November 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:2881-1: Recommended update for parted
by maintenance＠opensuse.org 23 Nov '16

23 Nov '16

openSUSE Recommended Update: Recommended update for parted ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2881-1 Rating: low References: #1001967 #964012 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for parted provides the following fixes: - Don't warn if the HDIO_GET_IDENTITY ioctl isn't supported. (bsc#964012, bsc#1001967) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1346=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libparted0-3.1-23.1 libparted0-debuginfo-3.1-23.1 parted-3.1-23.1 parted-debuginfo-3.1-23.1 parted-debugsource-3.1-23.1 parted-devel-3.1-23.1 - openSUSE Leap 42.2 (x86_64): libparted0-32bit-3.1-23.1 libparted0-debuginfo-32bit-3.1-23.1 - openSUSE Leap 42.2 (noarch): parted-lang-3.1-23.1 References: https://bugzilla.suse.com/1001967 https://bugzilla.suse.com/964012

1 0

openSUSE-RU-2016:2880-1: Recommended update for clamav-database
by maintenance＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2880-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh November 21st 2016. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1345=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1345=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201611210004-6.1 - openSUSE Leap 42.1 (noarch): clamav-database-201611210004-185.1 References:

1 0

openSUSE-SU-2016:2878-1: moderate: Security update for sudo
by opensuse-security＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2878-1 Rating: moderate References: #1007501 #1007766 Cross-References: CVE-2016-7032 CVE-2016-7076 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for sudo fixes the following issues: - fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality: * noexec bypass via system() and popen() [CVE-2016-7032, boo#1007766] * noexec bypass via wordexp() [CVE-2016-7076, boo#1007501] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1343=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): sudo-1.8.10p3-2.10.1 sudo-debuginfo-1.8.10p3-2.10.1 sudo-debugsource-1.8.10p3-2.10.1 sudo-devel-1.8.10p3-2.10.1 sudo-test-1.8.10p3-2.10.1 References: https://www.suse.com/security/cve/CVE-2016-7032.html https://www.suse.com/security/cve/CVE-2016-7076.html https://bugzilla.suse.com/1007501 https://bugzilla.suse.com/1007766

1 0

openSUSE-SU-2016:2877-1: moderate: Security update for monit
by opensuse-security＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Security Update: Security update for monit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2877-1 Rating: moderate References: #1007455 #971647 #974763 Cross-References: CVE-2014-3566 CVE-2016-7067 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for monit fixes the following issues: - CVE-2016-7067: A malicious attacker could have used a cross-site request forgery vulnerability to trick an authenticated user to perform monit actions. Monit was updated to 5.20, containing all upstream improvements and bug fixes. The following tracked packaging bugs were fixed: - disable sslv3 according to RFC7568 (boo#974763) - fixed pid file directory (boo#971647) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1339=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1339=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1339=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): monit-5.20.0-13.1 monit-debuginfo-5.20.0-13.1 monit-debugsource-5.20.0-13.1 - openSUSE Leap 42.2 (noarch): monit-doc-5.20.0-13.1 - openSUSE Leap 42.1 (i586 x86_64): monit-5.20.0-13.1 monit-debuginfo-5.20.0-13.1 monit-debugsource-5.20.0-13.1 - openSUSE Leap 42.1 (noarch): monit-doc-5.20.0-13.1 - openSUSE 13.2 (i586 x86_64): monit-5.20.0-2.3.1 monit-debuginfo-5.20.0-2.3.1 monit-debugsource-5.20.0-2.3.1 - openSUSE 13.2 (noarch): monit-doc-5.20.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-3566.html https://www.suse.com/security/cve/CVE-2016-7067.html https://bugzilla.suse.com/1007455 https://bugzilla.suse.com/971647 https://bugzilla.suse.com/974763

