July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1778-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1778-1 Rating: important References: #969894 #977333 #977375 #977376 #983549 #984126 #984637 #986162 Cross-References: CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1960 CVE-2016-1961 CVE-2016-1964 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 CVE-2016-2806 CVE-2016-2807 CVE-2016-2815 CVE-2016-2818 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update contains Mozilla Thunderbird 45.2. (boo#983549) It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail. The following vulnerabilities were fixed: - CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49) Contains the following security fixes from the 45.1 release: (boo#977333) - CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39) Contains the following security fixes from the 45.0 release: (boo#969894) - CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16) - CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17) - CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18) - CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19) - CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20) - CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23) - CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24) - CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27) - CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34) The graphite font shaping library was disabled, addressing the following font vulnerabilities: - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 The following tracked packaging changes are included: - fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637) - gcc6 fixes (boo#986162) - running on 48bit va aarch64 (boo#984126) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-851=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-851=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.2-16.1 MozillaThunderbird-buildsymbols-45.2-16.1 MozillaThunderbird-debuginfo-45.2-16.1 MozillaThunderbird-debugsource-45.2-16.1 MozillaThunderbird-devel-45.2-16.1 MozillaThunderbird-translations-common-45.2-16.1 MozillaThunderbird-translations-other-45.2-16.1 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-45.2-43.1 MozillaThunderbird-buildsymbols-45.2-43.1 MozillaThunderbird-debuginfo-45.2-43.1 MozillaThunderbird-debugsource-45.2-43.1 MozillaThunderbird-devel-45.2-43.1 MozillaThunderbird-translations-common-45.2-43.1 MozillaThunderbird-translations-other-45.2-43.1 References: https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://www.suse.com/security/cve/CVE-2016-2806.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://bugzilla.suse.com/969894 https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977375 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/984126 https://bugzilla.suse.com/984637 https://bugzilla.suse.com/986162

1 0

openSUSE-RU-2016:1777-1: Recommended update for cups
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for cups ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1777-1 Rating: low References: #968706 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups fixes the following issues: - Fix raw printing multiple files by adding the gziptoany filter. (bsc#968706) - Avoid warnings in error_log of the form "Unexpected 'document-name' operation attribute in a Create-Job request". This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-860=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cups-1.7.5-7.1 cups-client-1.7.5-7.1 cups-client-debuginfo-1.7.5-7.1 cups-ddk-1.7.5-7.1 cups-ddk-debuginfo-1.7.5-7.1 cups-debuginfo-1.7.5-7.1 cups-debugsource-1.7.5-7.1 cups-devel-1.7.5-7.1 cups-libs-1.7.5-7.1 cups-libs-debuginfo-1.7.5-7.1 - openSUSE Leap 42.1 (x86_64): cups-libs-32bit-1.7.5-7.1 cups-libs-debuginfo-32bit-1.7.5-7.1 References: https://bugzilla.suse.com/968706

1 0

openSUSE-RU-2016:1776-1: moderate: Recommended update for rsnapshot
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for rsnapshot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1776-1 Rating: moderate References: #987643 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rsnapshot fixes the following issues: - Fix double 8 bit shift bug introduced with 1.4.1. (boo#987643) - Add logrotate config and dependency for /var/log/rsnapshot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-856=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): rsnapshot-1.4.2-3.1 References: https://bugzilla.suse.com/987643

