recently submitted AWT_Mixing tests - S8044172, PR3077: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk - S8044429, PR3077: move awt automated tests for AWT_Modality to OpenJDK repository - S8044762, PR2960: com/sun/jdi/OptionTest.java test time out - S8044765, PR3077: Move functional tests AWT_SystemTray/Automated to openjdk repository - S8047180, PR3077: Move functional tests AWT_Headless/Automated to OpenJDK repository - S8047367, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 2 - S8048246, PR3077: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK - S8049226, PR2960: com/sun/jdi/OptionTest.java test times out again - S8049617, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 3 - S8049694, PR3077: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK - S8050885, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 4 - S8051440, PR3077: move tests about maximizing undecorated to OpenJDK - S8052012, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 5 - S8052408, PR3077: Move AWT_BAT functional tests to OpenJDK (3 of 3) - S8053657, PR3077: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK - S8054143, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 6 - S8054358, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 7 - S8054359, PR3077: move awt automated tests from AWT_Modality to OpenJDK repository - part 8 - S8055360, PR3077: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK - S8055664, PR3077: move 14 tests about setLocationRelativeTo to jdk - S8055836, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 9 - S8056911, PR3077: Remove internal API usage from ExtendedRobot class - S8057694, PR3077: move awt tests from AWT_Modality to OpenJDK repository - part 10 - S8058959, PR1061: closed/java/awt/event/ComponentEvent/MovedResizedTwiceTest/MovedResizedTwic eTest.java failed automatically - S8062606, PR3077: Fix a typo in java.awt.Robot class - S8063102, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1 - S8063104, PR3077: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2 - S8063106, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1 - S8063107, PR3077: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2 - S8064573, PR3077: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.java is asocial pressing VK_LEFT and not releasing - S8064575, PR3077: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases - S8064809, PR3077: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease - S8067441, PR3077: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes() - S8068228, PR3077: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameTest fails with GTKLookAndFeel - S8069361, PR1061: SunGraphics2D.getDefaultTransform() does not include scale factor - S8073320, PR1061: Windows HiDPI Graphics support - S8074807, PR3077: Fix some tests unnecessary using internal API - S8076315, PR3077: move 4 manual functional swing tests to regression suite - S8078504, PR3094: Zero lacks declaration of VM_Version::initialize() - S8129822, PR3077: Define "headful" jtreg keyword - S8132123, PR1061: MultiResolutionCachedImage unnecessarily creates base image to get its size - S8133539, PR1061: [TEST_BUG] Split java/awt/image/MultiResolutionImageTest.java in two to allow restricted access - S8137571, PR1061: Linux HiDPI Graphics support - S8142406, PR1061: [TEST] MultiResolution image: need test to cover the case when ( -at -) 2x image is corrupted - S8145188, PR2945: No LocalVariableTable generated for the entire JDK - S8150258, PR1061: [TEST] HiDPI: create a test for multiresolution menu items icons - S8150724, PR1061: [TEST] HiDPI: create a test for multiresolution icons - S8150844, PR1061: [hidpi] [macosx] -Dsun.java2d.uiScale should be taken into account for OS X - S8151841, PR2882: Build needs additional flags to compile with GCC 6 [plus parts of 8149647 & 8032045] - S8155613, PR1061: [PIT] crash in AWT_Desktop/Automated/Exceptions/BasicTest - S8156020, PR1061: 8145547 breaks AIX and and uses RTLD_NOLOAD incorrectly - S8156128, PR1061: Tests for [AWT/Swing] Conditional support for GTK 3 on Linux - S8158260, PR2991, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651) - S8159244, PR3074: Partially initialized string object created by C2's string concat optimization may escape - S8159690, PR3077: [TESTBUG] Mark headful tests with ( -at -) key headful. - S8160294, PR2882, PR3095: Some client libraries cannot be built with GCC 6 * Bug fixes - PR1958: GTKLookAndFeel does not honor gtk-alternative-button-order - PR2822: Feed LIBS & CFLAGS into configure rather than make to avoid re-discovery by OpenJDK configure - PR2932: Support ccache in a non-automagic manner - PR2933: Support ccache 3.2 and later - PR2964: Set system defaults based on OS - PR2974, RH1337583: PKCS#10 certificate requests now use CRLF line endings rather than system line endings - PR3078: Remove duplicated line [censored] back to 6788347 and 6894807 - PR3083, RH1346460: Regression in SSL debug output without an ECC provider - PR3089: Remove old memory limits patch - PR3090, RH1204159: SystemTap is heavily confused by multiple JDKs - PR3095: Fix warnings in URLClassPath.c - PR3096: Remove dead --disable-optimizations option - PR3105: Use version from hotspot.map to create tarball filename - PR3106: Handle both correctly-spelt property "enableCustomValueHandler" introduced by S8079718 and typo version - PR3108: Shenandoah patches not included in release tarball - PR3110: Update hotspot.map documentation in INSTALL * AArch64 port - S8145320, PR3078: Create unsafe_arraycopy and generic_arraycopy for AArch64 - S8148328, PR3078: aarch64: redundant lsr instructions in stub code. - S8148783, PR3078: aarch64: SEGV running SpecJBB2013 - S8148948, PR3078: aarch64: generate_copy_longs calls align() incorrectly - S8149080, PR3078: AArch64: Recognise disjoint array copy in stub code - S8149365, PR3078: aarch64: memory copy does not prefetch on backwards copy - S8149907, PR3078: aarch64: use load/store pair instructions in call_stub - S8150038, PR3078: aarch64: make use of CBZ and CBNZ when comparing narrow pointer with zero - S8150045, PR3078: arraycopy causes segfaults in SATB during garbage collection - S8150082, PR3078: aarch64: optimise small array copy - S8150229, PR3078: aarch64: pipeline class for several instructions is not set correctly - S8150313, PR3078: aarch64: optimise array copy using SIMD instructions - S8150394, PR3078: aarch64: add support for 8.1 LSE CAS instructions - S8151340, PR3078: aarch64: prefetch the destination word for write prior to ldxr/stxr loops. - S8151502, PR3078: optimize pd_disjoint_words and pd_conjoint_words - S8151775, PR3078: aarch64: add support for 8.1 LSE atomic operations - S8152537, PR3078: aarch64: Make use of CBZ and CBNZ when comparing unsigned values with zero. - S8152840, PR3078: aarch64: improve _unsafe_arraycopy stub routine - S8153713, PR3078: aarch64: improve short array clearing using store pair - S8153797, PR3078: aarch64: Add Arrays.fill stub code - S8154537, PR3078: AArch64: some integer rotate instructions are never emitted - S8154739, PR3078: AArch64: TemplateTable::fast_xaccess loads in wrong mode - S8155015, PR3078: Aarch64: bad assert in spill generation code - S8155100, PR3078: AArch64: Relax alignment requirement for byte_map_base - S8155612, PR3078: Aarch64: vector nodes need to support misaligned offset - S8155617, PR3078: aarch64: ClearArray does not use DC ZVA - S8155653, PR3078: TestVectorUnalignedOffset.java not pushed with 8155612 - S8156731, PR3078: aarch64: java/util/Arrays/Correct.java fails due to _generic_arraycopy stub routine - S8157841, PR3078: aarch64: prefetch ignores cache line size - S8157906, PR3078: aarch64: some more integer rotate instructions are never emitted - S8158913, PR3078: aarch64: SEGV running Spark terasort - S8159052, PR3078: aarch64: optimise unaligned copies in pd_disjoint_words and pd_conjoint_words - S8159063, PR3078: aarch64: optimise unaligned array copy long - PR3078: Cleanup remaining differences from aarch64/jdk8u tree - Fix script linking /usr/share/javazi/tzdb.dat for platform where it applies (bsc#987895) - Fix aarch64 running with 48 bits va space (bsc#984684) avoid some crashes This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-978=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.101-15.1 java-1_8_0-openjdk-accessibility-1.8.0.101-15.1 java-1_8_0-openjdk-debuginfo-1.8.0.101-15.1 java-1_8_0-openjdk-debugsource-1.8.0.101-15.1 java-1_8_0-openjdk-demo-1.8.0.101-15.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.101-15.1 java-1_8_0-openjdk-devel-1.8.0.101-15.