January 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0123-1: moderate: Security update for elfutils
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for elfutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0123-1 Rating: moderate References: #911662 Cross-References: CVE-2014-9447 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: elfutils was updated to fix a directory traversal vulnerability (bnc#911662 CVE-2014-9447) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-59 - openSUSE 13.1: zypper in -t patch openSUSE-2015-59 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): elfutils-0.158-4.5.1 elfutils-debuginfo-0.158-4.5.1 elfutils-debugsource-0.158-4.5.1 libasm-devel-0.158-4.5.1 libasm1-0.158-4.5.1 libasm1-debuginfo-0.158-4.5.1 libdw-devel-0.158-4.5.1 libdw1-0.158-4.5.1 libdw1-debuginfo-0.158-4.5.1 libebl-devel-0.158-4.5.1 libebl1-0.158-4.5.1 libebl1-debuginfo-0.158-4.5.1 libelf-devel-0.158-4.5.1 libelf1-0.158-4.5.1 libelf1-debuginfo-0.158-4.5.1 - openSUSE 13.2 (x86_64): libasm1-32bit-0.158-4.5.1 libasm1-debuginfo-32bit-0.158-4.5.1 libdw1-32bit-0.158-4.5.1 libdw1-debuginfo-32bit-0.158-4.5.1 libebl1-32bit-0.158-4.5.1 libebl1-debuginfo-32bit-0.158-4.5.1 libelf-devel-32bit-0.158-4.5.1 libelf1-32bit-0.158-4.5.1 libelf1-debuginfo-32bit-0.158-4.5.1 - openSUSE 13.1 (i586 x86_64): elfutils-0.155-6.8.1 elfutils-debuginfo-0.155-6.8.1 elfutils-debugsource-0.155-6.8.1 libasm-devel-0.155-6.8.1 libasm1-0.155-6.8.1 libasm1-debuginfo-0.155-6.8.1 libdw-devel-0.155-6.8.1 libdw1-0.155-6.8.1 libdw1-debuginfo-0.155-6.8.1 libebl-devel-0.155-6.8.1 libebl1-0.155-6.8.1 libebl1-debuginfo-0.155-6.8.1 libelf-devel-0.155-6.8.1 libelf1-0.155-6.8.1 libelf1-debuginfo-0.155-6.8.1 - openSUSE 13.1 (x86_64): libasm1-32bit-0.155-6.8.1 libasm1-debuginfo-32bit-0.155-6.8.1 libdw1-32bit-0.155-6.8.1 libdw1-debuginfo-32bit-0.155-6.8.1 libebl1-32bit-0.155-6.8.1 libebl1-debuginfo-32bit-0.155-6.8.1 libelf-devel-32bit-0.155-6.8.1 libelf1-32bit-0.155-6.8.1 libelf1-debuginfo-32bit-0.155-6.8.1 References: http://support.novell.com/security/cve/CVE-2014-9447.html https://bugzilla.suse.com/show_bug.cgi?id=911662

1 0

openSUSE-RU-2015:0122-1: moderate: recommended udpate for llvm
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: recommended udpate for llvm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0122-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended udpate for llvm fixes the following issue: - Conditionalize libcxx{abi} build on build_libcxx variable - Turn libc++.so into an ldscript so it links to libc++abi automatically. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-61 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libLLVM-3.5.0-7.1 libLLVM-debuginfo-3.5.0-7.1 libclang-3.5.0-7.1 libclang-debuginfo-3.5.0-7.1 llvm-3.5.0-7.1 llvm-clang-3.5.0-7.1 llvm-clang-debuginfo-3.5.0-7.1 llvm-clang-devel-3.5.0-7.1 llvm-debuginfo-3.5.0-7.1 llvm-debugsource-3.5.0-7.1 llvm-devel-3.5.0-7.1 llvm-devel-debuginfo-3.5.0-7.1 llvm-vim-plugins-3.5.0-7.1 python-clang-3.5.0-7.1 - openSUSE 13.2 (x86_64): libLLVM-32bit-3.5.0-7.1 libLLVM-debuginfo-32bit-3.5.0-7.1 libclang-32bit-3.5.0-7.1 libclang-debuginfo-32bit-3.5.0-7.1 lldb-3.5.0-7.1 lldb-debuginfo-3.5.0-7.1 lldb-devel-3.5.0-7.1 References:

1 0

openSUSE-RU-2015:0121-1: moderate: Recommended update for docker
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0121-1 Rating: moderate References: #913211 #913213 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for docker provides the following fixes: - Update from 1.4.0 to 1.4.1 + Runtime: * Fix issue with volumes-from and bind mounts not being honored after create (bnc#913213) + Added e2fsprogs as runtime dependency, this is required when the devicemapper driver is used. (bnc#913211). + Fixed owner and group for docker.socket Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-57 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): docker-1.4.1-17.1 docker-debuginfo-1.4.1-17.1 docker-debugsource-1.4.1-17.1 - openSUSE 13.2 (noarch): docker-bash-completion-1.4.1-17.1 docker-zsh-completion-1.4.1-17.1 References: https://bugzilla.suse.com/show_bug.cgi?id=913211 https://bugzilla.suse.com/show_bug.cgi?id=913213

1 0

openSUSE-RU-2015:0120-1: python-wxWidgets
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: python-wxWidgets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0120-1 Rating: low References: #907703 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for python-wxWidgets fixes the following issues: - bnc#907703: fixes plot library to make it compatible with a new version of NumPy. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-64 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-wxWidgets-2.8.12.1-10.4.1 python-wxWidgets-debuginfo-2.8.12.1-10.4.1 python-wxWidgets-debugsource-2.8.12.1-10.4.1 python-wxWidgets-devel-2.8.12.1-10.4.1 python-wxWidgets-lang-2.8.12.1-10.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=907703

1 0

openSUSE-RU-2015:0119-1: moderate: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0119-1 Rating: moderate References: #888534 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The system root SSL certificates were updated to match Mozilla NSS 2.2. Some removed/disabled 1024 bit certificates were temporarily reenabled/readded, as openssl and gnutls have a different handling of intermediates than mozilla nss and would otherwise not recognize SSL certificates from sites like Amazon. Updated to 2.2 (bnc#888534) - The following CAs were added: + COMODO_RSA_Certification_Authority codeSigning emailProtection serverAuth + GlobalSign_ECC_Root_CA_-_R4 codeSigning emailProtection serverAuth + GlobalSign_ECC_Root_CA_-_R5 codeSigning emailProtection serverAuth + USERTrust_ECC_Certification_Authority codeSigning emailProtection serverAuth + USERTrust_RSA_Certification_Authority codeSigning emailProtection serverAuth + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal - The following CAs were changed: + Equifax_Secure_eBusiness_CA_1 remote code signing and https trust, leave email trust + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2 only trust emailProtection - Updated to 2.1 (bnc#888534) - The following 1024-bit CA certificates were removed - Entrust.net Secure Server Certification Authority - ValiCert Class 1 Policy Validation Authority - ValiCert Class 2 Policy Validation Authority - ValiCert Class 3 Policy Validation Authority - TDC Internet Root CA - The following CA certificates were added: - Certification Authority of WoSign - CA 沃通根证书 - DigiCert Assured ID Root G2 - DigiCert Assured ID Root G3 - DigiCert Global Root G2 - DigiCert Global Root G3 - DigiCert Trusted Root G4 - QuoVadis Root CA 1 G3 - QuoVadis Root CA 2 G3 - QuoVadis Root CA 3 G3 - The Trust Bits were changed for the following CA certificates - Class 3 Public Primary Certification Authority - Class 3 Public Primary Certification Authority - Class 2 Public Primary Certification Authority - G2 - VeriSign Class 2 Public Primary Certification Authority - G3 - AC Raíz Certicámara S.A. - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado Temporary reenable some root ca trusts, as openssl/gnutls have trouble using intermediates as root CA. - GTE CyberTrust Global Root - Thawte Server CA - Thawte Premium Server CA - ValiCert Class 1 VA - ValiCert Class 2 VA - RSA Root Certificate 1 - Entrust.net Secure Server CA - America Online Root Certification Authority 1 - America Online Root Certification Authority 2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-56 - openSUSE 13.1: zypper in -t patch openSUSE-2015-56 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): ca-certificates-mozilla-2.2-3.4.1 - openSUSE 13.1 (noarch): ca-certificates-mozilla-2.2-3.17.1 References: https://bugzilla.suse.com/show_bug.cgi?id=888534