1 0

openSUSE-OU-2016:1775-1: Optional update for gnome-keysign, gstreamer-plugins-bad, zbar
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Optional Update: Optional update for gnome-keysign, gstreamer-plugins-bad, zbar ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1775-1 Rating: low References: #987287 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds gnome-keysign and zbar to openSUSE Leap 42.1 and enables the zbar element in gstreamer-plugins-bad. gnome-keysign: Its purpose is to ease signing other peoples' keys. It is similar to caff, PIUS, or monkeysign. In fact, it is influenced a lot by these tools and either reimplements ideas or reuses code. Consider either of the aboved mentioned tools when you need a much more mature codebase. zbar: ZBar is an open source software suite for reading bar codes from various sources, such as video streams, image files and raw intensity sensors. It supports many popular symbologies (types of bar codes) including EAN-13/UPC-A, UPC-E, EAN-8, Code 128, Code 39, Interleaved 2 of 5 and QR Code. The flexible, layered implementation facilitates bar code scanning and decoding for any application: use it stand-alone with the included GUI and command line programs, easily integrate a bar code scanning widget into your Qt, GTK+ or PyGTK GUI application, leverage one of the script or programming interfaces (Python, Perl, C++) ...all the way down to a streamlined C library suitable for embedded use. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-849=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gnome-keysign-0.5-2.1 gstreamer-plugins-bad-1.4.5-5.1 gstreamer-plugins-bad-debuginfo-1.4.5-5.1 gstreamer-plugins-bad-debugsource-1.4.5-5.1 gstreamer-plugins-bad-devel-1.4.5-5.1 gstreamer-plugins-bad-doc-1.4.5-5.1 libgstbadbase-1_0-0-1.4.5-5.1 libgstbadbase-1_0-0-debuginfo-1.4.5-5.1 libgstbadvideo-1_0-0-1.4.5-5.1 libgstbadvideo-1_0-0-debuginfo-1.4.5-5.1 libgstbasecamerabinsrc-1_0-0-1.4.5-5.1 libgstbasecamerabinsrc-1_0-0-debuginfo-1.4.5-5.1 libgstcodecparsers-1_0-0-1.4.5-5.1 libgstcodecparsers-1_0-0-debuginfo-1.4.5-5.1 libgstgl-1_0-0-1.4.5-5.1 libgstgl-1_0-0-debuginfo-1.4.5-5.1 libgstinsertbin-1_0-0-1.4.5-5.1 libgstinsertbin-1_0-0-debuginfo-1.4.5-5.1 libgstmpegts-1_0-0-1.4.5-5.1 libgstmpegts-1_0-0-debuginfo-1.4.5-5.1 libgstphotography-1_0-0-1.4.5-5.1 libgstphotography-1_0-0-debuginfo-1.4.5-5.1 libgsturidownloader-1_0-0-1.4.5-5.1 libgsturidownloader-1_0-0-debuginfo-1.4.5-5.1 libgstwayland-1_0-0-1.4.5-5.1 libgstwayland-1_0-0-debuginfo-1.4.5-5.1 libzbar-devel-0.10_2013_02_28-4.1 libzbar0-0.10_2013_02_28-4.1 libzbar0-debuginfo-0.10_2013_02_28-4.1 libzbargtk-devel-0.10_2013_02_28-4.1 libzbargtk0-0.10_2013_02_28-4.1 libzbargtk0-debuginfo-0.10_2013_02_28-4.1 libzbarqt-devel-0.10_2013_02_28-4.1 libzbarqt0-0.10_2013_02_28-4.1 libzbarqt0-debuginfo-0.10_2013_02_28-4.1 python-monkeysign-0.5-2.1 python-zbar-0.10_2013_02_28-4.1 python-zbar-debuginfo-0.10_2013_02_28-4.1 python-zbar-gtk-0.10_2013_02_28-4.1 python-zbar-gtk-debuginfo-0.10_2013_02_28-4.1 zbar-0.10_2013_02_28-4.1 zbar-debuginfo-0.10_2013_02_28-4.1 zbar-debugsource-0.10_2013_02_28-4.1 - openSUSE Leap 42.1 (noarch): gstreamer-plugins-bad-lang-1.4.5-5.1 - openSUSE Leap 42.1 (x86_64): gstreamer-plugins-bad-32bit-1.4.5-5.1 gstreamer-plugins-bad-debuginfo-32bit-1.4.5-5.1 libgstbadbase-1_0-0-32bit-1.4.5-5.1 libgstbadbase-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstbadvideo-1_0-0-32bit-1.4.5-5.1 libgstbadvideo-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstbasecamerabinsrc-1_0-0-32bit-1.4.5-5.1 libgstbasecamerabinsrc-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstcodecparsers-1_0-0-32bit-1.4.5-5.1 libgstcodecparsers-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstgl-1_0-0-32bit-1.4.5-5.1 libgstgl-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstinsertbin-1_0-0-32bit-1.4.5-5.1 libgstinsertbin-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstmpegts-1_0-0-32bit-1.4.5-5.1 libgstmpegts-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstphotography-1_0-0-32bit-1.4.5-5.1 libgstphotography-1_0-0-debuginfo-32bit-1.4.5-5.1 libgsturidownloader-1_0-0-32bit-1.4.5-5.1 libgsturidownloader-1_0-0-debuginfo-32bit-1.4.5-5.1 libgstwayland-1_0-0-32bit-1.4.5-5.1 libgstwayland-1_0-0-debuginfo-32bit-1.4.5-5.1 libzbar0-32bit-0.10_2013_02_28-4.1 libzbar0-debuginfo-32bit-0.10_2013_02_28-4.1 libzbargtk0-32bit-0.10_2013_02_28-4.1 libzbargtk0-debuginfo-32bit-0.10_2013_02_28-4.1 libzbarqt0-32bit-0.10_2013_02_28-4.1 libzbarqt0-debuginfo-32bit-0.10_2013_02_28-4.1 References: https://bugzilla.suse.com/987287

