October 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:2609-1: Recommended update for ksh
by maintenance＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Recommended Update: Recommended update for ksh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2609-1 Rating: low References: #988213 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ksh fixes a locking error in spawn implementation. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1224=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ksh-93vu-13.1 ksh-debuginfo-93vu-13.1 ksh-debugsource-93vu-13.1 ksh-devel-93vu-13.1 References: https://bugzilla.suse.com/988213

1 0

openSUSE-SU-2016:2608-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2608-1 Rating: moderate References: #1003898 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed: - bsc#1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included: - Change the default configuration for the session bus to only allow EXTERNAL authentication (secure kernel-mediated credentials-passing), as was already done for the system bus. - Fix a memory leak when GetConnectionCredentials() succeeds (fdo#91008) - Ensure that dbus-monitor does not reply to messages intended for others (fdo#90952) - Add locking to DBusCounter's reference count and notify function (fdo#89297) - Ensure that DBusTransport's reference count is protected by the corresponding DBusConnection's lock (fdo#90312) - Correctly release DBusServer mutex before early-return if we run out of memory while copying authentication mechanisms (fdo#90021) - Correctly initialize all fields of DBusTypeReader (fdo#90021) - Fix some missing \n in verbose (debug log) messages (fdo#90004) - Clean up some memory leaks in test code (fdo#90021) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1222=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dbus-1-1.8.22-10.1 dbus-1-debuginfo-1.8.22-10.1 dbus-1-debugsource-1.8.22-10.1 dbus-1-devel-1.8.22-10.1 dbus-1-x11-1.8.22-10.1 dbus-1-x11-debuginfo-1.8.22-10.1 dbus-1-x11-debugsource-1.8.22-10.1 libdbus-1-3-1.8.22-10.1 libdbus-1-3-debuginfo-1.8.22-10.1 - openSUSE Leap 42.1 (x86_64): dbus-1-debuginfo-32bit-1.8.22-10.1 dbus-1-devel-32bit-1.8.22-10.1 libdbus-1-3-32bit-1.8.22-10.1 libdbus-1-3-debuginfo-32bit-1.8.22-10.1 - openSUSE Leap 42.1 (noarch): dbus-1-devel-doc-1.8.22-10.1 References: https://bugzilla.suse.com/1003898

1 0

openSUSE-SU-2016:2607-1: important: Security update for gd
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2607-1 Rating: important References: #1001900 Cross-References: CVE-2016-7568 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issue: - CVE-2016-7568: Integer overflow in the gdImageWebpCtx function in gd_webp.c (libgd) (bsc#1001900). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1220=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gd-2.1.0-7.19.1 gd-debuginfo-2.1.0-7.19.1 gd-debugsource-2.1.0-7.19.1 gd-devel-2.1.0-7.19.1 libgd3-2.1.0-7.19.1 libgd3-debuginfo-2.1.0-7.19.1 - openSUSE 13.2 (x86_64): libgd3-32bit-2.1.0-7.19.1 libgd3-debuginfo-32bit-2.1.0-7.19.1 References: https://www.suse.com/security/cve/CVE-2016-7568.html https://bugzilla.suse.com/1001900

