November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:3110-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 27 Nov '17

27 Nov '17

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3110-1 Rating: moderate References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Mozilla Thunderbird fixes the following issues: Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 (boo#1068101): - CVE-2017-7828: Use-after-free of PressShell while restyling layout - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API - CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 The following bug fixes and improvements are included: - Better support for Charter/Spectrum IMAP - No longer mark other messages as read in search folders spanning multiple base folders - IMAP alerts have been corrected and now show the correct server name in case of connection problems - POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1311=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.5.0-48.1 MozillaThunderbird-buildsymbols-52.5.0-48.1 MozillaThunderbird-debuginfo-52.5.0-48.1 MozillaThunderbird-debugsource-52.5.0-48.1 MozillaThunderbird-devel-52.5.0-48.1 MozillaThunderbird-translations-common-52.5.0-48.1 MozillaThunderbird-translations-other-52.5.0-48.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101

1 0

openSUSE-FU-2017:3109-1: moderate: Feature update adding NetworkManager-l2tp
by maintenance＠opensuse.org 27 Nov '17

27 Nov '17

openSUSE Feature Update: Feature update adding NetworkManager-l2tp ______________________________________________________________________________ Announcement ID: openSUSE-FU-2017:3109-1 Rating: moderate References: #1067607 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This update adds NetworkManager-l2tp to the distribution. This package provides NetworkManager VPN support for L2TP and L2TP/IPsec (boo#1067607). Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1312=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): NetworkManager-l2tp-1.0.8-2.1 NetworkManager-l2tp-debuginfo-1.0.8-2.1 NetworkManager-l2tp-debugsource-1.0.8-2.1 NetworkManager-l2tp-gnome-1.0.8-2.1 NetworkManager-l2tp-gnome-debuginfo-1.0.8-2.1 - openSUSE Leap 42.3 (noarch): NetworkManager-l2tp-lang-1.0.8-2.1 References: https://bugzilla.suse.com/1067607

1 0

openSUSE-SU-2017:3108-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 27 Nov '17

27 Nov '17

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3108-1 Rating: moderate References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Mozilla Thunderbird fixes the following issues: Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 (boo#1068101): - CVE-2017-7828: Use-after-free of PressShell while restyling layout - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API - CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 The following bug fixes and improvements are included: - Better support for Charter/Spectrum IMAP - No longer mark other messages as read in search folders spanning multiple base folders - IMAP alerts have been corrected and now show the correct server name in case of connection problems - POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1311=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1311=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaThunderbird-52.5.0-50.1 MozillaThunderbird-buildsymbols-52.5.0-50.1 MozillaThunderbird-debuginfo-52.5.0-50.1 MozillaThunderbird-debugsource-52.5.0-50.1 MozillaThunderbird-devel-52.5.0-50.1 MozillaThunderbird-translations-common-52.5.0-50.1 MozillaThunderbird-translations-other-52.5.0-50.1 - openSUSE Leap 42.2 (x86_64): MozillaThunderbird-52.5.0-41.21.1 MozillaThunderbird-buildsymbols-52.5.0-41.21.1 MozillaThunderbird-debuginfo-52.5.0-41.21.1 MozillaThunderbird-debugsource-52.5.0-41.21.1 MozillaThunderbird-devel-52.5.0-41.21.1 MozillaThunderbird-translations-common-52.5.0-41.21.1 MozillaThunderbird-translations-other-52.5.0-41.21.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101

1 0

openSUSE-OU-2017:3105-1: Optional update adding xl2tpd to the SUSE PackageHub
by maintenance＠opensuse.org 27 Nov '17

27 Nov '17

openSUSE Optional Update: Optional update adding xl2tpd to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:3105-1 Rating: low References: #1067607 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds xl2tpd to the SUSE PackageHub. xl2tpd is a Layer 2 Tunnelling Protocol Daemon (RFC 2661). It is a run-time dependency for NetworkManager-l2tp (boo#1067607). Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1310=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): xl2tpd-1.3.6-2.1 xl2tpd-doc-1.3.6-2.1 References: https://bugzilla.suse.com/1067607