1 0

openSUSE-RU-2015:0118-1: libqt5-qtbase
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0118-1 Rating: low References: #870151 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for libqt5-qtbase fixes the following issues: - Added patch from upstream to fix Qt5 Apllication crashed in rendering when executing over ssh (qtbug#43623, boo#870151) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-60 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libQt5Bootstrap-devel-static-5.3.2-12.2 libQt5Concurrent-devel-5.3.2-12.2 libQt5Concurrent5-5.3.2-12.2 libQt5Concurrent5-debuginfo-5.3.2-12.2 libQt5Core-devel-5.3.2-12.2 libQt5Core5-5.3.2-12.2 libQt5Core5-debuginfo-5.3.2-12.2 libQt5DBus-devel-5.3.2-12.2 libQt5DBus-devel-debuginfo-5.3.2-12.2 libQt5DBus5-5.3.2-12.2 libQt5DBus5-debuginfo-5.3.2-12.2 libQt5Gui-devel-5.3.2-12.2 libQt5Gui5-5.3.2-12.2 libQt5Gui5-debuginfo-5.3.2-12.2 libQt5Network-devel-5.3.2-12.2 libQt5Network5-5.3.2-12.2 libQt5Network5-debuginfo-5.3.2-12.2 libQt5OpenGL-devel-5.3.2-12.2 libQt5OpenGL5-5.3.2-12.2 libQt5OpenGL5-debuginfo-5.3.2-12.2 libQt5OpenGLExtensions-devel-static-5.3.2-12.2 libQt5PlatformSupport-devel-static-5.3.2-12.2 libQt5PrintSupport-devel-5.3.2-12.2 libQt5PrintSupport5-5.3.2-12.2 libQt5PrintSupport5-debuginfo-5.3.2-12.2 libQt5Sql-devel-5.3.2-12.2 libQt5Sql5-5.3.2-12.2 libQt5Sql5-debuginfo-5.3.2-12.2 libQt5Sql5-mysql-5.3.2-12.2 libQt5Sql5-mysql-debuginfo-5.3.2-12.2 libQt5Sql5-postgresql-5.3.2-12.2 libQt5Sql5-postgresql-debuginfo-5.3.2-12.2 libQt5Sql5-sqlite-5.3.2-12.2 libQt5Sql5-sqlite-debuginfo-5.3.2-12.2 libQt5Sql5-unixODBC-5.3.2-12.2 libQt5Sql5-unixODBC-debuginfo-5.3.2-12.2 libQt5Test-devel-5.3.2-12.2 libQt5Test5-5.3.2-12.2 libQt5Test5-debuginfo-5.3.2-12.2 libQt5Widgets-devel-5.3.2-12.2 libQt5Widgets5-5.3.2-12.2 libQt5Widgets5-debuginfo-5.3.2-12.2 libQt5Xml-devel-5.3.2-12.2 libQt5Xml5-5.3.2-12.2 libQt5Xml5-debuginfo-5.3.2-12.2 libqt5-qtbase-common-devel-5.3.2-12.2 libqt5-qtbase-common-devel-debuginfo-5.3.2-12.2 libqt5-qtbase-debugsource-5.3.2-12.2 libqt5-qtbase-devel-5.3.2-12.2 libqt5-qtbase-doc-5.3.2-12.2 libqt5-qtbase-doc-debuginfo-5.3.2-12.2 libqt5-qtbase-examples-5.3.2-12.2 libqt5-qtbase-examples-debuginfo-5.3.2-12.2 - openSUSE 13.2 (x86_64): libQt5Bootstrap-devel-static-32bit-5.3.2-12.2 libQt5Concurrent-devel-32bit-5.3.2-12.2 libQt5Concurrent5-32bit-5.3.2-12.2 