July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1798-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 14 Jul '16

14 Jul '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1798-1 Rating: important References: #970114 #970275 #978469 #980265 #983977 #984755 #986362 #986530 #986572 Cross-References: CVE-2016-4470 CVE-2016-4794 CVE-2016-4997 CVE-2016-5829 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 5 fixes is now available. Description: The openSUSE Leap 42.1 was updated to 4.1.27 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-4997: A buffer overflow in 32bit compat_setsockopt iptables handling could lead to a local privilege escalation. (bsc#986362) - CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572). - CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755). - CVE-2016-4794: Use-after-free vulnerability in mm/percpu.c in the Linux kernel allowed local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls (bnc#980265). The following non-security bugs were fixed: - Refresh patches.xen/xen-netback-coalesce: Restore copying of SKBs with head exceeding page size (bsc#978469). - Refresh patches.xen/xen3-patch-2.6.26 (fix PAT initialization). - Refresh patches.xen/xen3-patch-2.6.39 (fix ia32_compat inheritance). - Refresh patches.xen/xen3-patch-3.14: Suppress atomic file position updates for /proc/xen/xenbus (bsc#970275). - Refresh patches.xen/xen3-patch-3.16 (drop redundant addition of a comment). - Refresh patches.xen/xen3-patch-4.1.7-8. - base: make module_create_drivers_dir race-free (bnc#983977). - ipvs: count pre-established TCP states as active (bsc#970114). - net: thunderx: Fix TL4 configuration for secondary Qsets (bsc#986530). - net: thunderx: Fix link status reporting (bsc#986530). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-869=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.27-24.1 kernel-debug-base-4.1.27-24.1 kernel-debug-base-debuginfo-4.1.27-24.1 kernel-debug-debuginfo-4.1.27-24.1 kernel-debug-debugsource-4.1.27-24.1 kernel-debug-devel-4.1.27-24.1 kernel-debug-devel-debuginfo-4.1.27-24.1 kernel-ec2-4.1.27-24.1 kernel-ec2-base-4.1.27-24.1 kernel-ec2-base-debuginfo-4.1.27-24.1 kernel-ec2-debuginfo-4.1.27-24.1 kernel-ec2-debugsource-4.1.27-24.1 kernel-ec2-devel-4.1.27-24.1 kernel-pv-4.1.27-24.1 kernel-pv-base-4.1.27-24.1 kernel-pv-base-debuginfo-4.1.27-24.1 kernel-pv-debuginfo-4.1.27-24.1 kernel-pv-debugsource-4.1.27-24.1 kernel-pv-devel-4.1.27-24.1 kernel-vanilla-4.1.27-24.1 kernel-vanilla-debuginfo-4.1.27-24.1 kernel-vanilla-debugsource-4.1.27-24.1 kernel-vanilla-devel-4.1.27-24.1 kernel-xen-4.1.27-24.1 kernel-xen-base-4.1.27-24.1 kernel-xen-base-debuginfo-4.1.27-24.1 kernel-xen-debuginfo-4.1.27-24.1 kernel-xen-debugsource-4.1.27-24.1 kernel-xen-devel-4.1.27-24.1 - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.27-24.1 kernel-default-base-4.1.27-24.1 kernel-default-base-debuginfo-4.1.27-24.1 kernel-default-debuginfo-4.1.27-24.1 kernel-default-debugsource-4.1.27-24.1 kernel-default-devel-4.1.27-24.1 kernel-obs-build-4.1.27-24.2 kernel-obs-build-debugsource-4.1.27-24.2 kernel-obs-qa-4.1.27-24.1 kernel-obs-qa-xen-4.1.27-24.1 kernel-syms-4.1.27-24.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.27-24.1 kernel-docs-4.1.27-24.2 kernel-docs-html-4.1.27-24.2 kernel-docs-pdf-4.1.27-24.2 kernel-macros-4.1.27-24.1 kernel-source-4.1.27-24.1 kernel-source-vanilla-4.1.27-24.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.27-24.1 kernel-pae-base-4.1.27-24.1 kernel-pae-base-debuginfo-4.1.27-24.1 kernel-pae-debuginfo-4.1.27-24.1 kernel-pae-debugsource-4.1.27-24.1 kernel-pae-devel-4.1.27-24.1 References: https://www.suse.com/security/cve/CVE-2016-4470.html https://www.suse.com/security/cve/CVE-2016-4794.html https://www.suse.com/security/cve/CVE-2016-4997.html https://www.suse.com/security/cve/CVE-2016-5829.html https://bugzilla.suse.com/970114 https://bugzilla.suse.com/970275 https://bugzilla.suse.com/978469 https://bugzilla.suse.com/980265 https://bugzilla.suse.com/983977 https://bugzilla.suse.com/984755 https://bugzilla.suse.com/986362 https://bugzilla.suse.com/986530 https://bugzilla.suse.com/986572