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.101-15.1 java-1_8_0-openjdk-headless-1.8.0.101-15.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.101-15.1 java-1_8_0-openjdk-src-1.8.0.101-15.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.101-15.1 References: https://www.suse.com/security/cve/CVE-2016-3458.html https://www.suse.com/security/cve/CVE-2016-3485.html https://www.suse.com/security/cve/CVE-2016-3498.html https://www.suse.com/security/cve/CVE-2016-3500.html https://www.suse.com/security/cve/CVE-2016-3503.html https://www.suse.com/security/cve/CVE-2016-3508.html https://www.suse.com/security/cve/CVE-2016-3511.html https://www.suse.com/security/cve/CVE-2016-3550.html https://www.suse.com/security/cve/CVE-2016-3552.html https://www.suse.com/security/cve/CVE-2016-3587.html https://www.suse.com/security/cve/CVE-2016-3598.html https://www.suse.com/security/cve/CVE-2016-3606.html https://www.suse.com/security/cve/CVE-2016-3610.html https://bugzilla.suse.com/984684 https://bugzilla.suse.com/987895 https://bugzilla.suse.com/988651 https://bugzilla.suse.com/989721 https://bugzilla.suse.com/989722 https://bugzilla.suse.com/989723 https://bugzilla.suse.com/989725 https://bugzilla.suse.com/989726 https://bugzilla.suse.com/989727 https://bugzilla.suse.com/989728 https://bugzilla.suse.com/989729 https://bugzilla.suse.com/989730 https://bugzilla.suse.com/989731 https://bugzilla.suse.com/989732 https://bugzilla.suse.com/989733 https://bugzilla.suse.com/989734 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2052-1 Rating: important References: #982366 #984684 #988651 #989722 #989723 #989725 #989727 #989728 #989729 #989730 #989731 #989732 #989733 #989734 Cross-References: CVE-2016-3458 CVE-2016-3485 CVE-2016-3498 CVE-2016-3500 CVE-2016-3503 CVE-2016-3508 CVE-2016-3511 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has three fixes is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: - Update to 2.6.7 - OpenJDK 7u111 * Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732) - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734) - S8147771: Construction of static protection domains under Javax custom policy - S8148872, CVE-2016-3500: Complete name checking (bsc#989730) - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731) - S8150752: Share Class Data - S8151925: Font reference improvements - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733) - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722) - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723) - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725) - CVE-2016-3511 (bsc#989727) - CVE-2016-3503 (bsc#989728) - CVE-2016-3498 (bsc#989729) * Import of OpenJDK 7 u111 build 0 - S6953295: Move few sun.security.{util, x509, pkcs} classes used by keytool/jarsigner to another package - S7060849: Eliminate pack200 build warnings - S7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror - S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond - S7102686: Restructure timestamp code so that jars and modules can more easily share the same code - S7105780: Add SSLSocket client/SSLEngine server to templates directory - S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done - S7152582: PKCS11 tests should use the NSS libraries available in the OS - S7192202: Make sure keytool prints both unknown and unparseable extensions - S7194449: String resources for Key Tool and Policy Tool should be in their respective packages - S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found - S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so - S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win] - S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161 - S8019341: Update CookieHttpsClientTest to use the newer framework. - S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs - S8022439: Fix lint warnings in sun.security.ec - S8022594: Potential deadlock in of sun.nio.ch.Util/IOUtil - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently - S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp - S8037557: test SessionCacheSizeTests.java timeout - S8038837: Add support to jarsigner for specifying timestamp hash algorithm - S8079410: Hotspot version to share the same update and build version from JDK - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts - S8139436: sun.security.mscapi.KeyStore might load incomplete data - S8144313: Test SessionTimeOutTests can be timeout - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out - S8146669: Test SessionTimeOutTests fails intermittently - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811 - S8147857: [TEST] RMIConnector logs attribute names incorrectly - S8151841, PR3098: Build needs additional flags to compile with GCC 6 - S8151876: (tz) Support tzdata2016d - S8157077: 8u101 L10n resource file updates - S8161262: Fix jdk build with gcc 4.1.2: -fno-strict-overflow not known. * Import of OpenJDK 7 u111 build 1 - S7081817: test/sun/security/provider/certpath/X509CertPath/IllegalCertificates.java f ailing - S8140344: add support for 3 digit update release numbers - S8145017: Add support for 3 digit hotspot minor version numbers - S8162344: The API changes made by CR 7064075 need to be reverted * Backports - S2178143, PR2958: JVM crashes if the number of bound CPUs changed during runtime - S4900206, PR3101: Include worst-case rounding tests for Math library functions - S6260348, PR3067: GTK+ L&F JTextComponent not respecting desktop caret blink rate - S6934604, PR3075: enable parts of EliminateAutoBox by default - S7043064, PR3020: sun/java2d/cmm/ tests failed against RI b141 & b138-nightly - S7051394, PR3020: NullPointerException when running regression tests LoadProfileTest by using openjdk-7-b144 - S7086015, PR3013: fix test/tools/javac/parser/netbeans/JavacParserTest.java - S7119487, PR3013: JavacParserTest.java test fails on Windows platforms - S7124245, PR3020: [lcms] ColorConvertOp to color space CS_GRAY apparently converts orange to 244,244,0 - S7159445, PR3013: (javac) emits inaccurate diagnostics for enhanced for-loops - S7175845, PR1437, RH1207129: 'jar uf' changes file permissions unexpectedly - S8005402, PR3020: Need to provide benchmarks for color management - S8005530, PR3020: [lcms] Improve performance of ColorConverOp for default destinations - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not transferred from source to destination. - S8013430, PR3020: REGRESSION: closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadProfileTest.java fail s with java.io.StreamCorruptedException: invalid type code: EE since 8b87 - S8014286, PR3075: failed java/lang/Math/DivModTests.java after 6934604 changes - S8014959, PR3075: assert(Compile::current()->live_nodes() < (uint)MaxNodeLimit) failed: Live Node limit exceeded limit - S8019247, PR3075: SIGSEGV in compiled method c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object - S8024511, PR3020: Crash during color profile destruction - S8025429, PR3020: [parfait] warnings from b107 for sun.java2d.cmm: JNI exception pending - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for Java_awt test suit - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java fails with ClassCastException - S8069181, PR3012, RH1015612: java.lang.AssertionError when compiling JDK 1.4 code in JDK 8 - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651) - S8159244, PR3075: Partially initialized string object created by C2's string concat optimization may escape * Bug fixes - PR2799, RH1195203: Files are missing from resources.jar - PR2900: Don't use WithSeed versions of NSS functions as they don't fully process the seed - PR3091: SystemTap is heavily confused by multiple JDKs - PR3102: Extend 8022594 to AixPollPort - PR3103: Handle case in clean-fonts where linux.fontconfig.Gentoo.properties.old has not been created - PR3111: Provide option to disable SystemTap tests - PR3114: Don't assume system mime.types supports text/x-java-source - PR3115: Add check for elliptic curve cryptography implementation - PR3116: Add tests for Java debug info and source files - PR3118: Path to agpl-3.0.txt not updated - PR3119: Makefile handles cacerts as a symlink, but the configure check doesn't * AArch64 port - S8148328, PR3100: aarch64: redundant lsr instructions in stub code. - S8148783, PR3100: aarch64: SEGV running SpecJBB2013 - S8148948, PR3100: aarch64: generate_copy_longs calls align() incorrectly - S8150045, PR3100: arraycopy causes segfaults in SATB during garbage collection - S8154537, PR3100: AArch64: some integer rotate instructions are never emitted - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads in wrong mode - S8157906, PR3100: aarch64: some more integer rotate instructions are never emitted - Enable SunEC for SLE12 and Leap (bsc#982366) - Fix aarch64 running with 48 bits va space (bsc#984684) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-977=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.111-34.1 java-1_7_0-openjdk-accessibility-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.111-34.