January 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0177-1: clamav
by maintenance＠opensuse.org 30 Jan '15

30 Jan '15

openSUSE Recommended Update: clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0177-1 Rating: low References: #908731 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for clamav fixes the following issues: - Restore the updateclamconf script (bnc#908731). - Fix a step backwards in the soname version from 0.98.4 to 0.98.5 (https://bugzilla.clamav.net/show_bug.cgi?id=11193) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-83 - openSUSE 13.1: zypper in -t patch openSUSE-2015-83 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.98.5-2.9.2 clamav-debuginfo-0.98.5-2.9.2 clamav-debugsource-0.98.5-2.9.2 - openSUSE 13.1 (i586 x86_64): clamav-0.98.5-26.2 clamav-debuginfo-0.98.5-26.2 clamav-debugsource-0.98.5-26.2 References: https://bugzilla.suse.com/show_bug.cgi?id=908731

1 0

openSUSE-RU-2015:0176-1: coreutils
by maintenance＠opensuse.org 30 Jan '15

30 Jan '15

openSUSE Recommended Update: coreutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0176-1 Rating: low References: #866010 #901905 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for coreutils fixes the following issues: - Add upstream patches for df(1) from upstream, thus aligning with SLES12: * df: improve mount point selection with inaccurate mount list: - coreutils-df-improve-mount-point-selection.patch * doc: mention that df -a includes duplicate file systems (deb#737399) - coreutils-df-doc-df-a-includes-duplicate-file-systems.patch * df: ensure -a shows all remote file system entries (deb#737399) - coreutils-df-show-all-remote-file-systems.patch * df: only suppress remote mounts of separate exports with --total (deb#737399, rh#920806, boo#866010, boo#901905) - coreutils-df-total-suppress-separate-remotes.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-82 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): coreutils-8.23-2.6.1 coreutils-debuginfo-8.23-2.6.1 coreutils-debugsource-8.23-2.6.1 coreutils-testsuite-8.23-2.6.2 - openSUSE 13.2 (noarch): coreutils-lang-8.23-2.6.1 References: https://bugzilla.suse.com/show_bug.cgi?id=866010 https://bugzilla.suse.com/show_bug.cgi?id=901905

1 0

openSUSE-SU-2015:0174-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 29 Jan '15

29 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0174-1 Rating: critical References: #856386 #913057 #914333 #914463 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 CVE-2015-0310 CVE-2015-0311 Affected Products: openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463): * APSA15-01, CVE-2015-0311 - Update of flashplayer (executable binary) for i386 is not available. This binary was disabled. - Security update to 11.2.202.438 (bsc#914333): * APSB15-02, CVE-2015-0310 - Security update to 11.2.202.429 (bsc#913057): * APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309. - Disable flash player on machines without SSE2 (bnc#856386). - Remove outdated README and keep only up-to-date readme.txt. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2015-81 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.440-2.115.1 flash-player-gnome-11.2.202.440-2.115.1 flash-player-kde4-11.2.202.440-2.115.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html http://support.novell.com/security/cve/CVE-2015-0310.html http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 https://bugzilla.suse.com/show_bug.cgi?id=914333 https://bugzilla.suse.com/show_bug.cgi?id=914463

1 0

openSUSE-SU-2015:0162-1: critical: glibc
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0162-1 Rating: critical References: #913646 Cross-References: 2015-0235 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-6 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): glibc-2.11.3-12.62.1 glibc-debuginfo-2.11.3-12.62.1 glibc-debugsource-2.11.3-12.62.1 glibc-devel-2.11.3-12.62.1 glibc-devel-debuginfo-2.11.3-12.62.1 glibc-html-2.11.3-12.62.1 glibc-i18ndata-2.11.3-12.62.1 glibc-info-2.11.3-12.62.1 glibc-locale-2.11.3-12.62.1 glibc-locale-debuginfo-2.11.3-12.62.1 glibc-obsolete-2.11.3-12.62.1 glibc-profile-2.11.3-12.62.1 nscd-2.11.3-12.62.1 nscd-debuginfo-2.11.3-12.62.1 - openSUSE Evergreen 11.4 (i586): glibc-obsolete-debuginfo-2.11.3-12.62.1 References: http://support.novell.com/security/cve/2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646