1 0

openSUSE-SU-2017:3101-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3101-1 Rating: moderate References: #1047178 #1057721 #1057724 #999735 Cross-References: CVE-2017-12837 CVE-2017-12883 CVE-2017-6512 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: Security issues fixed: - CVE-2017-12837: Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier. (bnc#1057724) - CVE-2017-12883: Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape. (bnc#1057721) - CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. (bnc#1047178) Bug fixes: - backport set_capture_string changes from upstream (bsc#999735) - reformat baselibs.conf as source validator workaround This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1304=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1304=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): perl-5.18.2-9.1 perl-base-5.18.2-9.1 perl-base-debuginfo-5.18.2-9.1 perl-debuginfo-5.18.2-9.1 perl-debugsource-5.18.2-9.1 - openSUSE Leap 42.3 (x86_64): perl-32bit-5.18.2-9.1 perl-base-32bit-5.18.2-9.1 perl-base-debuginfo-32bit-5.18.2-9.1 perl-debuginfo-32bit-5.18.2-9.1 - openSUSE Leap 42.3 (noarch): perl-doc-5.18.2-9.1 - openSUSE Leap 42.2 (i586 x86_64): perl-5.18.2-6.3.1 perl-base-5.18.2-6.3.1 perl-base-debuginfo-5.18.2-6.3.1 perl-debuginfo-5.18.2-6.3.1 perl-debugsource-5.18.2-6.3.1 - openSUSE Leap 42.2 (x86_64): perl-32bit-5.18.2-6.3.1 perl-base-32bit-5.18.2-6.3.1 perl-base-debuginfo-32bit-5.18.2-6.3.1 perl-debuginfo-32bit-5.18.2-6.3.1 - openSUSE Leap 42.2 (noarch): perl-doc-5.18.2-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-12837.html https://www.suse.com/security/cve/CVE-2017-12883.html https://www.suse.com/security/cve/CVE-2017-6512.html https://bugzilla.suse.com/1047178 https://bugzilla.suse.com/1057721 https://bugzilla.suse.com/1057724 https://bugzilla.suse.com/999735

1 0

openSUSE-SU-2017:3100-1: important: Security update for tboot
by opensuse-security＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Security Update: Security update for tboot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3100-1 Rating: important References: #1041264 #1067229 #1068390 #964408 #967441 #981948 Cross-References: CVE-2017-16837 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for tboot fixes the following issues: Security issues fixed: - CVE-2017-16837: Fix tbootfailed to validate a number of immutable function pointers, which could allow an attacker to bypass the chain of trust and execute arbitrary code (boo#1068390). - Make tboot package compatible with OpenSSL 1.1.0 for SLE-15 support (boo#1067229). Bug fixes: - Update to new upstream version. See release notes for details (1.9.6; 1.9.5, FATE#321510; 1.9.4, FATE#320665; 1.8.3, FATE#318542): * https://sourceforge.net/p/tboot/code/ci/default/tree/CHANGELOG - Fix some gcc7 warnings that lead to errors. (boo#1041264) - Fix wrong pvops kernel config matching (boo#981948) - Fix a excessive stack usage pattern that could lead to resets/crashes (boo#967441) - fixes a boot issue on Skylake (boo#964408) - Trim filler words from description; use modern macros over shell vars. - Add reproducible.patch to call gzip -n to make build fully reproducible. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1308=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1308=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): tboot-20170711_1.9.6-7.1 tboot-debuginfo-20170711_1.9.6-7.1 tboot-debugsource-20170711_1.9.6-7.1 - openSUSE Leap 42.2 (i586 x86_64): tboot-20170711_1.9.6-4.3.1 tboot-debuginfo-20170711_1.9.6-4.3.1 tboot-debugsource-20170711_1.9.6-4.3.1 References: https://www.suse.com/security/cve/CVE-2017-16837.html https://bugzilla.suse.com/1041264 https://bugzilla.suse.com/1067229 https://bugzilla.suse.com/1068390 https://bugzilla.suse.com/964408 https://bugzilla.suse.com/967441 https://bugzilla.suse.com/981948

1 0

openSUSE-SU-2017:3099-1: moderate: Security update for konversation
by opensuse-security＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Security Update: Security update for konversation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3099-1 Rating: moderate References: #1068097 Cross-References: CVE-2017-15923 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for konversation fixes the following issues: Security issue fixed: - CVE-2017-15923: Fixed a crash in parsing IRC color formatting codes (boo#1068097). Bug fixes: - Update to version 1.7.4: * Fixed a bug causing the size of a custom chat text view font set via the configuration dialog to be ignored. A font size modification done via the Enlarge/Decrease Font Size actions is now applied on top of the configured size (or the system default font size, respectively). - Update to 1.7.3: * Added a copy action to the context menu of nicknames in the chat text view. * Re-enabled channel mode buttons. * Reduced emission of Unicode directional control characters in the chat text view. Unnecessary control characters could sometimes cause problems with copying text from Konversation and pasting it into terminal applications, confusing them. * Fixed handling of nick and channel prefix characters potentially using the same set of symbols. * Removed redundant escaping of angle brackets in GECOS ("realname") field. * The nickname combobox will no longer change the nickname to the current value whenvever it loses focus. * Fixed color scheme handling in the treelist version on the tab bar, fixing an issue where the background and text color of the selected item would sometimes be the same, rendering the item unreadable. * Fixed handling of IRC URLs for channels starting with more than one #, addressing a percent-encoding problem with bookmarks of them. * Fixed custom chat text view font family reverting to system default font family upon using the increase/decrease font size actions. * Fixed chat text view font size adjusted via the increase/decrease font size actions reverting to configuration default when OK'ing the config dialog. * Fixed incorrect checkbox states in the Channel Invite dialog. * Fixed a crash in IRC v3 extended-join parsing. * Fixed a crash in parsing IRC color formatting codes. * Fixed a minor memory leak in the Join Channel dialog code. * Removed unnecessary nickname list debug message sent as warning. - Trim description from redundant phrasing, and ensure neutrality. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1306=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): konversation-1.7.4-3.1 konversation-debuginfo-1.7.4-3.1 konversation-debugsource-1.7.4-3.1 - openSUSE Leap 42.3 (noarch): konversation-lang-1.7.4-3.1 References: https://www.suse.com/security/cve/CVE-2017-15923.html https://bugzilla.suse.com/1068097