1 0

openSUSE-SU-2016:2606-1: important: Security update for php5
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2606-1 Rating: important References: #1001900 #1004924 #1005274 Cross-References: CVE-2016-6911 CVE-2016-7568 CVE-2016-8670 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php5 fixes the following issu: - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924). - CVE-2016-7568: Integer overflow in the gdImageWebpCtx function in gd_webp.c (libgd) (bsc#1001900). - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1221=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-83.1 apache2-mod_php5-debuginfo-5.6.1-83.1 php5-5.6.1-83.1 php5-bcmath-5.6.1-83.1 php5-bcmath-debuginfo-5.6.1-83.1 php5-bz2-5.6.1-83.1 php5-bz2-debuginfo-5.6.1-83.1 php5-calendar-5.6.1-83.1 php5-calendar-debuginfo-5.6.1-83.1 php5-ctype-5.6.1-83.1 php5-ctype-debuginfo-5.6.1-83.1 php5-curl-5.6.1-83.1 php5-curl-debuginfo-5.6.1-83.1 php5-dba-5.6.1-83.1 php5-dba-debuginfo-5.6.1-83.1 php5-debuginfo-5.6.1-83.1 php5-debugsource-5.6.1-83.1 php5-devel-5.6.1-83.1 php5-dom-5.6.1-83.1 php5-dom-debuginfo-5.6.1-83.1 php5-enchant-5.6.1-83.1 php5-enchant-debuginfo-5.6.1-83.1 php5-exif-5.6.1-83.1 php5-exif-debuginfo-5.6.1-83.1 php5-fastcgi-5.6.1-83.1 php5-fastcgi-debuginfo-5.6.1-83.1 php5-fileinfo-5.6.1-83.1 php5-fileinfo-debuginfo-5.6.1-83.1 php5-firebird-5.6.1-83.1 php5-firebird-debuginfo-5.6.1-83.1 php5-fpm-5.6.1-83.1 php5-fpm-debuginfo-5.6.1-83.1 php5-ftp-5.6.1-83.1 php5-ftp-debuginfo-5.6.1-83.1 php5-gd-5.6.1-83.1 php5-gd-debuginfo-5.6.1-83.1 php5-gettext-5.6.1-83.1 php5-gettext-debuginfo-5.6.1-83.1 php5-gmp-5.6.1-83.1 php5-gmp-debuginfo-5.6.1-83.1 php5-iconv-5.6.1-83.1 php5-iconv-debuginfo-5.6.1-83.1 php5-imap-5.6.1-83.1 php5-imap-debuginfo-5.6.1-83.1 php5-intl-5.6.1-83.1 php5-intl-debuginfo-5.6.1-83.1 php5-json-5.6.1-83.1 php5-json-debuginfo-5.6.1-83.1 php5-ldap-5.6.1-83.1 php5-ldap-debuginfo-5.6.1-83.1 php5-mbstring-5.6.1-83.1 php5-mbstring-debuginfo-5.6.1-83.1 php5-mcrypt-5.6.1-83.1 php5-mcrypt-debuginfo-5.6.1-83.1 php5-mssql-5.6.1-83.1 php5-mssql-debuginfo-5.6.1-83.1 php5-mysql-5.6.1-83.1 php5-mysql-debuginfo-5.6.1-83.1 php5-odbc-5.6.1-83.1 php5-odbc-debuginfo-5.6.1-83.1 php5-opcache-5.6.1-83.1 php5-opcache-debuginfo-5.6.1-83.1 php5-openssl-5.6.1-83.1 php5-openssl-debuginfo-5.6.1-83.1 php5-pcntl-5.6.1-83.1 php5-pcntl-debuginfo-5.6.1-83.1 php5-pdo-5.6.1-83.1 php5-pdo-debuginfo-5.6.1-83.1 php5-pgsql-5.6.1-83.1 php5-pgsql-debuginfo-5.6.1-83.1 php5-phar-5.6.1-83.1 php5-phar-debuginfo-5.6.1-83.1 php5-posix-5.6.1-83.1 php5-posix-debuginfo-5.6.1-83.1 php5-pspell-5.6.1-83.1 php5-pspell-debuginfo-5.6.1-83.1 php5-readline-5.6.1-83.1 php5-readline-debuginfo-5.6.1-83.1 php5-shmop-5.6.1-83.1 php5-shmop-debuginfo-5.6.1-83.1 php5-snmp-5.6.1-83.1 php5-snmp-debuginfo-5.6.1-83.1 php5-soap-5.6.1-83.1 php5-soap-debuginfo-5.6.1-83.1 php5-sockets-5.6.1-83.1 php5-sockets-debuginfo-5.6.1-83.1 php5-sqlite-5.6.1-83.1 php5-sqlite-debuginfo-5.6.1-83.1 php5-suhosin-5.6.1-83.1 php5-suhosin-debuginfo-5.6.1-83.1 php5-sysvmsg-5.6.1-83.1 php5-sysvmsg-debuginfo-5.6.1-83.1 php5-sysvsem-5.6.1-83.1 php5-sysvsem-debuginfo-5.6.1-83.1 php5-sysvshm-5.6.1-83.1 php5-sysvshm-debuginfo-5.6.1-83.1 php5-tidy-5.6.1-83.1 php5-tidy-debuginfo-5.6.1-83.1 php5-tokenizer-5.6.1-83.1 php5-tokenizer-debuginfo-5.6.1-83.1 php5-wddx-5.6.1-83.1 php5-wddx-debuginfo-5.6.1-83.1 php5-xmlreader-5.6.1-83.1 php5-xmlreader-debuginfo-5.6.1-83.1 php5-xmlrpc-5.6.1-83.1 php5-xmlrpc-debuginfo-5.6.1-83.1 php5-xmlwriter-5.6.1-83.1 php5-xmlwriter-debuginfo-5.6.1-83.1 php5-xsl-5.6.1-83.1 php5-xsl-debuginfo-5.6.1-83.1 php5-zip-5.6.1-83.1 php5-zip-debuginfo-5.6.1-83.1 php5-zlib-5.6.1-83.1 php5-zlib-debuginfo-5.6.1-83.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-83.1 References: https://www.suse.com/security/cve/CVE-2016-6911.html https://www.suse.com/security/cve/CVE-2016-7568.html https://www.suse.com/security/cve/CVE-2016-8670.html https://bugzilla.suse.com/1001900 https://bugzilla.suse.com/1004924 https://bugzilla.suse.com/1005274

