March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0887-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0887-1 Rating: moderate References: #955400 #960040 #963585 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for YaST fixes the following issues: - SuSEFirewall module reads system configuration during autoinstallation. It behaves in the same way as regular installation or normal operation. (bsc#963585) - AutoYaST settings for SuSEFirewall are now merged with the existing configuration instead of being fully overwritten. - Put valid hostname into AutoYaST profile generated at the end of installation. (bsc#960040) - Add a default value for firewall setting FW_BOOT_INIT_FULL. (bsc#955400) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-398=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-3.1.155.3-3.1 yast2-devel-doc-3.1.155.3-3.1 References: https://bugzilla.suse.com/955400 https://bugzilla.suse.com/960040 https://bugzilla.suse.com/963585

1 0

openSUSE-RU-2016:0886-1: moderate: Recommended update for os-prober
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for os-prober ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0886-1 Rating: moderate References: #892364 #931955 #953987 #954225 #957018 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for os-prober fixes the following issues: Various patches were merged from openSUSE Factory: - fix os-prober fails to detect other SLES12 installation (boo#892364) - fix os-prober mount error, no such file or directory (boo#931955) - also skip legacy grub if /boot/grub2/grub.cfg is present - fix detect os on default subvolume in snapshot (boo#954225) - fix os-prober update broke Linux detection (boo#957018) - fix y2base runs at 100% cpu busy from beginning in installation of files to completion (boo#953987) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-391=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): os-prober-1.61-12.4.1 os-prober-debuginfo-1.61-12.4.1 os-prober-debugsource-1.61-12.4.1 References: https://bugzilla.suse.com/892364 https://bugzilla.suse.com/931955 https://bugzilla.suse.com/953987 https://bugzilla.suse.com/954225 https://bugzilla.suse.com/957018

1 0

openSUSE-RU-2016:0885-1: moderate: Recommended update for mgetty
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0885-1 Rating: moderate References: #968571 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mgetty fixes the following issues: - Use correct permissions for unit files (boo#968571) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-390=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-390=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): g3utils-1.1.36-62.1 g3utils-debuginfo-1.1.36-62.1 mgetty-1.1.36-62.1 mgetty-debuginfo-1.1.36-62.1 mgetty-debugsource-1.1.36-62.1 sendfax-1.1.36-62.1 sendfax-debuginfo-1.1.36-62.1 - openSUSE 13.2 (i586 x86_64): g3utils-1.1.36-55.7.1 g3utils-debuginfo-1.1.36-55.7.1 mgetty-1.1.36-55.7.1 mgetty-debuginfo-1.1.36-55.7.1 mgetty-debugsource-1.1.36-55.7.1 sendfax-1.1.36-55.7.1 sendfax-debuginfo-1.1.36-55.7.1 References: https://bugzilla.suse.com/968571

1 0

openSUSE-SU-2016:0882-1: moderate: Security update for dropbear
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0882-1 Rating: moderate References: #970633 Cross-References: CVE-2016-3116 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dropbear was updated to 2016.72 to fix the following issues: Changes in dropbear: - updated to upstream version 2016.72 * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for boo#970633 - CVE-2016-3116 - updated to upstream version 2015.71 * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 * Fix crash on exit when -p address:port is used, broke in 2015.68 * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 * Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 - updated to upstream version 2015.70 * Fix server password authentication on Linux, broke in 2015.69 * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) * Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski * Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin * Manpage improvements from Guilhem Moulin * Build fixes for Android from Mike Frysinger * Don't display the MOTD when an explicit command is run from Guilhem Moulin * Check curve25519 shared secret isn't zero - updated to upstream version 2015.68 * Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost * Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) * Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. * Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. * Increase maximum command length to 9000 bytes * Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) * Fix small ECC memory leaks * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. * Twofish-ctr cipher is supported though disabled by default * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang * Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin * Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz - fixed checksum URL - updated to upstream version 2015.67 * Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard * Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB * Default client key path ~/.ssh/id_dropbear * Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 * Add option to disable CBC ciphers. * Disable twofish in default options.h * Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. * Fix installing dropbear.8 in a separate build directory, from Like Ma * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea * Minor bug fixes, a few issues found by Coverity scan - replaced deprecated gpg-offline check by obs-service-source_validator - updated to upstream version 2014.66 * Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere * Fix wtmp which broke since 2013.62, patch from Whoopie Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-387=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-387=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dropbear-2016.72-8.1 dropbear-debuginfo-2016.72-8.1 dropbear-debugsource-2016.72-8.1 - openSUSE 13.2 (i586 x86_64): dropbear-2016.72-2.3.1 dropbear-debuginfo-2016.72-2.3.1 dropbear-debugsource-2016.72-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-3116.html https://bugzilla.suse.com/970633