libQt5Concurrent5-debuginfo-32bit-5.3.2-12.2 libQt5Core-devel-32bit-5.3.2-12.2 libQt5Core5-32bit-5.3.2-12.2 libQt5Core5-debuginfo-32bit-5.3.2-12.2 libQt5DBus-devel-32bit-5.3.2-12.2 libQt5DBus-devel-debuginfo-32bit-5.3.2-12.2 libQt5DBus5-32bit-5.3.2-12.2 libQt5DBus5-debuginfo-32bit-5.3.2-12.2 libQt5Gui-devel-32bit-5.3.2-12.2 libQt5Gui5-32bit-5.3.2-12.2 libQt5Gui5-debuginfo-32bit-5.3.2-12.2 libQt5Network-devel-32bit-5.3.2-12.2 libQt5Network5-32bit-5.3.2-12.2 libQt5Network5-debuginfo-32bit-5.3.2-12.2 libQt5OpenGL-devel-32bit-5.3.2-12.2 libQt5OpenGL5-32bit-5.3.2-12.2 libQt5OpenGL5-debuginfo-32bit-5.3.2-12.2 libQt5OpenGLExtensions-devel-static-32bit-5.3.2-12.2 libQt5PlatformSupport-devel-static-32bit-5.3.2-12.2 libQt5PrintSupport-devel-32bit-5.3.2-12.2 libQt5PrintSupport5-32bit-5.3.2-12.2 libQt5PrintSupport5-debuginfo-32bit-5.3.2-12.2 libQt5Sql-devel-32bit-5.3.2-12.2 libQt5Sql5-32bit-5.3.2-12.2 libQt5Sql5-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-mysql-32bit-5.3.2-12.2 libQt5Sql5-mysql-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-postgresql-32bit-5.3.2-12.2 libQt5Sql5-postgresql-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-sqlite-32bit-5.3.2-12.2 libQt5Sql5-sqlite-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-unixODBC-32bit-5.3.2-12.2 libQt5Sql5-unixODBC-debuginfo-32bit-5.3.2-12.2 libQt5Test-devel-32bit-5.3.2-12.2 libQt5Test5-32bit-5.3.2-12.2 libQt5Test5-debuginfo-32bit-5.3.2-12.2 libQt5Widgets-devel-32bit-5.3.2-12.2 libQt5Widgets5-32bit-5.3.2-12.2 libQt5Widgets5-debuginfo-32bit-5.3.2-12.2 libQt5Xml-devel-32bit-5.3.2-12.2 libQt5Xml5-32bit-5.3.2-12.2 libQt5Xml5-debuginfo-32bit-5.3.2-12.2 libqt5-qtbase-examples-32bit-5.3.2-12.2 libqt5-qtbase-examples-debuginfo-32bit-5.3.2-12.2 - openSUSE 13.2 (noarch): libQt5Core-private-headers-devel-5.3.2-12.2 libQt5DBus-private-headers-devel-5.3.2-12.2 libQt5Gui-private-headers-devel-5.3.2-12.2 libQt5Network-private-headers-devel-5.3.2-12.2 libQt5OpenGL-private-headers-devel-5.3.2-12.2 libQt5PlatformSupport-private-headers-devel-5.3.2-12.2 libQt5PrintSupport-private-headers-devel-5.3.2-12.2 libQt5Sql-private-headers-devel-5.3.2-12.2 libQt5Test-private-headers-devel-5.3.2-12.2 libQt5Widgets-private-headers-devel-5.3.2-12.2 libqt5-qtbase-private-headers-devel-5.3.2-12.2 References: https://bugzilla.suse.com/show_bug.cgi?id=870151

