March 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0534-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 19 Mar '15

19 Mar '15

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0534-1 Rating: moderate References: #921070 Cross-References: CVE-2015-1782 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libssh2_org was updated to version 1.5.0 to fix bugs and a security issue. Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: - Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 - missing _libssh2_error in _libssh2_channel_write - knownhost: Fix DSS keys being detected as unknown. - knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. - libssh2.h: on Windows, a socket is of type SOCKET, not int - libssh2_priv.h: a 1 bit bit-field should be unsigned - windows build: do not export externals from static library - Fixed two potential use-after-frees of the payload buffer - Fixed a few memory leaks in error paths - userauth: Fixed an attempt to free from stack on error - agent_list_identities: Fixed memory leak on OOM - knownhosts: Abort if the hosts buffer is too small - sftp_close_handle: ensure the handle is always closed - channel_close: Close the channel even in the case of errors - docs: added missing libssh2_session_handshake.3 file - docs: fixed a bunch of typos - userauth_password: pass on the underlying error code - _libssh2_channel_forward_cancel: accessed struct after free - _libssh2_packet_add: avoid using uninitialized memory - _libssh2_channel_forward_cancel: avoid memory leaks on error - _libssh2_channel_write: client spins on write when window full - windows build: fix build errors - publickey_packet_receive: avoid junk in returned pointers - channel_receive_window_adjust: store windows size always - userauth_hostbased_fromfile: zero assign to avoid uninitialized use - configure: change LIBS not LDFLAGS when checking for libs - agent_connect_unix: make sure there's a trailing zero - MinGW build: Fixed redefine warnings. - sftpdir.c: added authentication method detection. - Watcom build: added support for WinCNG build. - configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS - sftp_statvfs: fix for servers not supporting statfvs extension - knownhost.c: use LIBSSH2_FREE macro instead of free - Fixed compilation using mingw-w64 - knownhost.c: fixed that 'key_type_len' may be used uninitialized - configure: Display individual crypto backends on separate lines - examples on Windows: check for WSAStartup return code - examples on Windows: check for socket return code - agent.c: check return code of MapViewOfFile - kex.c: fix possible NULL pointer de-reference with session->kex - packet.c: fix possible NULL pointer de-reference within listen_state - tests on Windows: check for WSAStartup return code - userauth.c: improve readability and clarity of for-loops - examples on Windows: use native SOCKET-type instead of int - packet.c: i < 256 was always true and i would overflow to 0 - kex.c: make sure mlist is not set to NULL - session.c: check return value of session_nonblock in debug mode - session.c: check return value of session_nonblock during startup - userauth.c: make sure that sp_len is positive and avoid overflows - knownhost.c: fix use of uninitialized argument variable wrote - openssl: initialise the digest context before calling EVP_DigestInit() - libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET - configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib - configure.ac: Rework crypto library detection - configure.ac: Reorder --with-* options in --help output - configure.ac: Call zlib zlib and not libz in text but keep option names - Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro - sftp: seek: Don't flush buffers on same offset - sftp: statvfs: Along error path, reset the correct 'state' variable. - sftp: Add support for fsync (OpenSSH extension). - _libssh2_channel_read: fix data drop when out of window - comp_method_zlib_decomp: Improve buffer growing algorithm - _libssh2_channel_read: Honour window_size_initial - window_size: redid window handling for flow control reasons - knownhosts: handle unknown key types Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-242=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-242=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libssh2-1-1.5.0-9.4.1 libssh2-1-debuginfo-1.5.0-9.4.1 libssh2-devel-1.5.0-9.4.1 libssh2_org-debugsource-1.5.0-9.4.1 - openSUSE 13.2 (x86_64): libssh2-1-32bit-1.5.0-9.4.1 libssh2-1-debuginfo-32bit-1.5.0-9.4.1 - openSUSE 13.1 (i586 x86_64): libssh2-1-1.5.0-7.4.1 libssh2-1-debuginfo-1.5.0-7.4.1 libssh2-devel-1.5.0-7.4.1 libssh2_org-debugsource-1.5.0-7.4.1 - openSUSE 13.1 (x86_64): libssh2-1-32bit-1.5.0-7.4.1 libssh2-1-debuginfo-32bit-1.5.0-7.4.1 References: http://support.novell.com/security/cve/CVE-2015-1782.html https://bugzilla.suse.com/921070

