openSUSE Security Update: Security update for polkit
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2015:1734-1
Rating:             important
References:         #933922 #935119 #939246 #943816 
Cross-References:   CVE-2015-3218 CVE-2015-3255 CVE-2015-3256
                    CVE-2015-4625
Affected Products:
                    openSUSE 13.2
                    openSUSE 13.1
______________________________________________________________________________

   An update that fixes four vulnerabilities is now available.

Description:

   Polkit was updated to 0.113 to fix four security issues.

   The following vulnerabilities were fixed:

   * CVE-2015-4625: a local privilege escalation due to predictable
     authentication session cookie values. (boo#935119)
   * CVE-2015-3256: various memory corruption vulnerabilities in use of the
     JavaScript interpreter, possibly leading to local privilege escalation.
     (boo#943816)
   * CVE-2015-3255: a memory corruption vulnerability in handling duplicate
     action IDs, possibly leading to local privilege escalation. (boo#939246)
   * CVE-2015-3218: Allowed any local user to crash polkitd. (boo#933922)


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.2:

      zypper in -t patch openSUSE-2015-655=1

   - openSUSE 13.1:

      zypper in -t patch openSUSE-2015-655=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.2 (i586 x86_64):

      libpolkit0-0.113-3.8.1
      libpolkit0-debuginfo-0.113-3.8.1
      polkit-0.113-3.8.1
      polkit-debuginfo-0.113-3.8.1
      polkit-debugsource-0.113-3.8.1
      polkit-devel-0.113-3.8.1
      polkit-devel-debuginfo-0.113-3.8.1
      typelib-1_0-Polkit-1_0-0.113-3.8.1

   - openSUSE 13.2 (x86_64):

      libpolkit0-32bit-0.113-3.8.1
      libpolkit0-debuginfo-32bit-0.113-3.8.1

   - openSUSE 13.2 (noarch):

      polkit-doc-0.113-3.8.1

   - openSUSE 13.1 (i586 x86_64):

      libpolkit0-0.113-9.1
      libpolkit0-debuginfo-0.113-9.1
      polkit-0.113-9.1
      polkit-debuginfo-0.113-9.1
      polkit-debugsource-0.113-9.1
      polkit-devel-0.113-9.1
      polkit-devel-debuginfo-0.113-9.1
      typelib-1_0-Polkit-1_0-0.113-9.1

   - openSUSE 13.1 (x86_64):

      libpolkit0-32bit-0.113-9.1
      libpolkit0-debuginfo-32bit-0.113-9.1

   - openSUSE 13.1 (noarch):

      polkit-doc-0.113-9.1


References:

   https://www.suse.com/security/cve/CVE-2015-3218.html
   https://www.suse.com/security/cve/CVE-2015-3255.html
   https://www.suse.com/security/cve/CVE-2015-3256.html
   https://www.suse.com/security/cve/CVE-2015-4625.html
   https://bugzilla.suse.com/933922
   https://bugzilla.suse.com/935119
   https://bugzilla.suse.com/939246
   https://bugzilla.suse.com/943816