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-debugsource-1.7.0.111-34.1 java-1_7_0-openjdk-demo-1.7.0.111-34.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-devel-1.7.0.111-34.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-headless-1.7.0.111-34.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-34.1 java-1_7_0-openjdk-src-1.7.0.111-34.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.111-34.1 References: https://www.suse.com/security/cve/CVE-2016-3458.html https://www.suse.com/security/cve/CVE-2016-3485.html https://www.suse.com/security/cve/CVE-2016-3498.html https://www.suse.com/security/cve/CVE-2016-3500.html https://www.suse.com/security/cve/CVE-2016-3503.html https://www.suse.com/security/cve/CVE-2016-3508.html https://www.suse.com/security/cve/CVE-2016-3511.html https://www.suse.com/security/cve/CVE-2016-3550.html https://www.suse.com/security/cve/CVE-2016-3598.html https://www.suse.com/security/cve/CVE-2016-3606.html https://www.suse.com/security/cve/CVE-2016-3610.html https://bugzilla.suse.com/982366 https://bugzilla.suse.com/984684 https://bugzilla.suse.com/988651 https://bugzilla.suse.com/989722 https://bugzilla.suse.com/989723 https://bugzilla.suse.com/989725 https://bugzilla.suse.com/989727 https://bugzilla.suse.com/989728 https://bugzilla.suse.com/989729 https://bugzilla.suse.com/989730 https://bugzilla.suse.com/989731 https://bugzilla.suse.com/989732 https://bugzilla.suse.com/989733 https://bugzilla.suse.com/989734 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

CentOS Errata and Security Advisory 2016:1609 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1609.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 18c6edf90ed25c9d475c3b1403f3346f0fc9d9fce1602529953d89e1ba25f6a5 php-5.3.3-48.el6_8.i686.rpm 0381ca2ebe57a6199721f9dd763cae41f621b70df24e74120d291c678d3d608d php-bcmath-5.3.3-48.el6_8.i686.rpm 4229962d4c54bc4a2fbf7a2bdb480b8ce9e83f8df0d7eef0e6e5ed9d00d6df42 php-cli-5.3.3-48.el6_8.i686.rpm 877048f86306e96457d56a2841588066dc59f11092a0bd9dfefdedf8c3175818 php-common-5.3.3-48.el6_8.i686.rpm 4eadbd850fb86c1a4431fb6fbf129259d66e78f07497cb28ba8dfccc18dedf88 php-dba-5.3.3-48.el6_8.i686.rpm b6b59f89d830339ae10fae80311715009ef566d9e45d402b7c343893f437d792 php-devel-5.3.3-48.el6_8.i686.rpm e0707ddd380d1267c3eb4d5ae9c6dbcb23813a3dece73b8aa904520ca99a4733 php-embedded-5.3.3-48.el6_8.i686.rpm 817f91a142f06ef59046ce9b1ab520051ffaef12586e25496c0c71e9b504db3f php-enchant-5.3.3-48.el6_8.i686.rpm 32723d2724cb6308d20a5a965494954453e01576f8a71ebb915af1eb40074fa3 php-fpm-5.3.3-48.el6_8.i686.rpm 54afec582db22da5eeb731cafb7bc04ec4b25bd9564f36e8dc12561c48b28584 php-gd-5.3.3-48.el6_8.i686.rpm a10b719a400a07096f6ead9159aaedf87a22120770242eff3b41bbf9afbe1f3a php-imap-5.3.3-48.el6_8.i686.rpm 8b6fcaf1d11c378ce9dc41432682b8bbac8be5eff0bca6e962e453a88960e0e4 php-intl-5.3.3-48.el6_8.i686.rpm 5adcddc71a3ecfa33ca15229012d83c4ac7a3b7b3487729100e2f68499ccaeb0 php-ldap-5.3.3-48.el6_8.i686.rpm 3e37d64c44d6e8ffe4d8d642f2f489aea0f6e580e9f16f39d749723fefa2d7f1 php-mbstring-5.3.3-48.el6_8.i686.rpm c7357024effc3fb89f446007b49805b2f90d890838f7e25f4d514c065b879e76 php-mysql-5.3.3-48.el6_8.i686.rpm 9237841324d2c22af8de7f04033ddbe97ebcdf1d22656d45252798387eccb5bc php-odbc-5.3.3-48.el6_8.i686.rpm ae96e15ea55375df915691655c17053964f0cab565c973163d8e0dbc595da075 php-pdo-5.3.3-48.el6_8.i686.rpm ff2ad39995ef3c71520a76a0cae2e1316b2ae1f08d0b5988f73eaf3e10cd9529 php-pgsql-5.3.3-48.el6_8.i686.rpm 9c09408ed3b8e7e1a27b8e6afa2e5d6ad36b483cf4265811c8582358f60707da php-process-5.3.3-48.el6_8.i686.rpm 21aa3cf90ec7719f9ebda3e313848cfb3121bbf8a4498d534cd0f46ce082eb73 php-pspell-5.3.3-48.el6_8.i686.rpm 38edd0ec86a2ac0039fa21b3ead24ea0c902218d167d9cc85761f6d406436df8 php-recode-5.3.3-48.el6_8.i686.rpm 11de24349e892e33a0cd9ea4871b20fb9250071da947c2b29b2dc47900e1aa06 php-snmp-5.3.3-48.el6_8.i686.rpm 37a94dff92f1ec7c7ea10af54e3faee951e63aabe37d162e451a520536b5ef04 php-soap-5.3.3-48.el6_8.i686.rpm 3bbe86d4ccd9ef3a90f003a55e3ba398ca2ecea38d21c632dc1c0de0188ca81b php-tidy-5.3.3-48.el6_8.i686.rpm 9cd0909a9ea19d3218bb1b5f6127af924236f2e00edea226a434f7b3922a67a2 php-xml-5.3.3-48.el6_8.i686.rpm d09c64953f4860f431301a7ee576c276ebb2310a842f4a8e7a7f9a097c284cf0 php-xmlrpc-5.3.3-48.el6_8.i686.rpm 6d3c35c4675c7266cedfcb31317bedc9751e158a3277397a6883d7a1d87ac19e php-zts-5.3.3-48.el6_8.i686.rpm x86_64: e2421eaf40ad3ba9d2599b7254a47247e519a27aba1ea3163df39f0f7f6eea83 php-5.3.3-48.el6_8.x86_64.rpm 02d0905128afd492526990d7384aa175b02c49e6559ba7b5268942a2fc393c14 php-bcmath-5.3.3-48.el6_8.x86_64.rpm 65f2106eaed7769f345f3c761b37301b02672d04c3be4a0b956c1572a8dbc94c php-cli-5.3.3-48.el6_8.x86_64.rpm 9bde59e8008ebee788b8dc79fc0bab5f93b735762362bce387b241b85a2c428e php-common-5.3.3-48.el6_8.x86_64.rpm 2aed05aab03feff4b15734cbd7afa43c9e8b043b21a6095360f45e5f0f2ec47d php-dba-5.3.3-48.el6_8.x86_64.rpm 3bca7510f95e0cc860ea53f124413d118fc4254dea06630c9d6f59c9c351dbd3 php-devel-5.3.3-48.el6_8.x86_64.rpm 421267b3d3825907ef2e7cf04dc76a10d49118e60de4a5f57ecbaf14bf9a65ba php-embedded-5.3.3-48.el6_8.x86_64.rpm f84ed8fcb311c59ec09f7629d18ed05ffc898d2dcabd897d7962ab5087f831e6 php-enchant-5.3.3-48.el6_8.x86_64.rpm 3f3851ab0ec840d4b1e0bdbfe4e0b685469b72dce4580ded56bec0740f94b638 php-fpm-5.3.3-48.el6_8.x86_64.rpm 7142f186a4f8b2fa72865b7f6d2a17dc3c150c9e72945b365295231d43157678 php-gd-5.3.3-48.el6_8.x86_64.rpm 308264471717187958e5795446c354c6c33c066508ac762a3737b662e423e1ce php-imap-5.3.3-48.el6_8.x86_64.rpm 9b9cc61b001d8c98be9c7ca752bd2aee9760bdafe5703126a87c3830c1f2eedd php-intl-5.3.3-48.el6_8.x86_64.rpm e3f466bb9e793cb0788aae9a9f3e52dcf921d3e699449d7d74fe6294848d510e php-ldap-5.3.3-48.el6_8.x86_64.rpm 0400d330de9ea1add901c25545479d9c9bd3dc428088fdf9bcb0454c6fb882b6 php-mbstring-5.3.3-48.el6_8.x86_64.rpm fa42e27d9effc54766fdf7c17551dc04f4452dd3165ca67a83e00eff5ec85f15 php-mysql-5.3.3-48.el6_8.x86_64.rpm 34092dd9ebdf1fbbfdbdcf29772ed0143994c077432f03aaf98825fceb5b9ce4 php-odbc-5.3.3-48.el6_8.x86_64.rpm 6bf0de2fc18865a3471e688c061e6325c7b226189f4b4d868fcac84c24e80a73 php-pdo-5.3.3-48.el6_8.x86_64.rpm c3f8c646635414938f3494944bdb9b2b9e4d20a873c061e6f0ab15c8e9346a66 php-pgsql-5.3.3-48.el6_8.x86_64.rpm 90a1b1fc3715699495120ae37570960c620f39269d729d314c26a434c456f844 php-process-5.3.3-48.el6_8.x86_64.rpm d5e4001f42e9b3ef0b9d08eab19d47ece87b2bb0af7680c799770537657ece6c php-pspell-5.3.3-48.el6_8.x86_64.rpm 6b1c5afa4010d6d66e74aa333729ffc5b943d2deaf6bacac8d0a2e7d02a6807a php-recode-5.3.3-48.el6_8.x86_64.rpm 4825c1150bd6a5cfc83f735599a30587577108088ab7349b42236d00754dd733 php-snmp-5.3.3-48.el6_8.x86_64.rpm a3ce07ebbe5f160d9e81bc8e4ca3b6ca35d04f70c3cbb05d40cb248a1920def6 php-soap-5.3.3-48.el6_8.x86_64.rpm 82c187e054f5145a27e161ac3155d2de546ffb52c8dede9b7461dcc0b7800c42 php-tidy-5.3.3-48.el6_8.x86_64.rpm 8575e3d3c49145d77c2d1f0a1e977b2e0ac49e4f77fe30f8e39dbb657e9563ba php-xml-5.3.3-48.el6_8.x86_64.rpm 1195b35b7b37861581e66dfb845152ad7fda8d4387a13fa4d42e6bf25c5738ce php-xmlrpc-5.3.3-48.el6_8.x86_64.rpm bcba7a176f961c69b32d13d2ab51e50a1c4fe8b595d68d23c67c549759f23d79 php-zts-5.3.3-48.el6_8.x86_64.rpm Source: 2207dc0d07e418746c6685856265d079e3e45c4ca18657d7520c01f43a8f8c26 php-5.3.3-48.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos ( -at -) irc.freenode.net Twitter: ( -at -) JohnnyCentOS _______________________________________________