1 0

openSUSE-RU-2016:1797-1: Recommended update for clamav-database
by maintenance＠opensuse.org 13 Jul '16

13 Jul '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1797-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh July 11, 2016 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-867=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201607110002-125.1 References:

1 0

openSUSE-RU-2016:1796-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 13 Jul '16

13 Jul '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1796-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update to Opera 38.0.2220.41 contains the following fixes: - Hovering bookmark below Menu would crash Opera - Quick clicking side panel items failed to work - Bold text in address bar suggestions was wrongly displayed - Certain pages never loaded completely when AdBlocker is on - Youtube history was not filled if ad-blocker was enabled - Fixed problems with autocomplete when typing www - Adblock + speedtest.net = blank page - YouTube shows ‘fullscreen unavailable’ message if DPI is > 100% Chromium has been updated to 51.0.2704.106. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-868=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1:NonFree (x86_64): opera-38.0.2220.41-19.1 References:

1 0

openSUSE-SU-2016:1795-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 13 Jul '16

13 Jul '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1795-1 Rating: important References: #988579 Cross-References: CVE-2016-4172 CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4178 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 CVE-2016-4249 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 52 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.632 to fix many security issues tracked under the upstream advisory APSB16-25, allowing remote attackers to execute arbitrary code when delivering specially crafted Flash content. The following vulnerabilities were fixed: - CVE-2016-4172: memory corruption vulnerability that could lead to code execution - CVE-2016-4173: use-after-free vulnerability that could lead to code execution - CVE-2016-4174: use-after-free vulnerability that could lead to code execution - CVE-2016-4175: memory corruption vulnerability that could lead to code execution - CVE-2016-4176: stack corruption vulnerability that could lead to code execution - CVE-2016-4177: stack corruption vulnerability that could lead to code execution - CVE-2016-4178: security bypass vulnerability that could lead to information disclosure - CVE-2016-4179: memory corruption vulnerability that could lead to code execution - CVE-2016-4180: memory corruption vulnerability that could lead to code execution - CVE-2016-4181: memory corruption vulnerability that could lead to code execution - CVE-2016-4182: memory corruption vulnerability that could lead to code execution - CVE-2016-4183: memory corruption vulnerability that could lead to code execution - CVE-2016-4184: memory corruption vulnerability that could lead to code execution - CVE-2016-4185: memory corruption vulnerability that could lead to code execution - CVE-2016-4186: memory corruption vulnerability that could lead to code execution - CVE-2016-4187: memory corruption vulnerability that could lead to code execution - CVE-2016-4188: memory corruption vulnerability that could lead to code execution - CVE-2016-4189: memory corruption vulnerability that could lead to code execution - CVE-2016-4190: memory corruption vulnerability that could lead to code execution - CVE-2016-4217: memory corruption vulnerability that could lead to code execution - CVE-2016-4218: memory corruption vulnerability that could lead to code execution - CVE-2016-4219: memory corruption vulnerability that could lead to code execution - CVE-2016-4220: memory corruption vulnerability that could lead to code execution - CVE-2016-4221: memory corruption vulnerability that could lead to code execution - CVE-2016-4222: use-after-free vulnerability that could lead to code execution - CVE-2016-4223: type confusion vulnerability that could lead to code execution - CVE-2016-4224: type confusion vulnerability that could lead to code execution - CVE-2016-4225: type confusion vulnerability that could lead to code execution - CVE-2016-4226: use-after-free vulnerability that could lead to code execution - CVE-2016-4227: use-after-free vulnerability that could lead to code execution - CVE-2016-4228: use-after-free vulnerability that could lead to code execution - CVE-2016-4229: use-after-free vulnerability that could lead to code execution - CVE-2016-4230: use-after-free vulnerability