1 0

openSUSE-SU-2016:2876-1: moderate: Security update for dovecot22
by opensuse-security＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Security Update: Security update for dovecot22 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2876-1 Rating: moderate References: #984639 Cross-References: CVE-2016-4983 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dovecot22 fixes the following issues: - dovecot insecure SSL/TLS key and certificate file creation (CVE-2016-4983, bnc#984639) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1342=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1342=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1342=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dovecot22-2.2.25-3.1 dovecot22-backend-mysql-2.2.25-3.1 dovecot22-backend-mysql-debuginfo-2.2.25-3.1 dovecot22-backend-pgsql-2.2.25-3.1 dovecot22-backend-pgsql-debuginfo-2.2.25-3.1 dovecot22-backend-sqlite-2.2.25-3.1 dovecot22-backend-sqlite-debuginfo-2.2.25-3.1 dovecot22-debuginfo-2.2.25-3.1 dovecot22-debugsource-2.2.25-3.1 dovecot22-devel-2.2.25-3.1 dovecot22-fts-2.2.25-3.1 dovecot22-fts-debuginfo-2.2.25-3.1 dovecot22-fts-lucene-2.2.25-3.1 dovecot22-fts-lucene-debuginfo-2.2.25-3.1 dovecot22-fts-solr-2.2.25-3.1 dovecot22-fts-solr-debuginfo-2.2.25-3.1 dovecot22-fts-squat-2.2.25-3.1 dovecot22-fts-squat-debuginfo-2.2.25-3.1 - openSUSE Leap 42.1 (i586 x86_64): dovecot22-2.2.18-9.1 dovecot22-backend-mysql-2.2.18-9.1 dovecot22-backend-mysql-debuginfo-2.2.18-9.1 dovecot22-backend-pgsql-2.2.18-9.1 dovecot22-backend-pgsql-debuginfo-2.2.18-9.1 dovecot22-backend-sqlite-2.2.18-9.1 dovecot22-backend-sqlite-debuginfo-2.2.18-9.1 dovecot22-debuginfo-2.2.18-9.1 dovecot22-debugsource-2.2.18-9.1 dovecot22-devel-2.2.18-9.1 dovecot22-fts-2.2.18-9.1 dovecot22-fts-debuginfo-2.2.18-9.1 dovecot22-fts-lucene-2.2.18-9.1 dovecot22-fts-lucene-debuginfo-2.2.18-9.1 dovecot22-fts-solr-2.2.18-9.1 dovecot22-fts-solr-debuginfo-2.2.18-9.1 dovecot22-fts-squat-2.2.18-9.1 dovecot22-fts-squat-debuginfo-2.2.18-9.1 - openSUSE 13.2 (i586 x86_64): dovecot22-2.2.13-3.7.1 dovecot22-backend-mysql-2.2.13-3.7.1 dovecot22-backend-mysql-debuginfo-2.2.13-3.7.1 dovecot22-backend-pgsql-2.2.13-3.7.1 dovecot22-backend-pgsql-debuginfo-2.2.13-3.7.1 dovecot22-backend-sqlite-2.2.13-3.7.1 dovecot22-backend-sqlite-debuginfo-2.2.13-3.7.1 dovecot22-debuginfo-2.2.13-3.7.1 dovecot22-debugsource-2.2.13-3.7.1 dovecot22-devel-2.2.13-3.7.1 dovecot22-fts-lucene-2.2.13-3.7.1 dovecot22-fts-lucene-debuginfo-2.2.13-3.7.1 dovecot22-fts-solr-2.2.13-3.7.1 dovecot22-fts-solr-debuginfo-2.2.13-3.7.1 References: https://www.suse.com/security/cve/CVE-2016-4983.html https://bugzilla.suse.com/984639

1 0

openSUSE-RU-2016:2875-1: moderate: Recommended update for ladspa-swh-plugins
by maintenance＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Recommended Update: Recommended update for ladspa-swh-plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2875-1 Rating: moderate References: #1006861 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for ladspa-swh-plugins fixes the following issues: - boo#1006861: Fix undefined symbol errors in 14 plugins It also contains a number of minor upstream fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1340=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1340=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ladspa-swh-plugins-0.4.17-10.1 ladspa-swh-plugins-debuginfo-0.4.17-10.1 ladspa-swh-plugins-debugsource-0.4.17-10.1 - openSUSE Leap 42.1 (i586 x86_64): ladspa-swh-plugins-0.4.17-9.1 ladspa-swh-plugins-debuginfo-0.4.17-9.1 ladspa-swh-plugins-debugsource-0.4.17-9.1 References: https://bugzilla.suse.com/1006861

1 0

openSUSE-SU-2016:2874-1: moderate: Security update for tar
by opensuse-security＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Security Update: Security update for tar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2874-1 Rating: moderate References: #1007188 #913058 Cross-References: CVE-2016-6321 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tar fixes the following issues: - extract files recursively with --files-from [boo#913058] - Fix POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line [boo#1007188] [CVE-2016-6321] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1341=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tar-1.28-2.19.1 tar-backup-scripts-1.28-2.19.1 tar-debuginfo-1.28-2.19.1 tar-debugsource-1.28-2.19.1 tar-tests-1.28-2.19.1 tar-tests-debuginfo-1.28-2.19.1 - openSUSE 13.2 (noarch): tar-lang-1.28-2.19.1 References: https://www.suse.com/security/cve/CVE-2016-6321.html https://bugzilla.suse.com/1007188 https://bugzilla.suse.com/913058