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2050-1 Rating: important References: #988651 #989722 #989723 #989725 #989727 #989728 #989729 #989730 #989731 #989732 #989733 #989734 Cross-References: CVE-2016-3458 CVE-2016-3485 CVE-2016-3498 CVE-2016-3500 CVE-2016-3503 CVE-2016-3508 CVE-2016-3511 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has one errata is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: - Update to 2.6.7 - OpenJDK 7u111 * Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking (bsc#989732) - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only) (bsc#989734) - S8147771: Construction of static protection domains under Javax custom policy - S8148872, CVE-2016-3500: Complete name checking (bsc#989730) - S8149962, CVE-2016-3508: Better delineation of XML processing (bsc#989731) - S8150752: Share Class Data - S8151925: Font reference improvements - S8152479, CVE-2016-3550: Coded byte streams (bsc#989733) - S8155981, CVE-2016-3606: Bolster bytecode verification (bsc#989722) - S8155985, CVE-2016-3598: Persistent Parameter Processing (bsc#989723) - S8158571, CVE-2016-3610: Additional method handle validation (bsc#989725) - CVE-2016-3511 (bsc#989727) - CVE-2016-3503 (bsc#989728) - CVE-2016-3498 (bsc#989729) * Import of OpenJDK 7 u111 build 0 - S6953295: Move few sun.security.{util, x509, pkcs} classes used by keytool/jarsigner to another package - S7060849: Eliminate pack200 build warnings - S7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror - S7069870: Parts of the JDK erroneously rely on generic array initializers with diamond - S7102686: Restructure timestamp code so that jars and modules can more easily share the same code - S7105780: Add SSLSocket client/SSLEngine server to templates directory - S7142339: PKCS7.java is needlessly creating SHA1PRNG SecureRandom instances when timestamping is not done - S7152582: PKCS11 tests should use the NSS libraries available in the OS - S7192202: Make sure keytool prints both unknown and unparseable extensions - S7194449: String resources for Key Tool and Policy Tool should be in their respective packages - S7196855: autotest.sh fails on ubuntu because libsoftokn.so not found - S7200682: TEST_BUG: keytool/autotest.sh still has problems with libsoftokn.so - S8002306: (se) Selector.open fails if invoked with thread interrupt status set [win] - S8009636: JARSigner including TimeStamp PolicyID (TSAPolicyID) as defined in RFC3161 - S8019341: Update CookieHttpsClientTest to use the newer framework. - S8022228: Intermittent test failures in sun/security/ssl/javax/net/ssl/NewAPIs - S8022439: Fix lint warnings in sun.security.ec - S8022594: Potential deadlock in of sun.nio.ch.Util/IOUtil - S8023546: sun/security/mscapi/ShortRSAKey1024.sh fails intermittently - S8036612: [parfait] JNI exception pending in jdk/src/windows/native/sun/security/mscapi/security.cpp - S8037557: test SessionCacheSizeTests.java timeout - S8038837: Add support to jarsigner for specifying timestamp hash algorithm - S8079410: Hotspot version to share the same update and build version from JDK - S8130735: javax.swing.TimerQueue: timer fires late when another timer starts - S8139436: sun.security.mscapi.KeyStore might load incomplete data - S8144313: Test SessionTimeOutTests can be timeout - S8146387: Test SSLSession/SessionCacheSizeTests socket accept timed out - S8146669: Test SessionTimeOutTests fails intermittently - S8146993: Several javax/management/remote/mandatory regression tests fail after JDK-8138811 - S8147857: [TEST] RMIConnector logs attribute names incorrectly - S8151841, PR3098: Build needs additional flags to compile with GCC 6 - S8151876: (tz) Support tzdata2016d - S8157077: 8u101 L10n resource file updates - S8161262: Fix jdk build with gcc 4.1.2: -fno-strict-overflow not known. * Import of OpenJDK 7 u111 build 1 - S7081817: test/sun/security/provider/certpath/X509CertPath/IllegalCertificates.java f ailing - S8140344: add support for 3 digit update release numbers - S8145017: Add support for 3 digit hotspot minor version numbers - S8162344: The API changes made by CR 7064075 need to be reverted * Backports - S2178143, PR2958: JVM crashes if the number of bound CPUs changed during runtime - S4900206, PR3101: Include worst-case rounding tests for Math library functions - S6260348, PR3067: GTK+ L&F JTextComponent not respecting desktop caret blink rate - S6934604, PR3075: enable parts of EliminateAutoBox by default - S7043064, PR3020: sun/java2d/cmm/ tests failed against RI b141 & b138-nightly - S7051394, PR3020: NullPointerException when running regression tests LoadProfileTest by using openjdk-7-b144 - S7086015, PR3013: fix test/tools/javac/parser/netbeans/JavacParserTest.java - S7119487, PR3013: JavacParserTest.java test fails on Windows platforms - S7124245, PR3020: [lcms] ColorConvertOp to color space CS_GRAY apparently converts orange to 244,244,0 - S7159445, PR3013: (javac) emits inaccurate diagnostics for enhanced for-loops - S7175845, PR1437, RH1207129: 'jar uf' changes file permissions unexpectedly - S8005402, PR3020: Need to provide benchmarks for color management - S8005530, PR3020: [lcms] Improve performance of ColorConverOp for default destinations - S8005930, PR3020: [lcms] ColorConvertOp: Alpha channel is not transferred from source to destination. - S8013430, PR3020: REGRESSION: closed/java/awt/color/ICC_Profile/LoadProfileTest/LoadProfileTest.java fail s with java.io.StreamCorruptedException: invalid type code: EE since 8b87 - S8014286, PR3075: failed java/lang/Math/DivModTests.java after 6934604 changes - S8014959, PR3075: assert(Compile::current()->live_nodes() < (uint)MaxNodeLimit) failed: Live Node limit exceeded limit - S8019247, PR3075: SIGSEGV in compiled method c8e.e.t_.getArray(Ljava/lang/Class;)[Ljava/lang/Object - S8024511, PR3020: Crash during color profile destruction - S8025429, PR3020: [parfait] warnings from b107 for sun.java2d.cmm: JNI exception pending - S8026702, PR3020: Fix for 8025429 breaks jdk build on windows - S8026780, PR3020, RH1142587: Crash on PPC and PPC v2 for Java_awt test suit - S8047066, PR3020: Test test/sun/awt/image/bug8038000.java fails with ClassCastException - S8069181, PR3012, RH1015612: java.lang.AssertionError when compiling JDK 1.4 code in JDK 8 - S8158260, PR2992, RH1341258: PPC64: unaligned Unsafe.getInt can lead to the generation of illegal instructions (bsc#988651) - S8159244, PR3075: Partially initialized string object created by C2's string concat optimization may escape * Bug fixes - PR2799, RH1195203: Files are missing from resources.jar - PR2900: Don't use WithSeed versions of NSS functions as they don't fully process the seed - PR3091: SystemTap is heavily confused by multiple JDKs - PR3102: Extend 8022594 to AixPollPort - PR3103: Handle case in clean-fonts where linux.fontconfig.Gentoo.properties.old has not been created - PR3111: Provide option to disable SystemTap tests - PR3114: Don't assume system mime.types supports text/x-java-source - PR3115: Add check for elliptic curve cryptography implementation - PR3116: Add tests for Java debug info and source files - PR3118: Path to agpl-3.0.txt not updated - PR3119: Makefile handles cacerts as a symlink, but the configure check doesn't * AArch64 port - S8148328, PR3100: aarch64: redundant lsr instructions in stub code. - S8148783, PR3100: aarch64: SEGV running SpecJBB2013 - S8148948, PR3100: aarch64: generate_copy_longs calls align() incorrectly - S8150045, PR3100: arraycopy causes segfaults in SATB during garbage collection - S8154537, PR3100: AArch64: some integer rotate instructions are never emitted - S8154739, PR3100: AArch64: TemplateTable::fast_xaccess loads in wrong mode - S8157906, PR3100: aarch64: some more integer rotate instructions are never emitted Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-976=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.111-25.1 java-1_7_0-openjdk-accessibility-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.111-25.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-debugsource-1.7.0.111-25.1 java-1_7_0-openjdk-demo-1.7.0.111-25.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-devel-1.7.0.111-25.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-headless-1.7.0.111-25.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.111-25.1 java-1_7_0-openjdk-src-1.7.0.111-25.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.111-25.1 References: https://www.suse.com/security/cve/CVE-2016-3458.html https://www.suse.com/security/cve/CVE-2016-3485.html https://www.suse.com/security/cve/CVE-2016-3498.html https://www.suse.com/security/cve/CVE-2016-3500.html https://www.suse.com/security/cve/CVE-2016-3503.html https://www.suse.com/security/cve/CVE-2016-3508.html https://www.suse.com/security/cve/CVE-2016-3511.html https://www.suse.com/security/cve/CVE-2016-3550.html https://www.suse.com/security/cve/CVE-2016-3598.html https://www.suse.com/security/cve/CVE-2016-3606.html https://www.suse.com/security/cve/CVE-2016-3610.html https://bugzilla.suse.com/988651 https://bugzilla.suse.com/989722 https://bugzilla.suse.com/989723 https://bugzilla.suse.com/989725 https://bugzilla.suse.com/989727 https://bugzilla.suse.com/989728 https://bugzilla.suse.com/989729 https://bugzilla.suse.com/989730 https://bugzilla.suse.com/989731 https://bugzilla.suse.com/989732 https://bugzilla.suse.com/989733 https://bugzilla.suse.com/989734 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