1 0

openSUSE-SU-2016:0881-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0881-1 Rating: moderate References: #928292 #961528 #967082 Cross-References: CVE-2015-8607 CVE-2016-2381 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: - CVE-2016-2381: Fixed environment duplicated variable handling bug [boo#967082] - fix memory leak in 'use utf8' handling [boo#928292] - CVE-2015-8607: Fixed taint propagation in canonpath [boo#961528] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-386=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): perl-5.20.1-3.1 perl-base-5.20.1-3.1 perl-base-debuginfo-5.20.1-3.1 perl-debuginfo-5.20.1-3.1 perl-debugsource-5.20.1-3.1 - openSUSE 13.2 (x86_64): perl-32bit-5.20.1-3.1 perl-base-32bit-5.20.1-3.1 perl-base-debuginfo-32bit-5.20.1-3.1 perl-debuginfo-32bit-5.20.1-3.1 - openSUSE 13.2 (noarch): perl-doc-5.20.1-3.1 References: https://www.suse.com/security/cve/CVE-2015-8607.html https://www.suse.com/security/cve/CVE-2016-2381.html https://bugzilla.suse.com/928292 https://bugzilla.suse.com/961528 https://bugzilla.suse.com/967082

1 0

openSUSE-SU-2016:0880-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0880-1 Rating: moderate References: #965875 Cross-References: CVE-2016-0739 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2016-0739: Fix Weakness in diffie-hellman secret key generation. (bsc#965875) This fix was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-394=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libssh-debugsource-0.6.3-2.10.1 libssh-devel-0.6.3-2.10.1 libssh-devel-doc-0.6.3-2.10.1 libssh4-0.6.3-2.10.1 libssh4-debuginfo-0.6.3-2.10.1 - openSUSE 13.2 (x86_64): libssh4-32bit-0.6.3-2.10.1 libssh4-debuginfo-32bit-0.6.3-2.10.1 References: https://www.suse.com/security/cve/CVE-2016-0739.html https://bugzilla.suse.com/965875

1 0

openSUSE-RU-2016:0879-1: Recommended update for libcap
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for libcap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0879-1 Rating: low References: #967838 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libcap adds two new capabilities (CAP_WAKE_ALARM and CAP_BLOCK_SUSPEND) which are available in Linux Kernel 3.12. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-392=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libcap-debugsource-2.22-16.1 libcap-devel-2.22-16.1 libcap-progs-2.22-16.1 libcap-progs-debuginfo-2.22-16.1 libcap2-2.22-16.1 libcap2-debuginfo-2.22-16.1 - openSUSE Leap 42.1 (x86_64): libcap2-32bit-2.22-16.1 libcap2-debuginfo-32bit-2.22-16.1 References: https://bugzilla.suse.com/967838

1 0

openSUSE-SU-2016:0878-1: moderate: Security update for pidgin-otr
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for pidgin-otr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0878-1 Rating: moderate References: #970498 Cross-References: CVE-2015-8833 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to pidgin-otr 4.0.2 fixes the following issue: - CVE-2015-8833: use-after-free issue during SMP (boo#970498) It also contains new and updated translations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-397=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-397=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): pidgin-otr-4.0.2-7.1 pidgin-otr-debuginfo-4.0.2-7.1 pidgin-otr-debugsource-4.0.2-7.1 - openSUSE 13.2 (i586 x86_64): pidgin-otr-4.0.2-7.8.1 pidgin-otr-debuginfo-4.0.2-7.8.1 pidgin-otr-debugsource-4.0.2-7.8.1 References: https://www.suse.com/security/cve/CVE-2015-8833.html https://bugzilla.suse.com/970498