1 0

openSUSE-SU-2015:0117-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0117-1 Rating: moderate References: #910988 Cross-References: CVE-2014-9324 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following issue: CVE-2014-9324: The GenericInterface in OTRS Help Desk access-control problems (bnc#910988) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-53 - openSUSE 13.1: zypper in -t patch openSUSE-2015-53 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): otrs-3.3.11-4.1 otrs-doc-3.3.11-4.1 otrs-itsm-3.3.11-4.1 - openSUSE 13.1 (noarch): otrs-3.2.17-31.13.1 otrs-doc-3.2.17-31.13.1 otrs-itsm-3.2.9-31.13.1 References: http://support.novell.com/security/cve/CVE-2014-9324.html https://bugzilla.suse.com/show_bug.cgi?id=910988

1 0

openSUSE-SU-2015:0116-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0116-1 Rating: moderate References: #913095 Cross-References: CVE-2014-9587 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: roundcubemail was updated to 1.0.4 fixing bugs and security issues. Changes: * Disable TinyMCE contextmenu plugin as there are more cons than pros in using it (#1490118) * Fix bug where show_real_foldernames setting wasn't honored on compose page (#1490153) * Fix issue where Archive folder wasn't protected in Folder Manager (#1490154) * Fix compatibility with PHP 5.2. in rcube_imap_generic (#1490115) * Fix setting flags on servers with no PERMANENTFLAGS response (#1490087) * Fix regression in SHAA password generation in ldap driver of password plugin (#1490094) * Fix displaying of HTML messages with absolutely positioned elements in Larry skin (#1490103) * Fix font style display issue in HTML messages with styled <span> elements (#1490101) * Fix download of attachments that are part of TNEF message (#1490091) * Fix handling of uuencoded messages if messages_cache is enabled (#1490108) * Fix handling of base64-encoded attachments with extra spaces (#1490111) * Fix handling of UNKNOWN-CTE response, try do decode content client-side (#1490046) * Fix bug where creating subfolders in shared folders wasn't possible without ACL extension (#1490113) * Fix reply scrolling issue with text mode and start message below the quote (#1490114) * Fix possible issues in skin/skin_path config handling (#1490125) * Fix lack of delimiter for recipient addresses in smtp_log (#1490150) * Fix generation of Blowfish-based password hashes (#1490184) * Fix bugs where CSRF attacks were still possible on some requests (CVE-2014-9587) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-58 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.4-4.1 References: http://support.novell.com/security/cve/CVE-2014-9587.html https://bugzilla.suse.com/show_bug.cgi?id=913095

1 0

openSUSE-RU-2015:0115-1: moderate: alpine-branding-openSUSE
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: alpine-branding-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0115-1 Rating: moderate References: #912611 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for alpine-branding-openSUSE fixes the following issue: - boo#912611: Disable IMAP-over-SSH by defualt Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-51 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): alpine-branding-openSUSE-0-2.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912611

1 0

openSUSE-SU-2015:0114-1: moderate: Security update for strongswan
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0114-1 Rating: moderate References: #897048 #897512 #910491 Cross-References: CVE-2014-9221 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update fixes the following security issues: - denial-of-service vulnerability, which can be triggered by an IKEv2 Key Exchange payload, that contains the Diffie-Hellman group 1025 (bsc#910491,CVE-2014-9221). - Applied an upstream patch reverting to store algorithms in the registration order again as ordering them by identifier caused weaker algorithms to be proposed first by default (bsc#897512). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-54 - openSUSE 13.1: zypper in -t patch openSUSE-2015-54 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): strongswan-5.1.3-4.4.1 strongswan-debugsource-5.1.3-4.4.1 strongswan-ipsec-5.1.3-4.4.1 strongswan-ipsec-debuginfo-5.1.3-4.4.1 strongswan-libs0-5.1.3-4.4.1 strongswan-libs0-debuginfo-5.1.3-4.4.1 strongswan-mysql-5.1.3-4.4.1 strongswan-mysql-debuginfo-5.1.3-4.4.1 strongswan-nm-5.1.3-4.4.1 strongswan-nm-debuginfo-5.1.3-4.4.1 strongswan-sqlite-5.1.3-4.4.1 strongswan-sqlite-debuginfo-5.1.3-4.4.1 - openSUSE 13.2 (noarch): strongswan-doc-5.1.3-4.4.1 - openSUSE 13.1 (i586 x86_64): strongswan-5.1.1-8.1 strongswan-debugsource-5.1.1-8.1 strongswan-ipsec-5.1.1-8.1 strongswan-ipsec-debuginfo-5.1.1-8.1 strongswan-libs0-5.1.1-8.1 strongswan-libs0-debuginfo-5.1.1-8.1 strongswan-mysql-5.1.1-8.1 strongswan-mysql-debuginfo-5.1.1-8.1 strongswan-nm-5.1.1-8.1 strongswan-nm-debuginfo-5.1.1-8.1 strongswan-sqlite-5.1.1-8.1 strongswan-sqlite-debuginfo-5.1.1-8.1 - openSUSE 13.1 (noarch): strongswan-doc-5.1.1-8.1 References: http://support.novell.com/security/cve/CVE-2014-9221.html https://bugzilla.suse.com/show_bug.cgi?id=897048 https://bugzilla.suse.com/show_bug.cgi?id=897512 https://bugzilla.suse.com/show_bug.cgi?id=910491