AMD's Radeon RX 460 graphics card is its first to use the tiny Polaris 11 GPU, which promises a major boost in performance-per-watt for its price class. We put it to the test to see just what entry-level gamers can expect from a $109-and-up graphics card. Read more: http://techreport.com/review/30488/amd-radeon-rx-460-graphics-card-reviewed --- The Tech Report - PC Hardware Explored http://techreport.com -- To unsubscribe from: TR-News, just follow this link: http://node1.techreport.com/cgi-bin/dada/mail.cgi/u/trnews/reviewnews// Click this link, or copy and paste the address into your browser.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Package : nettle Version : 2.4-3+deb7u1 CVE ID : CVE-2016-6489 Debian Bug : 832983 The cryptographic library nettle had a potential information leak problem reported. CVE-2016-6489 RSA code is vulnerable to cache sharing related attacks. For Debian 7 "Wheezy", this problems has been fixed in version 2.4-3+deb7u1. We recommend that you upgrade your nettle packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -- --- Inguza Technology AB --- MSc in Information Technology ---- / ola ( -at -) inguza.com Folkebogatan 26 \ | opal ( -at -) debian.org 654 68 KARLSTAD | | http://inguza.com/ Mobile: +46 (0)70-332 1551 | \ gpg/f.p.: 22F2 32C6 B1E0 F4BF 2B26 0A6A 5E90 DCFA 9426 876F / --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCAAGBQJXrMr1AAoJEF6Q3PqUJodvYwkQAJAfBVvn8InntzU+phbdy+Uz I4l9KI0G7kh6aO3nyB/ONkKaCAimkI6Gkf6Md123fdcErHiF0QXHcA4NZjIH++F5 CEivOaRT1QsfZOIBCVvePgUCAXJ6EAHE76lBPRF[censored]W4Dn/k9Aj8ODZnp3GihpXA Q8aEOEX7ZpiHFOy04z3teAkOpXImWIUrEEUtdQC/gX3VcdwyuCGg2vEMPzGJB+LT GDiswTtmjjVdCC/Vt7MTcjaWNbEQwHNnAFJIKWlfwQlweOssBzHpLYKGfum0TgAY emhg/2IEf0zUFGm7jBQtpgHHbnWpWWuAC0/3oS7KFzgjmvpCAKI+d1/uxFf3xRC2 +8UnV0ZODoG/aOlhvdXw6Z8S5X0AutqwOuLW/kNCkhOkqScgNYKo597/TnB1H39I lh5KgWd3wkvFTjCZBSYEfB6/yO+Ul/HzgPB42pCN4Mmv3PL94Y3s3C3JKGfnbdnq fN2RWXP6EOHRBuKE4YZzkLWR27XhOuzVPhonz3z5wNpe2CuCTs+1qhQ8BkNzkrNC pUs0QG3ExWsWfW5T0Q1CDj2zjtU9qUiXIDdC6DvsUm2vglVEV0jd/thDEKnnQmAK EIBj7KySsXWzb3H0hN1VY0resqXXzpkRGx2DwRR4oyPE+FrLMIROu7O4mf8A1lke 9cGm40fJtYNVw0DsjtQA =SDgH -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Enterprise security update Advisory ID: RHSA-2016:1605-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2016:1605 Issue date: 2016-08-11 CVE Names: CVE-2016-1000022 CVE-2016-1000023 ===================================================================== 1. Summary: An update is now available for Red Hat OpenShift Enterprise 3.1 and Red Hat OpenShift Enterprise 3.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Enterprise 3.1 - noarch Red Hat OpenShift Enterprise 3.2 - noarch 3. Description: OpenShift Enterprise by Red Hat is the company's cloud computing Platform- as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. The logging auth proxy is a reverse proxy that authenticates requests against OpenShift, retrieving user information and setting the configured header with the appropriate details. Security Fix(es): * A regular expression denial of service flaw was found in Negotiator. An attacker able to make an application using Negotiator to perform matching using a specially crafted glob pattern could cause the application to consume an excessive amount of CPU. (CVE-2016-1000022) * A regular expression denial of service flaw was found in Minimatch. An attacker able to make an application using Minimatch to perform matching using a specially crafted glob pattern could cause the application to consume an excessive amount of CPU. (CVE-2016-1000023) Refer to the changelog listed in the References section for a list of changes. This update includes the following images: openshift3/logging-auth-proxy:3.1.1-13 openshift3/logging-auth-proxy:3.2.1-5 All OpenShift Enterprise 3 users are advised to upgrade to the updated images. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1347677 - CVE-2016-1000022 nodejs-negotiator: Regular expression denial-of-service 1348509 - CVE-2016-1000023 nodejs-minimatch: Regular expression denial-of-service 6. Package List: Red Hat OpenShift Enterprise 3.1: Source: nodejs-accepts-1.3.3-1.el7.src.rpm nodejs-express-4.13.3-4.el7.src.rpm nodejs-mime-db-1.23.0-1.el7.src.rpm nodejs-mime-types-2.1.11-1.el7.src.rpm nodejs-minimatch-3.0.2-1.el7.src.rpm nodejs-negotiator-0.6.1-1.el7.src.rpm noarch: nodejs-accepts-1.3.3-1.el7.noarch.rpm nodejs-express-4.13.3-4.el7.noarch.rpm nodejs-mime-db-1.23.0-1.el7.noarch.rpm nodejs-mime-types-2.1.11-1.el7.noarch.rpm nodejs-minimatch-3.0.2-1.el7.noarch.rpm nodejs-negotiator-0.6.1-1.el7.noarch.rpm Red Hat OpenShift Enterprise 3.2: Source: nodejs-accepts-1.3.3-1.el7.src.rpm nodejs-express-4.13.3-4.el7.src.rpm nodejs-mime-db-1.23.0-1.el7.src.rpm nodejs-mime-types-2.1.11-1.el7.src.rpm nodejs-minimatch-3.0.2-1.el7.src.rpm nodejs-negotiator-0.6.1-1.el7.src.rpm noarch: nodejs-accepts-1.3.3-1.el7.noarch.rpm nodejs-express-4.13.3-4.el7.noarch.rpm nodejs-mime-db-1.23.0-1.el7.noarch.rpm nodejs-mime-types-2.1.11-1.el7.noarch.rpm nodejs-minimatch-3.0.2-1.el7.noarch.rpm nodejs-negotiator-0.6.1-1.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-1000022 https://access.redhat.com/security/cve/CVE-2016-1000023 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrLXGXlSAg2UNWIIRArocAJ9+WgzNssjwe83oaonRElAC53IdhACgxRui HZIq2cFtWbY2vNuXqE4rnNo= =8+17 -----END PGP SIGNATURE----- --

View this email in your browser (http://us3.campaign-archive1.com/?u=efc4c507c2cf964fc2462caca&id=5cc25ad6a5&e=0c004f9c13) CybertronPC is hoping to hit a sweet spot for gamers with its new 14-inch laptop, the CLX Osiris 14. The system is light and slim for a gaming laptop, but it packs an NVIDIA GeForce GTX 970M and Intel Skylake quad-core CPU under its hood, so this machine is clearly not messing around... CybertronPC CLX Osiris 14 Gaming Laptop Review (http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=7b31434ab7&e=0c004f9c13) http://hothardware.us3.list-manage2.com/track/click?u=efc4c507c2cf964fc2462caca&id=fff6a201b5&e=0c004f9c13 http://hothardware.us3.list-manage1.com/track/click?u=efc4c507c2cf964fc2462caca&id=96284c20a8&e=0c004f9c13 Best Regards, HotHardware.com http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=39d6b09770&e=0c004f9c13 http://hothardware.us3.list-manage.com/track/click?u=efc4c507c2cf964fc2462caca&id=ceb5504838&e=0c004f9c13 http://hothardware.us3.list-manage2.com/track/click?u=efc4c507c2cf964fc2462caca&id=8dfb343cad&e=0c004f9c13 ============================================================

Hi! As I've had so many requests again, I'm organising another mini-DebConf in Cambridge this year. Again, my employer ARM is going to host the conference for 4 days in November: * 2 days for a mini-DebCamp (Thu 10 - Fri 11), with space for dedicated development / sprint / team meetings for up to 40 people * 2 days for a more regular mini-conf (Sat 12 - Sun 13) with space for more general talks, up to 80 people I'm also hoping to find sponsors again to cover some other costs for the conference for things like food - please contact me if you can help! I'm expecting that we will end up discussing and working on the arm ports and other ARM-related topics at the very least, but there's also plenty of scope for other subjects for both sprint work and talks. For more details and to sign up to attend, please visit the wiki page at https://wiki.debian.org/DebianEvents/gb/2016/MiniDebConfCambridge -- Steve McIntyre, Cambridge, UK. steve ( -at -) einval.com You raise the blade, you make the change... You re-arrange me 'til I'm sane...