1 0

openSUSE-SU-2016:0877-1: important: Security update for samba
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0877-1 Rating: important References: #953382 #953972 #960249 #962177 #964023 #966271 #968222 Cross-References: CVE-2015-7560 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for the samba server fixes the following issues: Security issue fixed: - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222). Other bugs fixed: - Enable clustering (CTDB) support; (bsc#966271). - s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023). - vfs_fruit: Fix renaming directories with open files; (bso#11065). - Fix MacOS finder error 36 when copying folder to Samba; (bso#11347). - s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). - Fix copying files with vfs_fruit when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). - s3:libsmb: Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). - Reduce the memory footprint of empty string options; (bso#11625). - lib/async_req: Do not install async_connect_send_test; (bso#11639). - docs: Fix typos in man vfs_gpfs; (bso#11641). - smbd: make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). - smbcacls: Fix uninitialized variable; (bso#11682). - s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). - Add quotes around path of update-apparmor-samba-profile; (bsc#962177). - Prevent access denied if the share path is "/"; (bso#11647); (bsc#960249). - Ensure samlogon fallback requests are rerouted after kerberos failure; (bsc#953972). - samba: winbind crash -> netlogon_creds_client_authenticator; (bsc#953972) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-399=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ctdb-4.2.4-12.1 ctdb-debuginfo-4.2.4-12.1 ctdb-devel-4.2.4-12.1 ctdb-tests-4.2.4-12.1 ctdb-tests-debuginfo-4.2.4-12.1 libdcerpc-atsvc-devel-4.2.4-12.1 libdcerpc-atsvc0-4.2.4-12.1 libdcerpc-atsvc0-debuginfo-4.2.4-12.1 libdcerpc-binding0-4.2.4-12.1 libdcerpc-binding0-debuginfo-4.2.4-12.1 libdcerpc-devel-4.2.4-12.1 libdcerpc-samr-devel-4.2.4-12.1 libdcerpc-samr0-4.2.4-12.1 libdcerpc-samr0-debuginfo-4.2.4-12.1 libdcerpc0-4.2.4-12.1 libdcerpc0-debuginfo-4.2.4-12.1 libgensec-devel-4.2.4-12.1 libgensec0-4.2.4-12.1 libgensec0-debuginfo-4.2.4-12.1 libndr-devel-4.2.4-12.1 libndr-krb5pac-devel-4.2.4-12.1 libndr-krb5pac0-4.2.4-12.1 libndr-krb5pac0-debuginfo-4.2.4-12.1 libndr-nbt-devel-4.2.4-12.1 libndr-nbt0-4.2.4-12.1 libndr-nbt0-debuginfo-4.2.4-12.1 libndr-standard-devel-4.2.4-12.1 libndr-standard0-4.2.4-12.1 libndr-standard0-debuginfo-4.2.4-12.1 libndr0-4.2.4-12.1 libndr0-debuginfo-4.2.4-12.1 libnetapi-devel-4.2.4-12.1 libnetapi0-4.2.4-12.1 libnetapi0-debuginfo-4.2.4-12.1 libregistry-devel-4.2.4-12.1 libregistry0-4.2.4-12.1 libregistry0-debuginfo-4.2.4-12.1 libsamba-credentials-devel-4.2.4-12.1 libsamba-credentials0-4.2.4-12.1 libsamba-credentials0-debuginfo-4.2.4-12.1 libsamba-hostconfig-devel-4.2.4-12.1 libsamba-hostconfig0-4.2.4-12.1 libsamba-hostconfig0-debuginfo-4.2.4-12.1 libsamba-passdb-devel-4.2.4-12.1 libsamba-passdb0-4.2.4-12.1 libsamba-passdb0-debuginfo-4.2.4-12.1 libsamba-policy-devel-4.2.4-12.1 libsamba-policy0-4.2.4-12.1 libsamba-policy0-debuginfo-4.2.4-12.1 libsamba-util-devel-4.2.4-12.1 libsamba-util0-4.2.4-12.1 libsamba-util0-debuginfo-4.2.4-12.1 libsamdb-devel-4.2.4-12.1 libsamdb0-4.2.4-12.1 libsamdb0-debuginfo-4.2.4-12.1 libsmbclient-devel-4.2.4-12.1 libsmbclient-raw-devel-4.2.4-12.1 libsmbclient-raw0-4.2.4-12.1 libsmbclient-raw0-debuginfo-4.2.4-12.1 libsmbclient0-4.2.4-12.1 libsmbclient0-debuginfo-4.2.4-12.1 libsmbconf-devel-4.2.4-12.1 libsmbconf0-4.2.4-12.1 libsmbconf0-debuginfo-4.2.4-12.1 libsmbldap-devel-4.2.4-12.1 libsmbldap0-4.2.4-12.1 libsmbldap0-debuginfo-4.2.4-12.1 libtevent-util-devel-4.2.4-12.1 libtevent-util0-4.2.4-12.1 libtevent-util0-debuginfo-4.2.4-12.1 libwbclient-devel-4.2.4-12.1 libwbclient0-4.2.4-12.1 libwbclient0-debuginfo-4.2.4-12.1 samba-4.2.4-12.1 samba-client-4.2.4-12.1 