1 0

openSUSE-SU-2015:0113-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0113-1 Rating: moderate References: #912365 #912368 #912369 #912370 #912372 Cross-References: CVE-2015-0559 CVE-2015-0560 CVE-2015-0561 CVE-2015-0562 CVE-2015-0563 CVE-2015-0564 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update fixes the following security issues: + The WCCP dissector could crash wnpa-sec-2015-01 CVE-2015-0559 CVE-2015-0560 [boo#912365] + The LPP dissector could crash. wnpa-sec-2015-02 CVE-2015-0561 [boo#912368] + The DEC DNA Routing Protocol dissector could crash. wnpa-sec-2015-03 CVE-2015-0562 [boo#912369] + The SMTP dissector could crash. wnpa-sec-2015-04 CVE-2015-0563 [boo#912370] + Wireshark could crash while decypting TLS/SSL sessions. wnpa-sec-2015-05 CVE-2015-0564 [boo#912372] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-52 - openSUSE 13.1: zypper in -t patch openSUSE-2015-52 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wireshark-1.12.3-8.1 wireshark-debuginfo-1.12.3-8.1 wireshark-debugsource-1.12.3-8.1 wireshark-devel-1.12.3-8.1 wireshark-ui-gtk-1.12.3-8.1 wireshark-ui-gtk-debuginfo-1.12.3-8.1 wireshark-ui-qt-1.12.3-8.1 wireshark-ui-qt-debuginfo-1.12.3-8.1 - openSUSE 13.1 (i586 x86_64): wireshark-1.10.12-32.1 wireshark-debuginfo-1.10.12-32.1 wireshark-debugsource-1.10.12-32.1 wireshark-devel-1.10.12-32.1 References: http://support.novell.com/security/cve/CVE-2015-0559.html http://support.novell.com/security/cve/CVE-2015-0560.html http://support.novell.com/security/cve/CVE-2015-0561.html http://support.novell.com/security/cve/CVE-2015-0562.html http://support.novell.com/security/cve/CVE-2015-0563.html http://support.novell.com/security/cve/CVE-2015-0564.html https://bugzilla.suse.com/show_bug.cgi?id=912365 https://bugzilla.suse.com/show_bug.cgi?id=912368 https://bugzilla.suse.com/show_bug.cgi?id=912369 https://bugzilla.suse.com/show_bug.cgi?id=912370 https://bugzilla.suse.com/show_bug.cgi?id=912372

1 0

openSUSE-RU-2015:0112-1: moderate: Recommended update for spamassassin
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0112-1 Rating: moderate References: #911355 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for spamassassin fixes the following issue: - Run sa-update before starting service (bnc#911355) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-62 - openSUSE 13.1: zypper in -t patch openSUSE-2015-62 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): perl-Mail-SpamAssassin-3.4.0-44.4.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-44.4.1 spamassassin-3.4.0-44.4.1 spamassassin-debuginfo-3.4.0-44.4.1 spamassassin-debugsource-3.4.0-44.4.1 - openSUSE 13.1 (i586 x86_64): perl-Mail-SpamAssassin-3.3.2-37.8.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-37.8.1 spamassassin-3.3.2-37.8.1 spamassassin-debuginfo-3.3.2-37.8.1 spamassassin-debugsource-3.3.2-37.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911355

1 0

openSUSE-SU-2015:0111-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0111-1 Rating: moderate References: #912016 Cross-References: CVE-2012-3524 CVE-2014-8148 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues: * CVE-2014-8148: - Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment. * CVE-2012-3524: Don't access environment variables (bnc#912016) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-50 - openSUSE 13.1: zypper in -t patch openSUSE-2015-50 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dbus-1-1.8.14-12.2 dbus-1-debuginfo-1.8.14-12.2 dbus-1-debugsource-1.8.14-12.1 dbus-1-devel-1.8.14-12.1 dbus-1-x11-1.8.14-12.2 dbus-1-x11-debuginfo-1.8.14-12.2 dbus-1-x11-debugsource-1.8.14-12.2 libdbus-1-3-1.8.14-12.1 libdbus-1-3-debuginfo-1.8.14-12.1 - openSUSE 13.2 (x86_64): dbus-1-debuginfo-32bit-1.8.14-12.2 dbus-1-devel-32bit-1.8.14-12.1 libdbus-1-3-32bit-1.8.14-12.1 libdbus-1-3-debuginfo-32bit-1.8.14-12.1 - openSUSE 13.2 (noarch): dbus-1-devel-doc-1.8.14-12.2 - openSUSE 13.1 (i586 x86_64): dbus-1-1.8.14-4.32.3 dbus-1-debuginfo-1.8.14-4.32.3 dbus-1-debugsource-1.8.14-4.32.1 dbus-1-devel-1.8.14-4.32.1 dbus-1-x11-1.8.14-4.32.3 dbus-1-x11-debuginfo-1.8.14-4.32.3 dbus-1-x11-debugsource-1.8.14-4.32.3 libdbus-1-3-1.8.14-4.32.1 libdbus-1-3-debuginfo-1.8.14-4.32.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.8.14-4.32.3 dbus-1-devel-32bit-1.8.14-4.32.1 libdbus-1-3-32bit-1.8.14-4.32.1 libdbus-1-3-debuginfo-32bit-1.8.14-4.32.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.8.14-4.32.3 References: http://support.novell.com/security/cve/CVE-2012-3524.html http://support.novell.com/security/cve/CVE-2014-8148.html https://bugzilla.suse.com/show_bug.cgi?id=912016