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: mariadb security update Advisory ID: RHSA-2016:1602-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1602.html Issue date: 2016-08-11 CVE Names: CVE-2016-0640 CVE-2016-0641 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0666 CVE-2016-3452 CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 CVE-2016-5444 ===================================================================== 1. Summary: An update for mariadb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a newer upstream version: mariadb (5.5.50). Security Fix(es): * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages, listed in the References section. (CVE-2016-0640, CVE-2016-0641, CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0666, CVE-2016-3452, CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440, CVE-2016-5444) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1329239 - CVE-2016-0640 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) 1329241 - CVE-2016-0641 mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) 1329245 - CVE-2016-0643 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) 1329247 - CVE-2016-0644 mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) 1329248 - CVE-2016-0646 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) 1329249 - CVE-2016-0647 mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) 1329251 - CVE-2016-0648 mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) 1329252 - CVE-2016-0649 mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) 1329253 - CVE-2016-0650 mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) 1329270 - CVE-2016-0666 mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016) 1358201 - CVE-2016-3452 mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016) 1358205 - CVE-2016-3477 mysql: unspecified vulnerability in subcomponent: Server: Parser (CPU July 2016) 1358209 - CVE-2016-3521 mysql: unspecified vulnerability in subcomponent: Server: Types (CPU July 2016) 1358212 - CVE-2016-3615 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU July 2016) 1358218 - CVE-2016-5440 mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016) 1358223 - CVE-2016-5444 mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: mariadb-5.5.50-1.el7_2.src.rpm x86_64: mariadb-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-libs-5.5.50-1.el7_2.i686.rpm mariadb-libs-5.5.50-1.el7_2.x86_64.rpm mariadb-server-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: mariadb-bench-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-devel-5.5.50-1.el7_2.i686.rpm mariadb-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-5.5.50-1.el7_2.i686.rpm mariadb-embedded-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-devel-5.5.50-1.el7_2.i686.rpm mariadb-embedded-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-test-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: mariadb-5.5.50-1.el7_2.src.rpm x86_64: mariadb-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-libs-5.5.50-1.el7_2.i686.rpm mariadb-libs-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: mariadb-bench-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-devel-5.5.50-1.el7_2.i686.rpm mariadb-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-5.5.50-1.el7_2.i686.rpm mariadb-embedded-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-devel-5.5.50-1.el7_2.i686.rpm mariadb-embedded-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-server-5.5.50-1.el7_2.x86_64.rpm mariadb-test-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: mariadb-5.5.50-1.el7_2.src.rpm ppc64: mariadb-5.5.50-1.el7_2.ppc64.rpm mariadb-bench-5.5.50-1.el7_2.ppc64.rpm mariadb-debuginfo-5.5.50-1.el7_2.ppc.rpm mariadb-debuginfo-5.5.50-1.el7_2.ppc64.rpm mariadb-devel-5.5.50-1.el7_2.ppc.rpm mariadb-devel-5.5.50-1.el7_2.ppc64.rpm mariadb-libs-5.5.50-1.el7_2.ppc.rpm mariadb-libs-5.5.50-1.el7_2.ppc64.rpm mariadb-server-5.5.50-1.el7_2.ppc64.rpm mariadb-test-5.5.50-1.el7_2.ppc64.rpm ppc64le: mariadb-5.5.50-1.el7_2.ppc64le.rpm mariadb-bench-5.5.50-1.el7_2.ppc64le.rpm mariadb-debuginfo-5.5.50-1.el7_2.ppc64le.rpm mariadb-devel-5.5.50-1.el7_2.ppc64le.rpm mariadb-libs-5.5.50-1.el7_2.ppc64le.rpm mariadb-server-5.5.50-1.el7_2.ppc64le.rpm mariadb-test-5.5.50-1.el7_2.ppc64le.rpm s390x: mariadb-5.5.50-1.el7_2.s390x.rpm mariadb-bench-5.5.50-1.el7_2.s390x.rpm mariadb-debuginfo-5.5.50-1.el7_2.s390.rpm mariadb-debuginfo-5.5.50-1.el7_2.s390x.rpm mariadb-devel-5.5.50-1.el7_2.s390.rpm mariadb-devel-5.5.50-1.el7_2.s390x.rpm mariadb-libs-5.5.50-1.el7_2.s390.rpm mariadb-libs-5.5.50-1.el7_2.s390x.rpm mariadb-server-5.5.50-1.el7_2.s390x.rpm mariadb-test-5.5.50-1.el7_2.s390x.rpm x86_64: mariadb-5.5.50-1.el7_2.x86_64.rpm mariadb-bench-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-devel-5.5.50-1.el7_2.i686.rpm mariadb-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-libs-5.5.50-1.el7_2.i686.rpm mariadb-libs-5.5.50-1.el7_2.x86_64.rpm mariadb-server-5.5.50-1.el7_2.x86_64.rpm mariadb-test-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: mariadb-debuginfo-5.5.50-1.el7_2.ppc.rpm mariadb-debuginfo-5.5.50-1.el7_2.ppc64.rpm mariadb-embedded-5.5.50-1.el7_2.ppc.rpm mariadb-embedded-5.5.50-1.el7_2.ppc64.rpm mariadb-embedded-devel-5.5.50-1.el7_2.ppc.rpm mariadb-embedded-devel-5.5.50-1.el7_2.ppc64.rpm ppc64le: mariadb-debuginfo-5.5.50-1.el7_2.ppc64le.rpm mariadb-embedded-5.5.50-1.el7_2.ppc64le.rpm mariadb-embedded-devel-5.5.50-1.el7_2.ppc64le.rpm s390x: mariadb-debuginfo-5.5.50-1.el7_2.s390.rpm mariadb-debuginfo-5.5.50-1.el7_2.s390x.rpm mariadb-embedded-5.5.50-1.el7_2.s390.rpm mariadb-embedded-5.5.50-1.el7_2.s390x.rpm mariadb-embedded-devel-5.5.50-1.el7_2.s390.rpm mariadb-embedded-devel-5.5.50-1.el7_2.s390x.rpm x86_64: mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-5.5.50-1.el7_2.i686.rpm mariadb-embedded-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-devel-5.5.50-1.el7_2.i686.rpm mariadb-embedded-devel-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: mariadb-5.5.50-1.el7_2.src.rpm x86_64: mariadb-5.5.50-1.el7_2.x86_64.rpm mariadb-bench-5.5.50-1.el7_2.x86_64.rpm mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-devel-5.5.50-1.el7_2.i686.rpm mariadb-devel-5.5.50-1.el7_2.x86_64.rpm mariadb-libs-5.5.50-1.el7_2.i686.rpm mariadb-libs-5.5.50-1.el7_2.x86_64.rpm mariadb-server-5.5.50-1.el7_2.x86_64.rpm mariadb-test-5.5.50-1.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: mariadb-debuginfo-5.5.50-1.el7_2.i686.rpm mariadb-debuginfo-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-5.5.50-1.el7_2.i686.rpm mariadb-embedded-5.5.50-1.el7_2.x86_64.rpm mariadb-embedded-devel-5.5.50-1.el7_2.i686.rpm mariadb-embedded-devel-5.5.50-1.el7_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-0640 https://access.redhat.com/security/cve/CVE-2016-0641 https://access.redhat.com/security/cve/CVE-2016-0643 https://access.redhat.com/security/cve/CVE-2016-0644 https://access.redhat.com/security/cve/CVE-2016-0646 https://access.redhat.com/security/cve/CVE-2016-0647 https://access.redhat.com/security/cve/CVE-2016-0648 https://access.redhat.com/security/cve/CVE-2016-0649 https://access.redhat.com/security/cve/CVE-2016-0650 https://access.redhat.com/security/cve/CVE-2016-0666 https://access.redhat.com/security/cve/CVE-2016-3452 https://access.redhat.com/security/cve/CVE-2016-3477 https://access.redhat.com/security/cve/CVE-2016-3521 https://access.redhat.com/security/cve/CVE-2016-3615 https://access.redhat.com/security/cve/CVE-2016-5440 https://access.redhat.com/security/cve/CVE-2016-5444 https://access.redhat.com/security/updates/classification/#important http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixMSQL http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5550-release-notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrI5tXlSAg2UNWIIRAoMKAKCk82023z4v+aYdgpwKwjirfoOVTwCgtUwp 9y8bd6YZ2ioVv7ENX6rspoc= =nTD6 -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-mysql56-mysql security update Advisory ID: RHSA-2016:1601-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1601.html Issue date: 2016-08-11 CVE Names: CVE-2016-3459 CVE-2016-3477 CVE-2016-3486 CVE-2016-3501 CVE-2016-3521 CVE-2016-3614 CVE-2016-3615 CVE-2016-5439 CVE-2016-5440 ===================================================================== 1. Summary: An update for rh-mysql56-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The following packages have been upgraded to a newer upstream version: rh-mysql56-mysql (5.6.32). Security Fix(es): * This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3459, CVE-2016-3477, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3614, CVE-2016-3615, CVE-2016-5439, CVE-2016-5440) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1358202 - CVE-2016-3459 mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) 1358205 - CVE-2016-3477 mysql: unspecified vulnerability in subcomponent: Server: Parser (CPU July 2016) 1358206 - CVE-2016-3486 mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU July 2016) 1358207 - CVE-2016-3501 mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU July 2016) 1358209 - CVE-2016-3521 mysql: unspecified vulnerability in subcomponent: Server: Types (CPU July 2016) 1358211 - CVE-2016-3614 mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016) 1358212 - CVE-2016-3615 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU July 2016) 1358216 - CVE-2016-5439 mysql: unspecified vulnerability in subcomponent: Server: Privileges (CPU July 2016) 1358218 - CVE-2016-5440 mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016) 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-mysql56-mysql-5.6.32-1.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-mysql56-mysql-5.6.32-1.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-mysql56-mysql-5.6.32-1.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-mysql56-mysql-5.6.32-1.el6.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el6.