that could lead to code execution - CVE-2016-4231: use-after-free vulnerability that could lead to code execution - CVE-2016-4232: memory leak vulnerability - CVE-2016-4233: memory corruption vulnerability that could lead to code execution - CVE-2016-4234: memory corruption vulnerability that could lead to code execution - CVE-2016-4235: memory corruption vulnerability that could lead to code execution - CVE-2016-4236: memory corruption vulnerability that could lead to code execution - CVE-2016-4237: memory corruption vulnerability that could lead to code execution - CVE-2016-4238: memory corruption vulnerability that could lead to code execution - CVE-2016-4239: memory corruption vulnerability that could lead to code execution - CVE-2016-4240: memory corruption vulnerability that could lead to code execution - CVE-2016-4241: memory corruption vulnerability that could lead to code execution - CVE-2016-4242: memory corruption vulnerability that could lead to code execution - CVE-2016-4243: memory corruption vulnerability that could lead to code execution - CVE-2016-4244: memory corruption vulnerability that could lead to code execution - CVE-2016-4245: memory corruption vulnerability that could lead to code execution - CVE-2016-4246: memory corruption vulnerability that could lead to code execution - CVE-2016-4247: race condition vulnerability that could lead to information disclosure - CVE-2016-4248: use-after-free vulnerability that could lead to code execution - CVE-2016-4249: heap buffer overflow vulnerability that could lead to code execution Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-866=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.632-2.103.1 flash-player-gnome-11.2.202.632-2.103.1 flash-player-kde4-11.2.202.632-2.103.1 References: https://www.suse.com/security/cve/CVE-2016-4172.html https://www.suse.com/security/cve/CVE-2016-4173.html https://www.suse.com/security/cve/CVE-2016-4174.html https://www.suse.com/security/cve/CVE-2016-4175.html https://www.suse.com/security/cve/CVE-2016-4176.html https://www.suse.com/security/cve/CVE-2016-4177.html https://www.suse.com/security/cve/CVE-2016-4178.html https://www.suse.com/security/cve/CVE-2016-4179.html https://www.suse.com/security/cve/CVE-2016-4180.html https://www.suse.com/security/cve/CVE-2016-4181.html https://www.suse.com/security/cve/CVE-2016-4182.html https://www.suse.com/security/cve/CVE-2016-4183.html https://www.suse.com/security/cve/CVE-2016-4184.html https://www.suse.com/security/cve/CVE-2016-4185.html https://www.suse.com/security/cve/CVE-2016-4186.html https://www.suse.com/security/cve/CVE-2016-4187.html https://www.suse.com/security/cve/CVE-2016-4188.html https://www.suse.com/security/cve/CVE-2016-4189.html https://www.suse.com/security/cve/CVE-2016-4190.html https://www.suse.com/security/cve/CVE-2016-4217.html https://www.suse.com/security/cve/CVE-2016-4218.html https://www.suse.com/security/cve/CVE-2016-4219.html https://www.suse.com/security/cve/CVE-2016-4220.html https://www.suse.com/security/cve/CVE-2016-4221.html https://www.suse.com/security/cve/CVE-2016-4222.html https://www.suse.com/security/cve/CVE-2016-4223.html https://www.suse.com/security/cve/CVE-2016-4224.html https://www.suse.com/security/cve/CVE-2016-4225.html https://www.suse.com/security/cve/CVE-2016-4226.html https://www.suse.com/security/cve/CVE-2016-4227.html https://www.suse.com/security/cve/CVE-2016-4228.html https://www.suse.com/security/cve/CVE-2016-4229.html https://www.suse.com/security/cve/CVE-2016-4230.html https://www.suse.com/security/cve/CVE-2016-4231.html https://www.suse.com/security/cve/CVE-2016-4232.html https://www.suse.com/security/cve/CVE-2016-4233.html https://www.suse.com/security/cve/CVE-2016-4234.html https://www.suse.com/security/cve/CVE-2016-4235.html https://www.suse.com/security/cve/CVE-2016-4236.html https://www.suse.com/security/cve/CVE-2016-4237.html https://www.suse.com/security/cve/CVE-2016-4238.html https://www.suse.com/security/cve/CVE-2016-4239.html https://www.suse.com/security/cve/CVE-2016-4240.html https://www.suse.com/security/cve/CVE-2016-4241.html https://www.suse.com/security/cve/CVE-2016-4242.html https://www.suse.com/security/cve/CVE-2016-4243.html https://www.suse.com/security/cve/CVE-2016-4244.html https://www.suse.com/security/cve/CVE-2016-4245.html https://www.suse.com/security/cve/CVE-2016-4246.html https://www.suse.com/security/cve/CVE-2016-4247.html https://www.suse.com/security/cve/CVE-2016-4248.html https://www.suse.com/security/cve/CVE-2016-4249.html https://bugzilla.suse.com/988579

1 0

openSUSE-RU-2016:1794-1: Recommended update for gpg2
by maintenance＠opensuse.org 13 Jul '16