1 0

openSUSE-SU-2015:0528-1: moderate: Security update for glusterfs
by opensuse-security＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Security Update: Security update for glusterfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0528-1 Rating: moderate References: #919879 Cross-References: CVE-2014-3619 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-241=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): glusterfs-3.5.2-2.4.1 glusterfs-debuginfo-3.5.2-2.4.1 glusterfs-debugsource-3.5.2-2.4.1 glusterfs-devel-3.5.2-2.4.1 libgfapi0-3.5.2-2.4.1 libgfapi0-debuginfo-3.5.2-2.4.1 libgfchangelog0-3.5.2-2.4.1 libgfchangelog0-debuginfo-3.5.2-2.4.1 libgfrpc0-3.5.2-2.4.1 libgfrpc0-debuginfo-3.5.2-2.4.1 libgfxdr0-3.5.2-2.4.1 libgfxdr0-debuginfo-3.5.2-2.4.1 libglusterfs0-3.5.2-2.4.1 libglusterfs0-debuginfo-3.5.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-3619.html https://bugzilla.suse.com/919879

1 0

openSUSE-SU-2015:0527-1: moderate: Security update for gdm
by opensuse-security＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Security Update: Security update for gdm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0527-1 Rating: moderate References: #900836 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The GNOME Display Manager was updated to fix one security issue: - Removed gdm-fingerprint and gdm-smartcard pamfiles that allowed unlocking the screen without password or fingerprint if fingerprint reader support was enabled. (boo#900836). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-240=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gdm-3.14.1-4.1 gdm-debuginfo-3.14.1-4.1 gdm-debugsource-3.14.1-4.1 gdm-devel-3.14.1-4.1 libgdm1-3.14.1-4.1 libgdm1-debuginfo-3.14.1-4.1 typelib-1_0-Gdm-1_0-3.14.1-4.1 - openSUSE 13.2 (noarch): gdm-branding-upstream-3.14.1-4.1 gdm-lang-3.14.1-4.1 gdmflexiserver-3.14.1-4.1 References: https://bugzilla.suse.com/900836

1 0

openSUSE-SU-2015:0522-1: moderate: Security update for vorbis-tools
by opensuse-security＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Security Update: Security update for vorbis-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0522-1 Rating: moderate References: #914439 #914441 Cross-References: CVE-2014-9638 CVE-2014-9639 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: vorbis-tools was updated to fix division by zero and integer overflow by crafted WAV files (CVE-2014-9638, CVE-2014-9639, bnc#914439, bnc#914441). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-239=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): vorbis-tools-1.4.0-17.8.1 vorbis-tools-debuginfo-1.4.0-17.8.1 vorbis-tools-debugsource-1.4.0-17.8.1 - openSUSE 13.2 (noarch): vorbis-tools-lang-1.4.0-17.8.1 - openSUSE 13.1 (i586 x86_64): vorbis-tools-1.4.0-14.16.1 vorbis-tools-debuginfo-1.4.0-14.16.1 vorbis-tools-debugsource-1.4.0-14.16.1 - openSUSE 13.1 (noarch): vorbis-tools-lang-1.4.0-14.16.1 References: http://support.novell.com/security/cve/CVE-2014-9638.html http://support.novell.com/security/cve/CVE-2014-9639.html https://bugzilla.suse.com/914439 https://bugzilla.suse.com/914441

1 0

openSUSE-RU-2015:0521-1: moderate: Recommended update for ntp
by maintenance＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Recommended Update: Recommended update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0521-1 Rating: moderate References: #901751 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for ntp fixes the following issue: - Explicitely run /usr/sbin/sntp to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. (boo#901751) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-235=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ntp-4.2.6p5-25.9.1 ntp-debuginfo-4.2.6p5-25.9.1 ntp-debugsource-4.2.6p5-25.9.1 ntp-doc-4.2.6p5-25.9.1 References: https://bugzilla.suse.com/901751

1 0

openSUSE-RU-2015:0520-1: moderate: Recommended update for libass
by maintenance＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Recommended Update: Recommended update for libass ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0520-1 Rating: moderate References: #921212 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for libass fixes the following issues: - Update from version 0.10.2 to 0.12.1 (boo#921212) + Make ASS drawings with an extremely high number of control points work. This change increases compatibility with VSFilter. + Bugfixes * Fix a crash when using newer harfbuzz versions * Load embedded memory fonts correctly * Large shadow offsets rendered incorrectly * Fix incorrect closing of last drawing contour * Fix issues with undefined behavior in shifts * Lots of of malloc() error checking Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libass-debugsource-0.12.1-2.5.1 libass-devel-0.12.1-2.5.1 libass5-0.12.1-2.5.1 libass5-debuginfo-0.12.1-2.5.1 - openSUSE 13.2 (x86_64): libass5-32bit-0.12.1-2.5.1 libass5-debuginfo-32bit-0.12.1-2.5.1 References: https://bugzilla.suse.com/921212