1 0

openSUSE-RU-2016:1774-1: moderate: Recommended update for libdlm
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for libdlm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1774-1 Rating: moderate References: #967332 #977201 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libdlm to version 4.0.4 includes the following changes: - Don't SIGKILL dlm_controld - Make systemd stop dlm on corosync restart - dlm_controld: don't log error from cpg_dispatch - Fix rejection of valid connections in dlm_controld - Make fail_time in dlm_stonith optional - Fix segmentation fault during status printing in libdlmcontrol - Add dlm_stonith man page - Output of dlm_tool ls should distinguish causes for wait fencing message. (bnc#977201) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-853=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libdlm-4.0.4-9.2 libdlm-debuginfo-4.0.4-9.2 libdlm-debugsource-4.0.4-9.2 libdlm-devel-4.0.4-9.2 libdlm3-4.0.4-9.2 libdlm3-debuginfo-4.0.4-9.2 References: https://bugzilla.suse.com/967332 https://bugzilla.suse.com/977201

1 0

openSUSE-RU-2016:1773-1: Recommended update for libcpuset
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for libcpuset ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1773-1 Rating: low References: #546310 #978841 #984832 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for libcpuset fixes the following issues: - Insufficient error handling in functions cpuset_pin(), cpuset_size() and cpuset_where() could lead to a segmentation fault when number of open files reached the limit. (bsc#978841) - Missing initialization of buffer that stores data read from /proc files. (bsc#984832, bsc#546310) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-859=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libcpuset-debugsource-1.0-34.1 libcpuset-devel-1.0-34.1 libcpuset1-1.0-34.1 libcpuset1-debuginfo-1.0-34.1 References: https://bugzilla.suse.com/546310 https://bugzilla.suse.com/978841 https://bugzilla.suse.com/984832

1 0

openSUSE-RU-2016:1772-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1772-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for spec-cleaner fixes the following issues: - Version update to 0.9.0: * Various small fixes * Support for tex/perl/cmake conversions: + bla-devel -> cmake(bla) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-850=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-850=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): spec-cleaner-0.9.0-20.1 spec-cleaner-format_spec_file-0.9.0-20.1 - openSUSE 13.2 (noarch): spec-cleaner-0.9.0-42.1 spec-cleaner-format_spec_file-0.9.0-42.1 References:

1 0

openSUSE-RU-2016:1771-1: moderate: Recommended update for haveged
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for haveged ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1771-1 Rating: moderate References: #958562 #959237 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for haveged fixes the following issues: - Remedy the potential for deadlocks when booting the system: journald reads from /dev/random, which receives entropy from haveged, which in turn logs to syslog before providing any. (bsc#959237) - Remove "After=systemd-random-seed.service" from systemd service file to avoid the potential for deadlocks when booting the system: systemd-random-seed needs /var to read its previous state; mounting /var needs journald; journald needs entropy; and entropy is provided by haveged, which needs systemd-random-seed. (bsc#959237) - Add missing dependency on coreutils for initrd macros. (bsc#958562) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-854=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): haveged-1.9.1-12.1 haveged-debuginfo-1.9.1-12.1 haveged-debugsource-1.9.1-12.1 haveged-devel-1.9.1-12.1 libhavege1-1.9.1-12.1 libhavege1-debuginfo-1.9.1-12.1 References: https://bugzilla.suse.com/958562 https://bugzilla.suse.com/959237