1 0

openSUSE-RU-2017:3098-1: important: Recommended update for libgcrypt
by maintenance＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Recommended Update: Recommended update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3098-1 Rating: important References: #1043333 #1059723 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libgcrypt provides the following fix: - Fix a regression in a previous update which caused libgcrypt to leak file descriptors causing failures when starting rtkit-daemon. (bsc#1059723) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1303=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1303=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libgcrypt-cavs-1.6.1-42.1 libgcrypt-cavs-debuginfo-1.6.1-42.1 libgcrypt-debugsource-1.6.1-42.1 libgcrypt-devel-1.6.1-42.1 libgcrypt-devel-debuginfo-1.6.1-42.1 libgcrypt20-1.6.1-42.1 libgcrypt20-debuginfo-1.6.1-42.1 libgcrypt20-hmac-1.6.1-42.1 - openSUSE Leap 42.3 (x86_64): libgcrypt-devel-32bit-1.6.1-42.1 libgcrypt-devel-debuginfo-32bit-1.6.1-42.1 libgcrypt20-32bit-1.6.1-42.1 libgcrypt20-debuginfo-32bit-1.6.1-42.1 libgcrypt20-hmac-32bit-1.6.1-42.1 - openSUSE Leap 42.2 (i586 x86_64): libgcrypt-cavs-1.6.1-34.12.1 libgcrypt-cavs-debuginfo-1.6.1-34.12.1 libgcrypt-debugsource-1.6.1-34.12.1 libgcrypt-devel-1.6.1-34.12.1 libgcrypt-devel-debuginfo-1.6.1-34.12.1 libgcrypt20-1.6.1-34.12.1 libgcrypt20-debuginfo-1.6.1-34.12.1 libgcrypt20-hmac-1.6.1-34.12.1 - openSUSE Leap 42.2 (x86_64): libgcrypt-devel-32bit-1.6.1-34.12.1 libgcrypt-devel-debuginfo-32bit-1.6.1-34.12.1 libgcrypt20-32bit-1.6.1-34.12.1 libgcrypt20-debuginfo-32bit-1.6.1-34.12.1 libgcrypt20-hmac-32bit-1.6.1-34.12.1 References: https://bugzilla.suse.com/1043333 https://bugzilla.suse.com/1059723

1 0

openSUSE-SU-2017:3097-1: moderate: Security update for konversation
by opensuse-security＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Security Update: Security update for konversation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3097-1 Rating: moderate References: #1068097 Cross-References: CVE-2017-15923 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for konversation fixes the following issues: Security issue fixed: - CVE-2017-15923: Fix a crash in parsing IRC color formatting codes (boo#1068097). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1305=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): konversation-1.6.2-2.3.1 konversation-debuginfo-1.6.2-2.3.1 konversation-debugsource-1.6.2-2.3.1 - openSUSE Leap 42.2 (noarch): konversation-lang-1.6.2-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-15923.html https://bugzilla.suse.com/1068097

1 0

openSUSE-SU-2017:3096-1: moderate: Security update for backintime
by opensuse-security＠opensuse.org 25 Nov '17

25 Nov '17

openSUSE Security Update: Security update for backintime ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3096-1 Rating: moderate References: #1067342 Cross-References: CVE-2017-16667 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for backintime fixes the following issues: Security issue fixed: - CVE-2017-16667: Fixed shell injection in notify-send (boo#1067342). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1309=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1309=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): backintime-1.1.20-6.1 backintime-lang-1.1.20-6.1 backintime-qt4-1.1.20-6.1 - openSUSE Leap 42.2 (noarch): backintime-1.1.20-3.6.1 backintime-lang-1.1.20-3.6.1 backintime-qt4-1.1.20-3.6.1 References: https://www.suse.com/security/cve/CVE-2017-16667.html https://bugzilla.suse.com/1067342

1 0