1 0

openSUSE-SU-2016:2605-1: moderate: Security update for kdump
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for kdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2605-1 Rating: moderate References: #927451 #932339 #943214 #951844 #964206 #970708 #973213 #974270 #976864 #980328 #984799 #987862 #989972 #990200 Cross-References: CVE-2016-5759 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 13 fixes is now available. Description: This update for kdump provides several fixes and enhancements: - Refresh kdumprd if /etc/hosts or /etc/nsswitch.conf is changed. (bsc#943214) - Add a separate systemd service to rebuild kdumprd at boot. (bsc#943214) - Improve network setup in the kdump environment by reading configuration from wicked by default (system configuration files are used as a fallback). (bsc#980328) - Use the last mount entry in kdump_get_mountpoints(). (bsc#951844) - Remove 'notsc' from the kdump kernel command line. (bsc#973213) - Handle dump files with many program headers. (bsc#932339, bsc#970708) - Fall back to stat() if file type is DT_UNKNOWN. (bsc#964206) - Remove vm. sysctls from kdump initrd. (bsc#927451, bsc#987862) - Use the exit code of kexec, not that of "local". (bsc#984799) - Convert sysroot to a bind mount in kdump initrd. (bsc#976864) - Distinguish between Xenlinux (aka Xenified or SUSE) and pvops Xen kernels, as the latter can run on bare metal. (bsc#974270) - CVE-2016-5759: Use full path to dracut as argument to bash. (bsc#989972, bsc#990200) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1215=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kdump-0.8.15-27.1 kdump-debuginfo-0.8.15-27.1 kdump-debugsource-0.8.15-27.1 References: https://www.suse.com/security/cve/CVE-2016-5759.html https://bugzilla.suse.com/927451 https://bugzilla.suse.com/932339 https://bugzilla.suse.com/943214 https://bugzilla.suse.com/951844 https://bugzilla.suse.com/964206 https://bugzilla.suse.com/970708 https://bugzilla.suse.com/973213 https://bugzilla.suse.com/974270 https://bugzilla.suse.com/976864 https://bugzilla.suse.com/980328 https://bugzilla.suse.com/984799 https://bugzilla.suse.com/987862 https://bugzilla.suse.com/989972 https://bugzilla.suse.com/990200

1 0

openSUSE-RU-2016:2604-1: Recommended update for ipsec-tools
by maintenance＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Recommended Update: Recommended update for ipsec-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2604-1 Rating: low References: #1002216 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ipsec-tools fixes a segmentation fault when the path of the log file is passed to racoon(8) as a command line argument. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1217=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ipsec-tools-0.8.0-9.2 ipsec-tools-debuginfo-0.8.0-9.2 ipsec-tools-debugsource-0.8.0-9.2 References: https://bugzilla.suse.com/1002216

1 0

openSUSE-SU-2016:2603-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2603-1 Rating: moderate References: #1005292 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following security issue: - TROVE-2016-10-001: Remote DoS vulnerability triggered by specially crafted data (boo#1005292) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1219=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1219=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): tor-0.2.7.6-13.1 tor-debuginfo-0.2.7.6-13.1 tor-debugsource-0.2.7.6-13.1 - openSUSE 13.2 (i586 x86_64): tor-0.2.7.6-26.1 tor-debuginfo-0.2.7.6-26.1 tor-debugsource-0.2.7.6-26.1 References: https://bugzilla.suse.com/1005292