1 0

openSUSE-OU-2016:2870-1: moderate: ncompress, a file compression utility
by maintenance＠opensuse.org 22 Nov '16

22 Nov '16

openSUSE Optional Update: ncompress, a file compression utility ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:2870-1 Rating: moderate References: #1007750 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update provides ncompress, a file compression utility. The ncompress package contains the compress and uncompress file compression and decompression utilities, which are compatible with the original UNIX compress utility (.Z file extensions). These utilities can't handle gzipped (.gz file extensions) files, but gzip can handle compressed files. Install ncompress if you need compression/decompression utilities which are compatible with the original UNIX compress utility. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch 1000=1 - openSUSE Leap 42.1: zypper in -t patch 1000=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ncompress-4.2.4.4-2.1 ncompress-debuginfo-4.2.4.4-2.1 ncompress-debugsource-4.2.4.4-2.1 - openSUSE Leap 42.1 (i586 x86_64): ncompress-4.2.4.4-2.1 ncompress-debuginfo-4.2.4.4-2.1 ncompress-debugsource-4.2.4.4-2.1 References: https://bugzilla.suse.com/1007750

1 0

openSUSE-SU-2016:2866-1: important: Security update for php5
by opensuse-security＠opensuse.org 21 Nov '16

21 Nov '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2866-1 Rating: important References: #1008029 Cross-References: CVE-2016-9137 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: * CVE-2016-9137: Fixed a use after free in unserialize() in curl file deserialization [boo#1008029] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1338=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-86.1 apache2-mod_php5-debuginfo-5.6.1-86.1 php5-5.6.1-86.1 php5-bcmath-5.6.1-86.1 php5-bcmath-debuginfo-5.6.1-86.1 php5-bz2-5.6.1-86.1 php5-bz2-debuginfo-5.6.1-86.1 php5-calendar-5.6.1-86.1 php5-calendar-debuginfo-5.6.1-86.1 php5-ctype-5.6.1-86.1 php5-ctype-debuginfo-5.6.1-86.1 php5-curl-5.6.1-86.1 php5-curl-debuginfo-5.6.1-86.1 php5-dba-5.6.1-86.1 php5-dba-debuginfo-5.6.1-86.1 php5-debuginfo-5.6.1-86.1 php5-debugsource-5.6.1-86.1 php5-devel-5.6.1-86.1 php5-dom-5.6.1-86.1 php5-dom-debuginfo-5.6.1-86.1 php5-enchant-5.6.1-86.1 php5-enchant-debuginfo-5.6.1-86.1 php5-exif-5.6.1-86.1 php5-exif-debuginfo-5.6.1-86.1 php5-fastcgi-5.6.1-86.1 php5-fastcgi-debuginfo-5.6.1-86.1 php5-fileinfo-5.6.1-86.1 php5-fileinfo-debuginfo-5.6.1-86.1 php5-firebird-5.6.1-86.1 php5-firebird-debuginfo-5.6.1-86.1 php5-fpm-5.6.1-86.1 php5-fpm-debuginfo-5.6.1-86.1 php5-ftp-5.6.1-86.1 php5-ftp-debuginfo-5.6.1-86.1 php5-gd-5.6.1-86.1 php5-gd-debuginfo-5.6.1-86.1 php5-gettext-5.6.1-86.1 php5-gettext-debuginfo-5.6.1-86.1 php5-gmp-5.6.1-86.1 php5-gmp-debuginfo-5.6.1-86.1 php5-iconv-5.6.1-86.1 php5-iconv-debuginfo-5.6.1-86.1 php5-imap-5.6.1-86.1 php5-imap-debuginfo-5.6.1-86.1 php5-intl-5.6.1-86.1 php5-intl-debuginfo-5.6.1-86.1 php5-json-5.6.1-86.1 php5-json-debuginfo-5.6.1-86.1 php5-ldap-5.6.1-86.1 php5-ldap-debuginfo-5.6.1-86.1 php5-mbstring-5.6.1-86.1 