June 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1134-1: moderate: Security update for libwmf
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Security Update: Security update for libwmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1134-1 Rating: moderate References: #495842 #831299 #892356 #933109 Cross-References: CVE-2009-1364 CVE-2015-0848 CVE-2015-4588 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: libwmf was updated to fix three security issues and one non-security bug. The following vulnerabilities were fixed: * CVE-2015-0848: An attacker that could trick a victim into opening a specially crafted WMF file with BMP portions in a libwmf based application could have executed arbitrary code with the user's privileges. (boo#933109) * CVE-2015-0848: An attacker that could trick a victim into opening a specially crafted WMF file in a libwmf based application could have executed arbitrary code through incorrect run-length encoding. (boo#933109) * CVE-2009-1364: Use-after-free vulnerability in the embedded GD library in libwmf allowed context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. (boo#495842, boo#831299) The following non-security bug was fixed: * boo#892356: Make libwmf-tools not depend on libwmf-devel Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-443=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libwmf-0_2-7-0.2.8.4-234.4.1 libwmf-0_2-7-debuginfo-0.2.8.4-234.4.1 libwmf-debugsource-0.2.8.4-234.4.1 libwmf-devel-0.2.8.4-234.4.1 libwmf-gnome-0.2.8.4-234.4.1 libwmf-gnome-debuginfo-0.2.8.4-234.4.1 libwmf-tools-0.2.8.4-234.4.1 libwmf-tools-debuginfo-0.2.8.4-234.4.1 - openSUSE 13.1 (x86_64): libwmf-0_2-7-32bit-0.2.8.4-234.4.1 libwmf-0_2-7-debuginfo-32bit-0.2.8.4-234.4.1 libwmf-gnome-32bit-0.2.8.4-234.4.1 libwmf-gnome-debuginfo-32bit-0.2.8.4-234.4.1 References: https://www.suse.com/security/cve/CVE-2009-1364.html https://www.suse.com/security/cve/CVE-2015-0848.html https://www.suse.com/security/cve/CVE-2015-4588.html https://bugzilla.suse.com/495842 https://bugzilla.suse.com/831299 https://bugzilla.suse.com/892356 https://bugzilla.suse.com/933109

1 0

openSUSE-SU-2015:1133-1: moderate: Security update for cacti
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Security Update: Security update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1133-1 Rating: moderate References: #934187 Cross-References: CVE-2015-4342 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: cacti was updated to 0.8.8d to fix multiple security issues and bugs. The following vulnerabilities were fixed: * SQL injection VN: JVN#78187936 / TN:JPCERT#98968540 * Cacti Cross-Site Scripting Vulnerability Notification [FG-VD-15-017] * SQL Injection and Location header injection from cdef id CVE-2015-4342 * SQL injection in graph templates Also contains bug fixes in the upstream 0.8.8d release. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-445=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-445=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): cacti-0.8.8d-4.7.1 - openSUSE 13.1 (noarch): cacti-0.8.8d-11.1 References: https://www.suse.com/security/cve/CVE-2015-4342.html https://bugzilla.suse.com/934187

1 0

openSUSE-SU-2015:1132-1: moderate: Security update for libwmf
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Security Update: Security update for libwmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1132-1 Rating: moderate References: #933109 Cross-References: CVE-2015-0848 CVE-2015-4588 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libwmf was updated to fix two security issues. The following vulnerabilities were fixed: * CVE-2015-0848: An attacker that could trick a victim into opening a specially crafted WMF file with BMP portions in a libwmf based application could have executed arbitrary code with the user's privileges. (boo#933109) * CVE-2015-0848: An attacker that could trick a victim into opening a specially crafted WMF file in a libwmf based application could have executed arbitrary code through incorrect run-length encoding. (boo#933109) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-444=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libwmf-0_2-7-0.2.8.4-239.4.1 libwmf-0_2-7-debuginfo-0.2.8.4-239.4.1 libwmf-debugsource-0.2.8.4-239.4.1 libwmf-devel-0.2.8.4-239.4.1 libwmf-gnome-0.2.8.4-239.4.1 libwmf-gnome-debuginfo-0.2.8.4-239.4.1 libwmf-tools-0.2.8.4-239.4.1 libwmf-tools-debuginfo-0.2.8.4-239.4.1 - openSUSE 13.2 (x86_64): libwmf-0_2-7-32bit-0.2.8.4-239.4.1 libwmf-0_2-7-debuginfo-32bit-0.2.8.4-239.4.1 libwmf-gnome-32bit-0.2.8.4-239.4.1 libwmf-gnome-debuginfo-32bit-0.2.8.4-239.4.1 References: https://www.suse.com/security/cve/CVE-2015-0848.html https://www.suse.com/security/cve/CVE-2015-4588.html https://bugzilla.suse.com/933109

1 0

openSUSE-RU-2015:1131-1: important: Recommended update for seccheck
by maintenance＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Recommended Update: Recommended update for seccheck ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1131-1 Rating: important References: #934544 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for seccheck fixes a regression introduced with the last update: - fixed bashisms (bnc#934544) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-442=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): seccheck-3.0-2.11.1 References: https://bugzilla.suse.com/934544