1 0

openSUSE-RU-2016:1770-1: moderate: Recommended update for openldap2
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1770-1 Rating: moderate References: #770009 #972331 #976172 #978408 #984691 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for openldap2 provides the following fixes: - Package previously missing schema files in LDIF format and fix a minor issue in schema2ldif script that led to missing attribute in the generated LDIF. (bsc#984691) - Enable non-blocking SSL/TLS handshakes. (fate#314570, bnc#770009, bsc#978408) - Fix an issue with transaction management that could cause server crash. (bsc#972331) - Remove outdated README.update file. (bsc#976172) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-858=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-libldap-2_3-0-2.3.37-14.1 compat-libldap-2_3-0-debuginfo-2.3.37-14.1 libldap-2_4-2-2.4.41-14.1 libldap-2_4-2-debuginfo-2.4.41-14.1 openldap2-2.4.41-14.1 openldap2-back-meta-2.4.41-14.1 openldap2-back-meta-debuginfo-2.4.41-14.1 openldap2-back-perl-2.4.41-14.1 openldap2-back-perl-debuginfo-2.4.41-14.1 openldap2-back-sql-2.4.41-14.1 openldap2-back-sql-debuginfo-2.4.41-14.1 openldap2-client-2.4.41-14.1 openldap2-client-debuginfo-2.4.41-14.1 openldap2-client-debugsource-2.4.41-14.1 openldap2-debuginfo-2.4.41-14.1 openldap2-debugsource-2.4.41-14.1 openldap2-devel-2.4.41-14.1 openldap2-devel-static-2.4.41-14.1 - openSUSE Leap 42.1 (noarch): openldap2-doc-2.4.41-14.1 - openSUSE Leap 42.1 (x86_64): libldap-2_4-2-32bit-2.4.41-14.1 libldap-2_4-2-debuginfo-32bit-2.4.41-14.1 openldap2-devel-32bit-2.4.41-14.1 References: https://bugzilla.suse.com/770009 https://bugzilla.suse.com/972331 https://bugzilla.suse.com/976172 https://bugzilla.suse.com/978408 https://bugzilla.suse.com/984691

1 0

openSUSE-SU-2016:1769-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1769-1 Rating: important References: #969894 #977333 #977375 #977376 #983549 #984126 #984637 #986162 Cross-References: CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1960 CVE-2016-1961 CVE-2016-1964 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 CVE-2016-2806 CVE-2016-2807 CVE-2016-2815 CVE-2016-2818 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update contains Mozilla Thunderbird 45.2. (boo#983549) It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail. The following vulnerabilities were fixed: - CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49) Contains the following security fixes from the 45.1 release: (boo#977333) - CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39) Contains the following security fixes from the 45.0 release: (boo#969894) - CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16) - CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17) - CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18) - CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19) - CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20) - CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23) - CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24) - CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27) - CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34) The graphite font shaping library was disabled, addressing the following font vulnerabilities: - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 The following tracked packaging changes are included: - fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637) - gcc6 fixes (boo#986162) - running on 48bit va aarch64 (boo#984126) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-851=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.2-6.1 MozillaThunderbird-debuginfo-45.2-6.1 MozillaThunderbird-debugsource-45.2-6.1 MozillaThunderbird-devel-45.2-6.1 MozillaThunderbird-translations-common-45.2-6.1 MozillaThunderbird-translations-other-45.2-6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.2-6.1 References: https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://www.suse.com/security/cve/CVE-2016-2806.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://bugzilla.suse.com/969894 https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977375 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/984126 https://bugzilla.suse.com/984637 https://bugzilla.suse.com/986162

1 0