13 Jul '16

openSUSE Recommended Update: Recommended update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1794-1 Rating: low References: #986783 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gpg2 fixes the following issues: - Need to init the trustdb for import. (boo#986783) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-865=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gpg2-2.0.26-2.6.1 gpg2-debuginfo-2.0.26-2.6.1 gpg2-debugsource-2.0.26-2.6.1 - openSUSE 13.2 (noarch): gpg2-lang-2.0.26-2.6.1 References: https://bugzilla.suse.com/986783

1 0

openSUSE-OU-2016:1787-1: Initial update for libbsd
by maintenance＠opensuse.org 11 Jul '16

11 Jul '16

openSUSE Optional Update: Initial update for libbsd ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1787-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds libbsd to the SUSE Linux Enterprise Package Hub 12. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-864=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libbsd-ctor-static-0.8.3-2.1 libbsd-devel-0.8.3-2.1 libbsd0-0.8.3-2.1 References:

1 0

openSUSE-OU-2016:1786-1: Initial update for R-base
by maintenance＠opensuse.org 11 Jul '16

11 Jul '16

openSUSE Optional Update: Initial update for R-base ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1786-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds R-base to the SUSE Linux Enterprise Package Hub 12. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-863=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): R-KernSmooth-2.23.15-2.1 R-MASS-7.3.45-2.1 R-Matrix-1.2.6-2.1 R-Matrix-devel-1.2.6-2.1 R-base-3.3.1-2.1 R-base-devel-3.3.1-2.1 R-boot-1.3.18-2.1 R-class-7.3.14-2.1 R-cluster-2.0.4-2.1 R-codetools-0.2.14-2.1 R-compiler-3.3.1-2.1 R-core-3.3.1-2.1 R-core-devel-3.3.1-2.1 R-core-doc-3.3.1-2.1 R-core-libs-3.3.1-2.1 R-core-packages-3.3.1-2.1 R-datasets-3.3.1-2.1 R-foreign-0.8.66-2.1 R-grDevices-3.3.1-2.1 R-graphics-3.3.1-2.1 R-grid-3.3.1-2.1 R-lattice-0.20.33-2.1 R-methods-3.3.1-2.1 R-mgcv-1.8.12-2.1 R-nlme-3.1.128-2.1 R-nnet-7.3.12-2.1 R-parallel-3.3.1-2.1 R-recommended-packages-3.3.1-2.1 R-rpart-4.1.10-2.1 R-spatial-7.3.11-2.1 R-splines-3.3.1-2.1 R-stats-3.3.1-2.1 R-stats4-3.3.1-2.1 R-survival-2.39.4-2.1 R-tcltk-3.3.1-2.1 R-tools-3.3.1-2.1 R-utils-3.3.1-2.1 References:

1 0

openSUSE-RU-2016:1781-1: Recommended update for man-pages
by maintenance＠opensuse.org 11 Jul '16

11 Jul '16

openSUSE Recommended Update: Recommended update for man-pages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1781-1 Rating: low References: #967488 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for man-pages fixes the following issues: - Document in open(2) that O_TMPFILE support was added to btrfs only in kernel 3.16 and hence is not yet available on SUSE Linux Enterprise 12-SP1. (bsc#967488) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-861=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): man-pages-4.02-7.5 References: https://bugzilla.suse.com/967488