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mysql56-mysql-5.6.32-1.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: rh-mysql56-mysql-5.6.32-1.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-mysql56-mysql-5.6.32-1.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-mysql56-mysql-5.6.32-1.el7.src.rpm x86_64: rh-mysql56-mysql-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-bench-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-common-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-config-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-debuginfo-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-devel-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-errmsg-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-server-5.6.32-1.el7.x86_64.rpm rh-mysql56-mysql-test-5.6.32-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-3459 https://access.redhat.com/security/cve/CVE-2016-3477 https://access.redhat.com/security/cve/CVE-2016-3486 https://access.redhat.com/security/cve/CVE-2016-3501 https://access.redhat.com/security/cve/CVE-2016-3521 https://access.redhat.com/security/cve/CVE-2016-3614 https://access.redhat.com/security/cve/CVE-2016-3615 https://access.redhat.com/security/cve/CVE-2016-5439 https://access.redhat.com/security/cve/CVE-2016-5440 https://access.redhat.com/security/updates/classification/#important http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-32.html 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrI4xXlSAg2UNWIIRAoUcAJ9/1CbuBAUulo4awyGSncXHJLkbYQCfaRQx 2TFWuluSLoYZbUOX6WXmd1Y= =ZZhJ -----END PGP SIGNATURE----- --

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2036-1 Rating: important References: #984990 #985609 #985665 #985669 #985673 #985675 #985679 #985682 #985685 #985688 #985689 #985697 #985698 #985700 #985703 #985704 #985706 #985826 #985832 #985835 Cross-References: CVE-2015-8918 CVE-2015-8919 CVE-2015-8920 CVE-2015-8921 CVE-2015-8922 CVE-2015-8923 CVE-2015-8924 CVE-2015-8925 CVE-2015-8926 CVE-2015-8928 CVE-2015-8929 CVE-2015-8930 CVE-2015-8931 CVE-2015-8932 CVE-2015-8933 CVE-2015-8934 CVE-2016-4300 CVE-2016-4301 CVE-2016-4302 CVE-2016-4809 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: libarchive was updated to fix 20 security issues. These security issues were fixed: - CVE-2015-8918: Overlapping memcpy in CAB parser (bsc#985698). - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser (bsc#985697). - CVE-2015-8920: Stack out of bounds read in ar parser (bsc#985675). - CVE-2015-8921: Global out of bounds read in mtree parser (bsc#985682). - CVE-2015-8922: Null pointer access in 7z parser (bsc#985685). - CVE-2015-8923: Unclear crashes in ZIP parser (bsc#985703). - CVE-2015-8924: Heap buffer read overflow in tar (bsc#985609). - CVE-2015-8925: Unclear invalid memory read in mtree parser (bsc#985706). - CVE-2015-8926: NULL pointer access in RAR parser (bsc#985704). - CVE-2015-8928: Heap out of bounds read in mtree parser (bsc#985679). - CVE-2015-8929: Memory leak in tar parser (bsc#985669). - CVE-2015-8930: Endless loop in ISO parser (bsc#985700). - CVE-2015-8931: Undefined behavior / signed integer overflow in mtree parser (bsc#985689). - CVE-2015-8932: Compress handler left shifting larger than int size (bsc#985665). - CVE-2015-8933: Undefined behavior / signed integer overflow in TAR parser (bsc#985688). - CVE-2015-8934: Out of bounds read in RAR (bsc#985673). - CVE-2016-4300: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo (bsc#985832). - CVE-2016-4301: Stack buffer overflow in the mtree parse_device (bsc#985826). - CVE-2016-4302: Heap buffer overflow in the Rar decompression functionality (bsc#985835). - CVE-2016-4809: Memory allocate error with symbolic links in cpio archives (bsc#984990). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-969=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bsdtar-3.1.2-13.2 bsdtar-debuginfo-3.1.2-13.2 libarchive-debugsource-3.1.2-13.2 libarchive-devel-3.1.2-13.2 libarchive13-3.1.2-13.2 libarchive13-debuginfo-3.1.2-13.2 - openSUSE Leap 42.1 (x86_64): libarchive13-32bit-3.1.2-13.2 libarchive13-debuginfo-32bit-3.1.2-13.2 References: https://www.suse.com/security/cve/CVE-2015-8918.html https://www.suse.com/security/cve/CVE-2015-8919.html https://www.suse.com/security/cve/CVE-2015-8920.html https://www.suse.com/security/cve/CVE-2015-8921.html https://www.suse.com/security/cve/CVE-2015-8922.html https://www.suse.com/security/cve/CVE-2015-8923.html https://www.suse.com/security/cve/CVE-2015-8924.html https://www.suse.com/security/cve/CVE-2015-8925.html https://www.suse.com/security/cve/CVE-2015-8926.html https://www.suse.com/security/cve/CVE-2015-8928.html https://www.suse.com/security/cve/CVE-2015-8929.html https://www.suse.com/security/cve/CVE-2015-8930.html https://www.suse.com/security/cve/CVE-2015-8931.html https://www.suse.com/security/cve/CVE-2015-8932.html https://www.suse.com/security/cve/CVE-2015-8933.html https://www.suse.com/security/cve/CVE-2015-8934.html https://www.suse.com/security/cve/CVE-2016-4300.html https://www.suse.com/security/cve/CVE-2016-4301.html https://www.suse.com/security/cve/CVE-2016-4302.html https://www.suse.com/security/cve/CVE-2016-4809.html https://bugzilla.suse.com/984990 https://bugzilla.suse.com/985609 https://bugzilla.suse.com/985665 https://bugzilla.suse.com/985669 https://bugzilla.suse.com/985673 https://bugzilla.suse.com/985675 https://bugzilla.suse.com/985679 https://bugzilla.suse.com/985682 https://bugzilla.suse.com/985685 https://bugzilla.suse.com/985688 https://bugzilla.suse.com/985689 https://bugzilla.suse.com/985697 https://bugzilla.suse.com/985698 https://bugzilla.suse.com/985700 https://bugzilla.suse.com/985703 https://bugzilla.suse.com/985704 https://bugzilla.suse.com/985706 https://bugzilla.suse.com/985826 https://bugzilla.suse.com/985832 https://bugzilla.suse.com/985835 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: mariadb55-mariadb security update Advisory ID: RHSA-2016:1603-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1603.html Issue date: 2016-08-11 CVE Names: CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 ===================================================================== 1. Summary: An update for mariadb55-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The following packages have been upgraded to a newer upstream version: mariadb55-mariadb (5.5.50). Security Fix(es): * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1358205 - CVE-2016-3477 mysql: unspecified vulnerability in subcomponent: Server: Parser (CPU July 2016) 1358209 - CVE-2016-3521 mysql: unspecified vulnerability in subcomponent: Server: Types (CPU July 2016) 1358212 - CVE-2016-3615 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU July 2016) 1358218 - CVE-2016-5440 mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016) 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: mariadb55-mariadb-5.5.50-1.el6.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: mariadb55-mariadb-5.5.50-1.el6.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: mariadb55-mariadb-5.5.50-1.el6.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: mariadb55-mariadb-5.5.50-1.el6.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el6.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: mariadb55-mariadb-5.5.50-1.el7.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: mariadb55-mariadb-5.5.50-1.el7.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: mariadb55-mariadb-5.5.50-1.el7.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: mariadb55-mariadb-5.5.50-1.el7.src.rpm x86_64: mariadb55-mariadb-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-bench-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-debuginfo-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-devel-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-libs-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-server-5.5.50-1.el7.x86_64.rpm mariadb55-mariadb-test-5.5.50-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-3477 https://access.redhat.com/security/cve/CVE-2016-3521 https://access.redhat.com/security/cve/CVE-2016-3615 https://access.redhat.com/security/cve/CVE-2016-5440 https://access.redhat.com/security/updates/classification/#important http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-5550-release-notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrI6qXlSAg2UNWIIRAuAMAJ9/lUwv+Tsj7708/DZu7BMu9oITsQCeMbhO BaGf+317EgchrutG1C0R4LY= =C4GV -----END PGP SIGNATURE----- --