1 0

openSUSE-RU-2016:2602-1: moderate: Recommended update for Mesa
by maintenance＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Recommended Update: Recommended update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2602-1 Rating: moderate References: #985650 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for Mesa fixes the following issues: - Initialize RSxxx chipsets correctly (boo#985650) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1218=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): Mesa-10.3.7-91.21.1 Mesa-debuginfo-10.3.7-91.21.1 Mesa-debugsource-10.3.7-91.21.1 Mesa-devel-10.3.7-91.21.1 Mesa-libEGL-devel-10.3.7-91.21.1 Mesa-libEGL1-10.3.7-91.21.1 Mesa-libEGL1-debuginfo-10.3.7-91.21.1 Mesa-libGL-devel-10.3.7-91.21.1 Mesa-libGL1-10.3.7-91.21.1 Mesa-libGL1-debuginfo-10.3.7-91.21.1 Mesa-libGLESv1_CM-devel-10.3.7-91.21.1 Mesa-libGLESv1_CM1-10.3.7-91.21.1 Mesa-libGLESv1_CM1-debuginfo-10.3.7-91.21.1 Mesa-libGLESv2-2-10.3.7-91.21.1 Mesa-libGLESv2-2-debuginfo-10.3.7-91.21.1 Mesa-libGLESv2-devel-10.3.7-91.21.1 Mesa-libGLESv3-devel-10.3.7-91.21.1 Mesa-libglapi-devel-10.3.7-91.21.1 Mesa-libglapi0-10.3.7-91.21.1 Mesa-libglapi0-debuginfo-10.3.7-91.21.1 libOSMesa-devel-10.3.7-91.21.1 libOSMesa9-10.3.7-91.21.1 libOSMesa9-debuginfo-10.3.7-91.21.1 libXvMC_nouveau-10.3.7-91.21.1 libXvMC_nouveau-debuginfo-10.3.7-91.21.1 libXvMC_r600-10.3.7-91.21.1 libgbm-devel-10.3.7-91.21.1 libgbm1-10.3.7-91.21.1 libgbm1-debuginfo-10.3.7-91.21.1 libvdpau_nouveau-10.3.7-91.21.1 libvdpau_nouveau-debuginfo-10.3.7-91.21.1 libvdpau_r600-10.3.7-91.21.1 libvdpau_radeonsi-10.3.7-91.21.1 libwayland-egl-devel-10.3.7-91.21.1 libwayland-egl1-10.3.7-91.21.1 libwayland-egl1-debuginfo-10.3.7-91.21.1 libxatracker-devel-1.0.0-91.21.1 libxatracker2-1.0.0-91.21.1 libxatracker2-debuginfo-1.0.0-91.21.1 - openSUSE 13.2 (x86_64): Mesa-32bit-10.3.7-91.21.1 Mesa-debuginfo-32bit-10.3.7-91.21.1 Mesa-libEGL-devel-32bit-10.3.7-91.21.1 Mesa-libEGL1-32bit-10.3.7-91.21.1 Mesa-libEGL1-debuginfo-32bit-10.3.7-91.21.1 Mesa-libGL-devel-32bit-10.3.7-91.21.1 Mesa-libGL1-32bit-10.3.7-91.21.1 Mesa-libGL1-debuginfo-32bit-10.3.7-91.21.1 Mesa-libGLESv1_CM-devel-32bit-10.3.7-91.21.1 Mesa-libGLESv1_CM1-32bit-10.3.7-91.21.1 Mesa-libGLESv1_CM1-debuginfo-32bit-10.3.7-91.21.1 Mesa-libGLESv2-2-32bit-10.3.7-91.21.1 Mesa-libGLESv2-2-debuginfo-32bit-10.3.7-91.21.1 Mesa-libGLESv2-devel-32bit-10.3.7-91.21.1 Mesa-libglapi-devel-32bit-10.3.7-91.21.1 Mesa-libglapi0-32bit-10.3.7-91.21.1 Mesa-libglapi0-debuginfo-32bit-10.3.7-91.21.1 libOSMesa-devel-32bit-10.3.7-91.21.1 libOSMesa9-32bit-10.3.7-91.21.1 libOSMesa9-debuginfo-32bit-10.3.7-91.21.1 libXvMC_nouveau-32bit-10.3.7-91.21.1 libXvMC_nouveau-debuginfo-32bit-10.3.7-91.21.1 libXvMC_r600-32bit-10.3.7-91.21.1 libgbm-devel-32bit-10.3.7-91.21.1 libgbm1-32bit-10.3.7-91.21.1 libgbm1-debuginfo-32bit-10.3.7-91.21.1 libvdpau_nouveau-32bit-10.3.7-91.21.1 libvdpau_nouveau-debuginfo-32bit-10.3.7-91.21.1 libvdpau_r600-32bit-10.3.7-91.21.1 libvdpau_radeonsi-32bit-10.3.7-91.21.1 libwayland-egl-devel-32bit-10.3.7-91.21.1 libwayland-egl1-32bit-10.3.7-91.21.1 libwayland-egl1-debuginfo-32bit-10.3.7-91.21.1 References: https://bugzilla.suse.com/985650