1 0

openSUSE-RU-2016:1780-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1780-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for virtualbox fixes the following issues: - Update from version 5.0.22 to 5.0.24 This is a maintenance release. The following items were fixed and/or added: + VMM: Reverted to the old I/O-APIC code for now to fix certain regressions with 5.0.22. This means that the networking performance with certain guests will drop to the 5.0.20 level. One workaround is to disable GRO for Linux guests. + Main: When taking a screenshot, don't save garbage for blanked screens. + NAT: Correctly parse resolv.conf file with multiple separators. (5.0.22 regression) + Storage: Fixed a possible corruption of stream optimized VMDK images from VMware when opened in read/write mode for the first time. + Audio: Imlemented dynamic re-attaching of input/output devices on Mac OS X hosts. + ACPI: Notify the guest when the battery / AC state changes instead of relying on guest polling. + Linux hosts: Fixed VERR_VMM_SET_JMP_ABORTED_RESUME Guru Meditations on hosts with Linux 4.6 or later. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-855=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): python-virtualbox-5.0.24-22.1 python-virtualbox-debuginfo-5.0.24-22.1 virtualbox-5.0.24-22.1 virtualbox-debuginfo-5.0.24-22.1 virtualbox-debugsource-5.0.24-22.1 virtualbox-devel-5.0.24-22.1 virtualbox-guest-kmp-default-5.0.24_k4.1.26_21-22.1 virtualbox-guest-kmp-default-debuginfo-5.0.24_k4.1.26_21-22.1 virtualbox-guest-tools-5.0.24-22.1 virtualbox-guest-tools-debuginfo-5.0.24-22.1 virtualbox-guest-x11-5.0.24-22.1 virtualbox-guest-x11-debuginfo-5.0.24-22.1 virtualbox-host-kmp-default-5.0.24_k4.1.26_21-22.1 virtualbox-host-kmp-default-debuginfo-5.0.24_k4.1.26_21-22.1 virtualbox-qt-5.0.24-22.1 virtualbox-qt-debuginfo-5.0.24-22.1 virtualbox-websrv-5.0.24-22.1 virtualbox-websrv-debuginfo-5.0.24-22.1 - openSUSE Leap 42.1 (noarch): virtualbox-guest-desktop-icons-5.0.24-22.1 virtualbox-host-source-5.0.24-22.1 References:

1 0

openSUSE-SU-2016:1779-1: moderate: Security update for glibc
by opensuse-security＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1779-1 Rating: moderate References: #967190 #968787 #969727 #973010 #973164 #975930 #980483 #980854 Cross-References: CVE-2016-1234 CVE-2016-3075 CVE-2016-3706 CVE-2016-4429 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has four fixes is now available. Description: This update for glibc provides the following fixes: - Increase DTV_SURPLUS limit. (bsc#968787) - Do not copy d_name field of struct dirent. (CVE-2016-1234, bsc#969727) - Fix memory leak in _nss_dns_gethostbyname4_r. (bsc#973010) - Fix stack overflow in _nss_dns_getnetbyname_r. (CVE-2016-3075, bsc#973164) - Fix malloc performance regression from SLE 11. (bsc#975930) - Fix getaddrinfo stack overflow in hostent conversion. (CVE-2016-3706, bsc#980483) - Do not use alloca in clntudp_call. (CVE-2016-4429, bsc#980854) - Remove mtrace.1, now included in the man-pages package. (bsc#967190) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-852=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 i686 x86_64): glibc-2.19-22.1 glibc-debuginfo-2.19-22.1 glibc-debugsource-2.19-22.1 glibc-devel-2.19-22.1 glibc-devel-debuginfo-2.19-22.1 glibc-devel-static-2.19-22.1 glibc-locale-2.19-22.1 glibc-locale-debuginfo-2.19-22.1 glibc-profile-2.19-22.1 - openSUSE Leap 42.1 (i586 x86_64): glibc-extra-2.19-22.1 glibc-extra-debuginfo-2.19-22.1 glibc-utils-2.19-22.1 glibc-utils-debuginfo-2.19-22.1 glibc-utils-debugsource-2.19-22.1 nscd-2.19-22.1 nscd-debuginfo-2.19-22.1 - openSUSE Leap 42.1 (noarch): glibc-html-2.19-22.1 glibc-i18ndata-2.19-22.1 glibc-info-2.19-22.1 - openSUSE Leap 42.1 (x86_64): glibc-32bit-2.19-22.1 glibc-debuginfo-32bit-2.19-22.1 glibc-devel-32bit-2.19-22.1 glibc-devel-debuginfo-32bit-2.19-22.1 glibc-devel-static-32bit-2.19-22.1 glibc-locale-32bit-2.19-22.1 glibc-locale-debuginfo-32bit-2.19-22.1 glibc-profile-32bit-2.19-22.1 glibc-utils-32bit-2.19-22.1 glibc-utils-debuginfo-32bit-2.19-22.1 - openSUSE Leap 42.1 (i586): glibc-obsolete-2.19-22.1 glibc-obsolete-debuginfo-2.19-22.1 References: https://www.suse.com/security/cve/CVE-2016-1234.html https://www.suse.com/security/cve/CVE-2016-3075.html https://www.suse.com/security/cve/CVE-2016-3706.html https://www.suse.com/security/cve/CVE-2016-4429.html https://bugzilla.suse.com/967190 https://bugzilla.suse.com/968787 https://bugzilla.suse.com/969727 https://bugzilla.suse.com/973010 https://bugzilla.suse.com/973164 https://bugzilla.suse.com/975930 https://bugzilla.suse.com/980483 https://bugzilla.suse.com/980854

1 0