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-mariadb100-mariadb security update Advisory ID: RHSA-2016:1604-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1604.html Issue date: 2016-08-11 CVE Names: CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 ===================================================================== 1. Summary: An update for rh-mariadb100-mariadb is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The following packages have been upgraded to a newer upstream version: rh-mariadb100-mariadb (10.0.26). Security Fix(es): * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2016-3477, CVE-2016-3521, CVE-2016-3615, CVE-2016-5440) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1358205 - CVE-2016-3477 mysql: unspecified vulnerability in subcomponent: Server: Parser (CPU July 2016) 1358209 - CVE-2016-3521 mysql: unspecified vulnerability in subcomponent: Server: Types (CPU July 2016) 1358212 - CVE-2016-3615 mysql: unspecified vulnerability in subcomponent: Server: DML (CPU July 2016) 1358218 - CVE-2016-5440 mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016) 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-mariadb100-mariadb-10.0.26-2.el6.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-mariadb100-mariadb-10.0.26-2.el6.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-mariadb100-mariadb-10.0.26-2.el6.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-mariadb100-mariadb-10.0.26-2.el6.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el6.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-mariadb100-mariadb-10.0.26-2.el7.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: rh-mariadb100-mariadb-10.0.26-2.el7.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-mariadb100-mariadb-10.0.26-2.el7.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-mariadb100-mariadb-10.0.26-2.el7.src.rpm x86_64: rh-mariadb100-mariadb-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-bench-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-common-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-config-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-debuginfo-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-devel-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-errmsg-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-oqgraph-engine-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-server-10.0.26-2.el7.x86_64.rpm rh-mariadb100-mariadb-test-10.0.26-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-3477 https://access.redhat.com/security/cve/CVE-2016-3521 https://access.redhat.com/security/cve/CVE-2016-3615 https://access.redhat.com/security/cve/CVE-2016-5440 https://access.redhat.com/security/updates/classification/#important http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-10026-release-notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrI7pXlSAg2UNWIIRAhALAJoCTZGPe9HptNW5FZgymvBc3g50kgCfbdOS mfaADT08wiPtKFc+vJIwlEY= =eic/ -----END PGP SIGNATURE----- --

openSUSE Security Update: Security update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2028-1 Rating: important References: #984619 #987696 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for hawk2 fixes one security issue and one bug. The following security change is included: - To prevent Clickjacking attacks, set Content-Security-Policy to frame-ancestors 'self' (bsc#984619) The following non-security issue was fixed: - In the Wizards UI, prevent text display issues due to internationalization with certain strings (bsc#987696) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-971=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): hawk2-1.0.1+git.1456406635.49e230d-5.1 hawk2-debuginfo-1.0.1+git.1456406635.49e230d-5.1 hawk2-debugsource-1.0.1+git.1456406635.49e230d-5.1 References: https://bugzilla.suse.com/984619 https://bugzilla.suse.com/987696 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

At Phoronix we have posted a new article. A link to this from your site's news section would be greatly appreciated. Title: 18-Way GPU Linux Benchmarks, Including The Radeon RX 460 & RX 470 On Open-Source ( -at -) Phoronix Direct Link: http://www.phoronix.com/vr.php?view=23421 Summary: "Yesterday I published early open-source benchmarks of the Radeon RX 470 while today is a full 18-way graphics card comparison including the newly-launched Radeon RX 460 and Radeon RX 470 graphics cards alongside the RX 480 Polaris graphics card. All of the AMD graphics cards tested for this article were running the very latest open-source driver stack on the Linux 4.8 kernel and Mesa 12.1-dev Git." Please feel free to contact us with any questions or comments you may

Nvidia Titan X (Pascal) 12GB Review ------------------------------------------------------------ http://us2.campaign-archive2.com/?u=bfb2b902b5fb045ad6f841f98&id=9f4844157e&e=872093acb5 http://www.kitguru.net Nvidia Titan X (Pascal) 12GB Review Nvidia’s GTX 1080 has been dominating the high end this year with AMD placing focus in the low end to mid range market with their RX 480, RX 470 and RX 460. Nvidia CEO Jen-Hsun Huang has described the latest Titan X as ‘The Ultimate’ and at an eye watering price of £1099.99 we expect performance to be nothing less than class leading. Read the review here: http://www.kitguru.net/components/graphic-cards/zardon/nvidia-titan-x-pascal-12gb-review/ ============================================================ ** follow on Twitter (http://twitter.com/#!/kitgurupress) | ** friend on Facebook (http://www.facebook.com/pages/KitGuru/162236020510911) | ** forward to a friend (http://us2.forward-to-friend.com/forward?u=bfb2b902b5fb045ad6f841f98&id=9f4844157e&e=872093acb5) Copyright © 2016 KitGuru, All rights reserved. You are receiving this because you are a news partner or have signed up to receive our news.

------------------------------------------------------------ http://us7.campaign-archive1.com/?u=406e963590798a4aa1eab5f99&id=867bf448eb&e=2c7a1c459a Dear News Affiliates, Custom PC Review recently published article(s) your readers may enjoy. We’d appreciate it if you could share it with them. Title: Review: Razer Mechanical Keyboard Case (Apple iPad Pro) ( -at -) Custom PC Review (http://custompcreview.us7.list-manage1.com/track/click?u=406e963590798a4aa1eab5f99&id=a052fd9135&e=2c7a1c459a) Excerpt: "Ever since I laid my hands on a mechanical keyboard several years ago, I was hooked. Today, almost every keyboard I own is mechanical with the exception of the keyboard on my laptop and a Bluetooth keyboard I use from time to time with my HTPC or tablet. Wouldn’t it be great if everything could be mechanical? I sure think so and Razer..." Thank you for your support, -- Sam Chen -- Editor-in-Chief -- Custom PC Review -- http://custompcreview.us7.list-manage1.com/track/click?u=406e963590798a4aa1eab5f99&id=c710abc9aa&e=2c7a1c459a (http://custompcreview.us7.list-manage.com/track/click?u=406e963590798a4aa1eab5f99&id=1c18c3c095&e=2c7a1c459a)

------------------------------------------------------------ http://us7.campaign-archive1.com/?u=406e963590798a4aa1eab5f99&id=867bf448eb&e=2c7a1c459a Dear News Affiliates, Custom PC Review recently published article(s) your readers may enjoy. We’d appreciate it if you could share it with them. Title: Review: Razer Mechanical Keyboard Case (Apple iPad Pro) ( -at -) Custom PC Review (http://custompcreview.us7.list-manage1.com/track/click?u=406e963590798a4aa1eab5f99&id=a052fd9135&e=2c7a1c459a) Excerpt: "Ever since I laid my hands on a mechanical keyboard several years ago, I was hooked. Today, almost every keyboard I own is mechanical with the exception of the keyboard on my laptop and a Bluetooth keyboard I use from time to time with my HTPC or tablet. Wouldn’t it be great if everything could be mechanical? I sure think so and Razer..." Thank you for your support, -- Sam Chen -- Editor-in-Chief -- Custom PC Review -- http://custompcreview.us7.list-manage1.com/track/click?u=406e963590798a4aa1eab5f99&id=c710abc9aa&e=2c7a1c459a (http://custompcreview.us7.list-manage.com/track/click?u=406e963590798a4aa1eab5f99&id=1c18c3c095&e=2c7a1c459a)

TITLE: Corsair Vengeance LED 32GB DDR4 Review ( -at -) Vortez CONTENT: Today we'll be taking a look at Corsair's new Vengeance LED DDR4 kit courtesy of the "white" edition. Along with the lighting we have a newly designed heatspreader and a 10-layer PCB which Corsair claim enhances the signalling for assistance in the overclocking and reliability departments. The kit we're testing out offers 32GB (4x8GB) of capacity and is rated at 3200MHz. LINK: http://www.vortez.net/review.php?id=1195 ---------------------------------------------------------------------------- -------------------- Please post this news item in your news section. Thank you.