1 0

openSUSE-RU-2015:0519-1: moderate: Recommended update for facter
by maintenance＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Recommended Update: Recommended update for facter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0519-1 Rating: moderate References: #920446 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for facter fixes the following issue: - Provide 'operatingsystemmajversion' variable which is needed by several puppet modules. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-238=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-238=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): facter-2.0.2-2.9.1 - openSUSE 13.1 (i586 x86_64): facter-1.7.2-2.4.1 References: https://bugzilla.suse.com/920446

1 0

openSUSE-RU-2015:0518-1: moderate: Recommended update for sudo
by maintenance＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Recommended Update: Recommended update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0518-1 Rating: moderate References: #899252 #911298 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended udpate for sudo fixes the following issue: - correctly parse /proc/stat for boottime (bnc#899252) - fix a typo in german translation (bnc#911298) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-236=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-236=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): sudo-1.8.10p3-2.4.1 sudo-debuginfo-1.8.10p3-2.4.1 sudo-debugsource-1.8.10p3-2.4.1 sudo-devel-1.8.10p3-2.4.1 sudo-test-1.8.10p3-2.4.1 - openSUSE 13.1 (i586 x86_64): sudo-1.8.10p3-5.13.1 sudo-debuginfo-1.8.10p3-5.13.1 sudo-debugsource-1.8.10p3-5.13.1 sudo-devel-1.8.10p3-5.13.1 References: https://bugzilla.suse.com/899252 https://bugzilla.suse.com/911298

1 0

openSUSE-RU-2015:0517-1: moderate: Recommended update for kde4-print-manager
by maintenance＠opensuse.org 18 Mar '15

18 Mar '15

openSUSE Recommended Update: Recommended update for kde4-print-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0517-1 Rating: moderate References: #889187 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended udpate for kde4-print-manager fixes the following issue: - do not make the configure printer dialog modal as that prevents the password dialog window from getting focus, i.e. you cannot enter the password necessary for saving the changes (kde#328014, boo#889187) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kde4-print-manager-4.11.5-128.1 kde4-print-manager-debuginfo-4.11.5-128.1 kde4-print-manager-debugsource-4.11.5-128.1 References: https://bugzilla.suse.com/889187

1 0

openSUSE-RU-2015:0511-1: moderate: Recommended update for mariadb
by maintenance＠opensuse.org 17 Mar '15

17 Mar '15

openSUSE Recommended Update: Recommended update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0511-1 Rating: moderate References: #921955 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for mariadb fixes the build for ppc. (boo#921955) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysqlclient-devel-10.0.13-2.6.1 libmysqlclient18-10.0.13-2.6.1 libmysqlclient18-debuginfo-10.0.13-2.6.1 libmysqlclient_r18-10.0.13-2.6.1 libmysqld-devel-10.0.13-2.6.1 libmysqld18-10.0.13-2.6.1 libmysqld18-debuginfo-10.0.13-2.6.1 mariadb-10.0.13-2.6.1 mariadb-bench-10.0.13-2.6.1 mariadb-bench-debuginfo-10.0.13-2.6.1 mariadb-client-10.0.13-2.6.1 mariadb-client-debuginfo-10.0.13-2.6.1 mariadb-debug-version-10.0.13-2.6.1 mariadb-debug-version-debuginfo-10.0.13-2.6.1 mariadb-debuginfo-10.0.13-2.6.1 mariadb-debugsource-10.0.13-2.6.1 mariadb-errormessages-10.0.13-2.6.1 mariadb-test-10.0.13-2.6.1 mariadb-test-debuginfo-10.0.13-2.6.1 mariadb-tools-10.0.13-2.6.1 mariadb-tools-debuginfo-10.0.13-2.6.1 - openSUSE 13.2 (x86_64): libmysqlclient18-32bit-10.0.13-2.6.1 libmysqlclient18-debuginfo-32bit-10.0.13-2.6.1 libmysqlclient_r18-32bit-10.0.13-2.6.1 References: https://bugzilla.suse.com/921955

1 0