samba-client-debuginfo-4.2.4-12.1 samba-core-devel-4.2.4-12.1 samba-debuginfo-4.2.4-12.1 samba-debugsource-4.2.4-12.1 samba-libs-4.2.4-12.1 samba-libs-debuginfo-4.2.4-12.1 samba-pidl-4.2.4-12.1 samba-python-4.2.4-12.1 samba-python-debuginfo-4.2.4-12.1 samba-test-4.2.4-12.1 samba-test-debuginfo-4.2.4-12.1 samba-test-devel-4.2.4-12.1 samba-winbind-4.2.4-12.1 samba-winbind-debuginfo-4.2.4-12.1 - openSUSE Leap 42.1 (x86_64): libdcerpc-atsvc0-32bit-4.2.4-12.1 libdcerpc-atsvc0-debuginfo-32bit-4.2.4-12.1 libdcerpc-binding0-32bit-4.2.4-12.1 libdcerpc-binding0-debuginfo-32bit-4.2.4-12.1 libdcerpc-samr0-32bit-4.2.4-12.1 libdcerpc-samr0-debuginfo-32bit-4.2.4-12.1 libdcerpc0-32bit-4.2.4-12.1 libdcerpc0-debuginfo-32bit-4.2.4-12.1 libgensec0-32bit-4.2.4-12.1 libgensec0-debuginfo-32bit-4.2.4-12.1 libndr-krb5pac0-32bit-4.2.4-12.1 libndr-krb5pac0-debuginfo-32bit-4.2.4-12.1 libndr-nbt0-32bit-4.2.4-12.1 libndr-nbt0-debuginfo-32bit-4.2.4-12.1 libndr-standard0-32bit-4.2.4-12.1 libndr-standard0-debuginfo-32bit-4.2.4-12.1 libndr0-32bit-4.2.4-12.1 libndr0-debuginfo-32bit-4.2.4-12.1 libnetapi0-32bit-4.2.4-12.1 libnetapi0-debuginfo-32bit-4.2.4-12.1 libregistry0-32bit-4.2.4-12.1 libregistry0-debuginfo-32bit-4.2.4-12.1 libsamba-credentials0-32bit-4.2.4-12.1 libsamba-credentials0-debuginfo-32bit-4.2.4-12.1 libsamba-hostconfig0-32bit-4.2.4-12.1 libsamba-hostconfig0-debuginfo-32bit-4.2.4-12.1 libsamba-passdb0-32bit-4.2.4-12.1 libsamba-passdb0-debuginfo-32bit-4.2.4-12.1 libsamba-policy0-32bit-4.2.4-12.1 libsamba-policy0-debuginfo-32bit-4.2.4-12.1 libsamba-util0-32bit-4.2.4-12.1 libsamba-util0-debuginfo-32bit-4.2.4-12.1 libsamdb0-32bit-4.2.4-12.1 libsamdb0-debuginfo-32bit-4.2.4-12.1 libsmbclient-raw0-32bit-4.2.4-12.1 libsmbclient-raw0-debuginfo-32bit-4.2.4-12.1 libsmbclient0-32bit-4.2.4-12.1 libsmbclient0-debuginfo-32bit-4.2.4-12.1 libsmbconf0-32bit-4.2.4-12.1 libsmbconf0-debuginfo-32bit-4.2.4-12.1 libsmbldap0-32bit-4.2.4-12.1 libsmbldap0-debuginfo-32bit-4.2.4-12.1 libtevent-util0-32bit-4.2.4-12.1 libtevent-util0-debuginfo-32bit-4.2.4-12.1 libwbclient0-32bit-4.2.4-12.1 libwbclient0-debuginfo-32bit-4.2.4-12.1 samba-32bit-4.2.4-12.1 samba-client-32bit-4.2.4-12.1 samba-client-debuginfo-32bit-4.2.4-12.1 samba-debuginfo-32bit-4.2.4-12.1 samba-libs-32bit-4.2.4-12.1 samba-libs-debuginfo-32bit-4.2.4-12.1 samba-winbind-32bit-4.2.4-12.1 samba-winbind-debuginfo-32bit-4.2.4-12.1 - openSUSE Leap 42.1 (noarch): samba-doc-4.2.4-12.1 References: https://www.suse.com/security/cve/CVE-2015-7560.html https://bugzilla.suse.com/953382 https://bugzilla.suse.com/953972 https://bugzilla.suse.com/960249 https://bugzilla.suse.com/962177 https://bugzilla.suse.com/964023 https://bugzilla.suse.com/966271 https://bugzilla.suse.com/968222

1 0

openSUSE-SU-2016:0876-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0876-1 Rating: important References: #969894 Cross-References: CVE-2015-4477 CVE-2015-7207 CVE-2016-1952 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: MozillaThunderbird was updated to 38.7.0 to fix the following issues: * Update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-395=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-395=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-38.7.0-13.1 MozillaThunderbird-buildsymbols-38.7.0-13.1 MozillaThunderbird-debuginfo-38.7.0-13.1 MozillaThunderbird-debugsource-38.7.0-13.1 MozillaThunderbird-devel-38.7.0-13.1 MozillaThunderbird-translations-common-38.7.0-13.1 MozillaThunderbird-translations-other-38.7.0-13.1 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.7.0-40.2 MozillaThunderbird-buildsymbols-38.7.0-40.2 MozillaThunderbird-debuginfo-38.7.0-40.2 MozillaThunderbird-debugsource-38.7.0-40.2 MozillaThunderbird-devel-38.7.0-40.2 MozillaThunderbird-translations-common-38.7.0-40.2 MozillaThunderbird-translations-other-38.7.0-40.2 References: https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-7207.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0