php5-mbstring-debuginfo-5.6.1-86.1 php5-mcrypt-5.6.1-86.1 php5-mcrypt-debuginfo-5.6.1-86.1 php5-mssql-5.6.1-86.1 php5-mssql-debuginfo-5.6.1-86.1 php5-mysql-5.6.1-86.1 php5-mysql-debuginfo-5.6.1-86.1 php5-odbc-5.6.1-86.1 php5-odbc-debuginfo-5.6.1-86.1 php5-opcache-5.6.1-86.1 php5-opcache-debuginfo-5.6.1-86.1 php5-openssl-5.6.1-86.1 php5-openssl-debuginfo-5.6.1-86.1 php5-pcntl-5.6.1-86.1 php5-pcntl-debuginfo-5.6.1-86.1 php5-pdo-5.6.1-86.1 php5-pdo-debuginfo-5.6.1-86.1 php5-pgsql-5.6.1-86.1 php5-pgsql-debuginfo-5.6.1-86.1 php5-phar-5.6.1-86.1 php5-phar-debuginfo-5.6.1-86.1 php5-posix-5.6.1-86.1 php5-posix-debuginfo-5.6.1-86.1 php5-pspell-5.6.1-86.1 php5-pspell-debuginfo-5.6.1-86.1 php5-readline-5.6.1-86.1 php5-readline-debuginfo-5.6.1-86.1 php5-shmop-5.6.1-86.1 php5-shmop-debuginfo-5.6.1-86.1 php5-snmp-5.6.1-86.1 php5-snmp-debuginfo-5.6.1-86.1 php5-soap-5.6.1-86.1 php5-soap-debuginfo-5.6.1-86.1 php5-sockets-5.6.1-86.1 php5-sockets-debuginfo-5.6.1-86.1 php5-sqlite-5.6.1-86.1 php5-sqlite-debuginfo-5.6.1-86.1 php5-suhosin-5.6.1-86.1 php5-suhosin-debuginfo-5.6.1-86.1 php5-sysvmsg-5.6.1-86.1 php5-sysvmsg-debuginfo-5.6.1-86.1 php5-sysvsem-5.6.1-86.1 php5-sysvsem-debuginfo-5.6.1-86.1 php5-sysvshm-5.6.1-86.1 php5-sysvshm-debuginfo-5.6.1-86.1 php5-tidy-5.6.1-86.1 php5-tidy-debuginfo-5.6.1-86.1 php5-tokenizer-5.6.1-86.1 php5-tokenizer-debuginfo-5.6.1-86.1 php5-wddx-5.6.1-86.1 php5-wddx-debuginfo-5.6.1-86.1 php5-xmlreader-5.6.1-86.1 php5-xmlreader-debuginfo-5.6.1-86.1 php5-xmlrpc-5.6.1-86.1 php5-xmlrpc-debuginfo-5.6.1-86.1 php5-xmlwriter-5.6.1-86.1 php5-xmlwriter-debuginfo-5.6.1-86.1 php5-xsl-5.6.1-86.1 php5-xsl-debuginfo-5.6.1-86.1 php5-zip-5.6.1-86.1 php5-zip-debuginfo-5.6.1-86.1 php5-zlib-5.6.1-86.1 php5-zlib-debuginfo-5.6.1-86.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-86.1 References: https://www.suse.com/security/cve/CVE-2016-9137.html https://bugzilla.suse.com/1008029

1 0

openSUSE-RU-2016:2865-1: moderate: Recommended update for kdesu
by maintenance＠opensuse.org 21 Nov '16

21 Nov '16

openSUSE Recommended Update: Recommended update for kdesu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2865-1 Rating: moderate References: #1009510 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kdesu fixes the following issues: - Add unset-xdg-runtime-dir.diff to unset XDG_RUNTIME_DIR in processes run with kdesu. This fixes the problem which made most kde application (like dolphin or kate) not usable when run as another user with kdesu. kdesu worked to run those applications as root, but then, sockets were created in / . - Fix the creation of those files which will be created on /tmp/runtime-<username>/ (boo#1009510). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1337=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kdesu-debugsource-5.26.0-3.1 kdesu-devel-5.26.0-3.1 libKF5Su5-5.26.0-3.1 libKF5Su5-debuginfo-5.26.0-3.1 - openSUSE Leap 42.2 (noarch): libKF5Su5-lang-5.26.0-3.1 - openSUSE Leap 42.2 (x86_64): kdesu-devel-32bit-5.26.0-3.1 libKF5Su5-32bit-5.26.0-3.1 libKF5Su5-debuginfo-32bit-5.26.0-3.1 References: https://bugzilla.suse.com/1009510

1 0