1 0

openSUSE-RU-2016:2601-1: moderate: Recommended update for upower
by maintenance＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Recommended Update: Recommended update for upower ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2601-1 Rating: moderate References: #985741 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for upower fixes the following issues: - Set the system per default to hibernate, not hybridsleep. If the battery is going to be empty soon, there is no reason any longer to attempt to HybridSleep, which quite some hardware seems to get wrong. Simply hibernate, get the data on the disk and switch off (boo#985741). - Properly detect bluetooth mice and keyboards that are HID Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1216=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libupower-glib-devel-0.99.3-5.1 libupower-glib3-0.99.3-5.1 libupower-glib3-debuginfo-0.99.3-5.1 typelib-1_0-UpowerGlib-1_0-0.99.3-5.1 upower-0.99.3-5.1 upower-debuginfo-0.99.3-5.1 upower-debugsource-0.99.3-5.1 - openSUSE Leap 42.1 (noarch): upower-lang-0.99.3-5.1 References: https://bugzilla.suse.com/985741

1 0

openSUSE-SU-2016:2600-1: moderate: Security update for X Window System client libraries
by opensuse-security＠opensuse.org 24 Oct '16

24 Oct '16

openSUSE Security Update: Security update for X Window System client libraries ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2600-1 Rating: moderate References: #1002991 #1002995 #1002998 #1003000 #1003002 #1003012 #1003017 #1003023 Cross-References: CVE-2016-5407 CVE-2016-7942 CVE-2016-7944 CVE-2016-7945 CVE-2016-7946 CVE-2016-7947 CVE-2016-7948 CVE-2016-7949 CVE-2016-7950 CVE-2016-7951 CVE-2016-7952 CVE-2016-7953 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for the X Window System client libraries fixes a class of privilege escalation issues. A malicious X Server could send specially crafted data to X clients, which allowed for triggering crashes, or privilege escalation if this relationship was untrusted or crossed user or permission level boundaries. libX11, libXfixes, libXi, libXrandr, libXrender, libXtst, libXv, libXvMC were fixed, specifically: libX11: - CVE-2016-7942: insufficient validation of data from the X server allowed out of boundary memory read (bsc#1002991) libXfixes: - CVE-2016-7944: insufficient validation of data from the X server can cause an integer overflow on 32 bit architectures (bsc#1002995) libXi: - CVE-2016-7945, CVE-2016-7946: insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service) (bsc#1002998) libXtst: - CVE-2016-7951, CVE-2016-7952: insufficient validation of data from the X server can cause out of boundary memory access or endless loops (Denial of Service) (bsc#1003012) libXv: - CVE-2016-5407: insufficient validation of data from the X server can cause out of boundary memory and memory corruption (bsc#1003017) libXvMC: - CVE-2016-7953: insufficient validation of data from the X server can cause a one byte buffer read underrun (bsc#1003023) libXrender: - CVE-2016-7949, CVE-2016-7950: insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003002) libXrandr: - CVE-2016-7947, CVE-2016-7948: insufficient validation of data from the X server can cause out of boundary memory writes (bsc#1003000) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libX11-6-1.6.3-6.1 libX11-6-debuginfo-1.6.3-6.1 libX11-debugsource-1.6.3-6.1 libX11-devel-1.6.3-6.1 libX11-xcb1-1.6.3-6.1 libX11-xcb1-debuginfo-1.6.3-6.1 libXfixes-debugsource-5.0.1-7.1 libXfixes-devel-5.0.1-7.1 libXfixes3-5.0.1-7.1 libXfixes3-debuginfo-5.0.1-7.1 libXi-debugsource-1.7.5-3.1 libXi-devel-1.7.5-3.1 libXi6-1.7.5-3.1 libXi6-debuginfo-1.7.5-3.1 libXrandr-debugsource-1.5.0-3.1 libXrandr-devel-1.5.0-3.1 libXrandr2-1.5.0-3.1 libXrandr2-debuginfo-1.5.0-3.1 libXrender-debugsource-0.9.9-3.1 libXrender-devel-0.9.9-3.1 libXrender1-0.9.9-3.1 libXrender1-debuginfo-0.9.9-3.1 libXtst-debugsource-1.2.2-7.1 libXtst-devel-1.2.2-7.1 libXtst6-1.2.2-7.1 libXtst6-debuginfo-1.2.2-7.1 libXv-debugsource-1.0.10-7.1 libXv-devel-1.0.10-7.1 libXv1-1.0.10-7.1 libXv1-debuginfo-1.0.10-7.1 libXvMC-debugsource-1.0.9-3.1 libXvMC-devel-1.0.9-3.1 libXvMC1-1.0.9-3.1 libXvMC1-debuginfo-1.0.9-3.1 - openSUSE Leap 42.1 (noarch): libX11-data-1.6.3-6.1 - openSUSE Leap 42.1 (x86_64): libX11-6-32bit-1.6.3-6.1 libX11-6-debuginfo-32bit-1.6.3-6.1 libX11-devel-32bit-1.6.3-6.1 libX11-xcb1-32bit-1.6.3-6.1 libX11-xcb1-debuginfo-32bit-1.6.3-6.1 libXfixes-devel-32bit-5.0.1-7.1 libXfixes3-32bit-5.0.1-7.1 libXfixes3-debuginfo-32bit-5.0.1-7.1 libXi-devel-32bit-1.7.5-3.1 libXi6-32bit-1.7.5-3.1 libXi6-debuginfo-32bit-1.7.5-3.1 libXrandr-devel-32bit-1.5.0-3.1 libXrandr2-32bit-1.5.0-3.1 libXrandr2-debuginfo-32bit-1.5.0-3.1 libXrender-devel-32bit-0.9.9-3.1 libXrender1-32bit-0.9.9-3.1 libXrender1-debuginfo-32bit-0.9.9-3.1 libXtst-devel-32bit-1.2.2-7.1 libXtst6-32bit-1.2.2-7.1 libXtst6-debuginfo-32bit-1.2.2-7.1 libXv-devel-32bit-1.0.10-7.1 libXv1-32bit-1.0.10-7.1 libXv1-debuginfo-32bit-1.0.10-7.1 libXvMC-devel-32bit-1.0.9-3.1 libXvMC1-32bit-1.0.9-3.1 libXvMC1-debuginfo-32bit-1.0.9-3.1 References: https://www.suse.com/security/cve/CVE-2016-5407.html https://www.suse.com/security/cve/CVE-2016-7942.html https://www.suse.com/security/cve/CVE-2016-7944.html https://www.suse.com/security/cve/CVE-2016-7945.html https://www.suse.com/security/cve/CVE-2016-7946.html https://www.suse.com/security/cve/CVE-2016-7947.html https://www.suse.com/security/cve/CVE-2016-7948.html https://www.suse.com/security/cve/CVE-2016-7949.html https://www.suse.com/security/cve/CVE-2016-7950.html https://www.suse.com/security/cve/CVE-2016-7951.html https://www.suse.com/security/cve/CVE-2016-7952.html https://www.suse.com/security/cve/CVE-2016-7953.html https://bugzilla.suse.com/1002991 https://bugzilla.suse.com/1002995 https://bugzilla.suse.com/1002998 https://bugzilla.suse.com/1003000 https://bugzilla.suse.com/1003002 https://bugzilla.suse.com/1003012 https://bugzilla.suse.com/1003017 https://bugzilla.suse.com/1003023

1 0