1 0

openSUSE-SU-2015:0161-1: important: Security update for libpng16
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0161-1 Rating: important References: #912076 #912929 Cross-References: CVE-2014-9495 CVE-2015-0973 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libpng was updated to fix some security issues: * CVE-2014-9495 [bnc#912076]: Heap-buffer overflow png_combine_row() with very wide interlaced images * CVE-2015-0973 [bnc#912929]: overflow in png_read_IDAT_data libpng is now also build with -DPNG_SAFE_LIMITS_SUPPORTED. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-79 - openSUSE 13.1: zypper in -t patch openSUSE-2015-79 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpng16-16-1.6.13-2.4.1 libpng16-16-debuginfo-1.6.13-2.4.1 libpng16-compat-devel-1.6.13-2.4.1 libpng16-debugsource-1.6.13-2.4.1 libpng16-devel-1.6.13-2.4.1 libpng16-tools-1.6.13-2.4.1 libpng16-tools-debuginfo-1.6.13-2.4.1 - openSUSE 13.2 (x86_64): libpng16-16-32bit-1.6.13-2.4.1 libpng16-16-debuginfo-32bit-1.6.13-2.4.1 libpng16-compat-devel-32bit-1.6.13-2.4.1 libpng16-devel-32bit-1.6.13-2.4.1 - openSUSE 13.1 (i586 x86_64): libpng16-16-1.6.6-16.1 libpng16-16-debuginfo-1.6.6-16.1 libpng16-compat-devel-1.6.6-16.1 libpng16-debugsource-1.6.6-16.1 libpng16-devel-1.6.6-16.1 libpng16-tools-1.6.6-16.1 libpng16-tools-debuginfo-1.6.6-16.1 - openSUSE 13.1 (x86_64): libpng16-16-32bit-1.6.6-16.1 libpng16-16-debuginfo-32bit-1.6.6-16.1 libpng16-compat-devel-32bit-1.6.6-16.1 libpng16-devel-32bit-1.6.6-16.1 References: http://support.novell.com/security/cve/CVE-2014-9495.html http://support.novell.com/security/cve/CVE-2015-0973.html https://bugzilla.suse.com/show_bug.cgi?id=912076 https://bugzilla.suse.com/show_bug.cgi?id=912929

1 0

openSUSE-SU-2015:0159-1: moderate: Security update for git
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0159-1 Rating: moderate References: #910756 Cross-References: CVE-2014-9390 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue: - CVE-2014-9390: arbitrary command execution vulnerability on case-insensitive file system ( bnc#910756) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-80 - openSUSE 13.1: zypper in -t patch openSUSE-2015-80 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): git-2.1.4-9.6 git-arch-2.1.4-9.6 git-core-2.1.4-9.6 git-core-debuginfo-2.1.4-9.6 git-cvs-2.1.4-9.6 git-daemon-2.1.4-9.6 git-daemon-debuginfo-2.1.4-9.6 git-debugsource-2.1.4-9.6 git-email-2.1.4-9.6 git-gui-2.1.4-9.6 git-svn-2.1.4-9.6 git-svn-debuginfo-2.1.4-9.6 git-web-2.1.4-9.6 gitk-2.1.4-9.6 - openSUSE 13.2 (noarch): git-doc-2.1.4-9.7 - openSUSE 13.2 (i586): git-2.1.4-9.7 git-arch-2.1.4-9.7 git-core-2.1.4-9.7 git-core-debuginfo-2.1.4-9.7 git-cvs-2.1.4-9.7 git-daemon-2.1.4-9.7 git-daemon-debuginfo-2.1.4-9.7 git-debugsource-2.1.4-9.7 git-email-2.1.4-9.7 git-gui-2.1.4-9.7 git-svn-2.1.4-9.7 git-svn-debuginfo-2.1.4-9.7 git-web-2.1.4-9.7 gitk-2.1.4-9.7 - openSUSE 13.1 (i586 x86_64): git-1.8.4.5-3.8.4 git-arch-1.8.4.5-3.8.4 git-core-1.8.4.5-3.8.4 git-core-debuginfo-1.8.4.5-3.8.4 git-cvs-1.8.4.5-3.8.4 git-daemon-1.8.4.5-3.8.4 git-daemon-debuginfo-1.8.4.5-3.8.4 git-debugsource-1.8.4.5-3.8.4 git-email-1.8.4.5-3.8.4 git-gui-1.8.4.5-3.8.4 git-remote-helpers-1.8.4.5-3.8.4 git-svn-1.8.4.5-3.8.4 git-svn-debuginfo-1.8.4.5-3.8.4 git-web-1.8.4.5-3.8.4 gitk-1.8.4.5-3.8.4 References: http://support.novell.com/security/cve/CVE-2014-9390.html https://bugzilla.suse.com/show_bug.cgi?id=910756