1 0

openSUSE-RU-2015:1130-1: moderate: Recommended update for redis
by maintenance＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Recommended Update: Recommended update for redis ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1130-1 Rating: moderate References: #835815 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for redis fixes the following issue: - also pass the bind address to the redis-cli for shutdown (boo#835815) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-440=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-440=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): redis-2.8.13-2.3.1 redis-debuginfo-2.8.13-2.3.1 redis-debugsource-2.8.13-2.3.1 - openSUSE 13.1 (i586 x86_64): redis-2.6.14-3.3.1 redis-debuginfo-2.6.14-3.3.1 redis-debugsource-2.6.14-3.3.1 References: https://bugzilla.suse.com/835815

1 0

openSUSE-RU-2015:1129-1: moderate: Recommended update for postgrey
by maintenance＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Recommended Update: Recommended update for postgrey ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1129-1 Rating: moderate References: #919194 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update of postgrey provides version 1.35 (boo#919194) with various fixes and improvements: - Build as noarch since there are now architecture dependend components - Don't install init scripts when systemd is used - Create rcpostgrey also when systemd is used - Remove condition for suggesting cron since all current releases already have cron - use just 'postgrey' as process name, instead of '/usr/sbin/postgrey', because Linux tools are limited to 15 characters - Make postgrey work with Perl 5.18 - updated whitelist Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-441=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-441=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): postgrey-1.35-8.3.1 - openSUSE 13.1 (noarch): postgrey-1.35-4.7.1 References: https://bugzilla.suse.com/919194

1 0

openSUSE-RU-2015:1128-1: moderate: Recommended udpate for atftp
by maintenance＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Recommended Update: Recommended udpate for atftp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1128-1 Rating: moderate References: #921219 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for atftp fixes the following issue: - Fix typo in init script (boo #921219) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-439=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-439=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): atftp-0.7.0-160.3.1 atftp-debuginfo-0.7.0-160.3.1 atftp-debugsource-0.7.0-160.3.1 - openSUSE 13.1 (i586 x86_64): atftp-0.7.0-157.3.1 atftp-debuginfo-0.7.0-157.3.1 atftp-debugsource-0.7.0-157.3.1 References: https://bugzilla.suse.com/921219

1 0

openSUSE-RU-2015:1097-1: moderate: Recommended update for NetworkManager-strongswan
by maintenance＠opensuse.org 22 Jun '15

22 Jun '15

openSUSE Recommended Update: Recommended update for NetworkManager-strongswan ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1097-1 Rating: moderate References: #934129 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: NetworkManager-strongswan was updated to fix failures to connect go strongSwan VPN. The following bug was fixed: * boo#934129: NetworkManager-strongswan configures incorrect path to charon-nm Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-437=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): NetworkManager-strongswan-1.3.1-2.3.1 NetworkManager-strongswan-debugsource-1.3.1-2.3.1 NetworkManager-strongswan-gnome-1.3.1-2.3.1 NetworkManager-strongswan-gnome-debuginfo-1.3.1-2.3.1 - openSUSE 13.2 (noarch): NetworkManager-strongswan-lang-1.3.1-2.3.1 References: https://bugzilla.suse.com/934129

1 0

openSUSE-SU-2015:1096-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 22 Jun '15

22 Jun '15

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1096-1 Rating: moderate References: #910756 Cross-References: CVE-2014-9390 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The git web frontend cgit was updated to 0.11.2 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2014-9390: arbitrary command execution vulnerability on case-insensitive file systems in git. Malicious commits could affect client users on all platforms using case-insensitive file systems when using vulnerable git versions. In addition cgit was updated to 0.11.2 with minor improvements and bug fixes. The embedded git version was updated to 2.4.3. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-436=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-436=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cgit-0.11.2-13.3.1 cgit-debuginfo-0.11.2-13.3.1 cgit-debugsource-0.11.2-13.3.1 - openSUSE 13.1 (i586 x86_64): cgit-0.11.2-11.3.1 cgit-debuginfo-0.11.2-11.3.1 cgit-debugsource-0.11.2-11.3.1 References: https://www.suse.com/security/cve/CVE-2014-9390.html https://bugzilla.suse.com/910756

1 0

openSUSE-SU-2015:1095-1: moderate: Security update for XWayland
by opensuse-security＠opensuse.org 22 Jun '15

22 Jun '15

openSUSE Security Update: Security update for XWayland ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1095-1 Rating: moderate References: #934102 Cross-References: CVE-2015-3164 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The XWayland portion of the x.org X11 server was updated to fix one security issue. The following vulnerability was fixed: * CVE-2015-3164: Unauthorised local client access in XWayland (boo#934102) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-438=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xorg-x11-server-7.6_1.16.1-19.1 xorg-x11-server-debuginfo-7.6_1.16.1-19.1 xorg-x11-server-debugsource-7.6_1.16.1-19.1 xorg-x11-server-extra-7.6_1.16.1-19.1 xorg-x11-server-extra-debuginfo-7.6_1.16.1-19.1 xorg-x11-server-sdk-7.6_1.16.1-19.1 References: https://www.suse.com/security/cve/CVE-2015-3164.html https://bugzilla.suse.com/934102

1 0