1 0

openSUSE-SU-2015:0150-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0150-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found on https://helpx.adobe.com/security/products/flash-player/apsa15-01.html An update of flashplayer (executable binary) for i386 is currently not available. Disabled! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-78 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-78 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.440-2.29.1 flash-player-gnome-11.2.202.440-2.29.1 flash-player-kde4-11.2.202.440-2.29.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.440-94.1 flash-player-gnome-11.2.202.440-94.1 flash-player-kde4-11.2.202.440-94.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463

1 0

openSUSE-RU-2015:0149-1: subversion
by maintenance＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Recommended Update: subversion ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0149-1 Rating: low References: #911620 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for subversion fixes the following issues: - fixes sysconfig file generation (bnc#911620) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-77 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.11-2.11.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.11-2.11.1 libsvn_auth_kwallet-1-0-1.8.11-2.11.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.11-2.11.1 subversion-1.8.11-2.11.1 subversion-debuginfo-1.8.11-2.11.1 subversion-debugsource-1.8.11-2.11.1 subversion-devel-1.8.11-2.11.1 subversion-perl-1.8.11-2.11.1 subversion-perl-debuginfo-1.8.11-2.11.1 subversion-python-1.8.11-2.11.1 subversion-python-ctypes-1.8.11-2.11.1 subversion-python-debuginfo-1.8.11-2.11.1 subversion-ruby-1.8.11-2.11.1 subversion-ruby-debuginfo-1.8.11-2.11.1 subversion-server-1.8.11-2.11.1 subversion-server-debuginfo-1.8.11-2.11.1 subversion-tools-1.8.11-2.11.1 subversion-tools-debuginfo-1.8.11-2.11.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.11-2.11.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911620

1 0

openSUSE-SU-2015:0147-1: critical: update for Flash player
by opensuse-security＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Security Update: update for Flash player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0147-1 Rating: critical References: Cross-References: 2015-0310 2015-0311 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Flash player fixes known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-5 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.440-143.1 flash-player-gnome-11.2.202.440-143.1 flash-player-kde4-11.2.202.440-143.1 References: http://support.novell.com/security/cve/2015-0310.html http://support.novell.com/security/cve/2015-0311.html

1 0

openSUSE-RU-2015:0143-1: xdm
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0143-1 Rating: low References: #897803 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xdm fixes the following issues: - part of solution of bnc#897803 * modify /etc/X11/xdm/keytable to don't truncate too much *.map.gz names with dot. * rpm post script: * move away /etc/X11/xorg.conf.d/00-keyboard.conf * run /etc/X11/xdm/keytable Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-76 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xdm-1.1.11-3.8.1 xdm-debuginfo-1.1.11-3.8.1 xdm-debugsource-1.1.11-3.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=897803

1 0