1 0

openSUSE-SU-2015:0110-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0110-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-49 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-49 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.438-2.25.1 flash-player-gnome-11.2.202.438-2.25.1 flash-player-kde4-11.2.202.438-2.25.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.438-90.1 flash-player-gnome-11.2.202.438-90.1 flash-player-kde4-11.2.202.438-90.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333

1 0

openSUSE-RU-2015:0098-1: moderate: apache2
by maintenance＠opensuse.org 21 Jan '15

21 Jan '15

openSUSE Recommended Update: apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0098-1 Rating: moderate References: #859439 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for apache2 fixes the following issues: - boo#859439: Fixed service reload can cause log data to be lost with logrotate under some circumstances. Remove "-t" from service reload. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-47 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): apache2-2.4.10-12.1 apache2-debuginfo-2.4.10-12.1 apache2-debugsource-2.4.10-12.1 apache2-devel-2.4.10-12.1 apache2-event-2.4.10-12.1 apache2-event-debuginfo-2.4.10-12.1 apache2-example-pages-2.4.10-12.1 apache2-prefork-2.4.10-12.1 apache2-prefork-debuginfo-2.4.10-12.1 apache2-utils-2.4.10-12.1 apache2-utils-debuginfo-2.4.10-12.1 apache2-worker-2.4.10-12.1 apache2-worker-debuginfo-2.4.10-12.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-12.1 apache2-doc-2.4.10-8.1 - openSUSE 13.2 (i586): apache2-2.4.10-8.1 apache2-debuginfo-2.4.10-8.1 apache2-debugsource-2.4.10-8.1 apache2-devel-2.4.10-8.1 apache2-event-2.4.10-8.1 apache2-event-debuginfo-2.4.10-8.1 apache2-example-pages-2.4.10-8.1 apache2-prefork-2.4.10-8.1 apache2-prefork-debuginfo-2.4.10-8.1 apache2-utils-2.4.10-8.1 apache2-utils-debuginfo-2.4.10-8.1 apache2-worker-2.4.10-8.1 apache2-worker-debuginfo-2.4.10-8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=859439

1 0

openSUSE-RU-2015:0097-1: moderate: tigervnc
by maintenance＠opensuse.org 21 Jan '15

21 Jan '15

openSUSE Recommended Update: tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0097-1 Rating: moderate References: #911577 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This reommended update provides the current version 1.4.1 for tigervnc and 1.16.1 for X server with various fixes and improvements. - boo#911577: fixed unresolved symbol in libvnc - For a detailed changelog please see https://github.com/TigerVNC/tigervnc/releases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.18.1 tigervnc-debuginfo-1.4.1-6.18.1 tigervnc-debugsource-1.4.1-6.18.1 xorg-x11-Xvnc-1.4.1-6.18.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.18.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911577

1 0

openSUSE-RU-2015:0091-1: moderate: rpm
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: rpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0091-1 Rating: moderate References: #911228 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended udpate for rpm fixes the following issue: - boo#911228: fix noglob patch, which broke files with spaces Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-45 - openSUSE 13.1: zypper in -t patch openSUSE-2015-45 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python3-rpm-4.11.3-8.1 python3-rpm-debuginfo-4.11.3-8.1 python3-rpm-debugsource-4.11.3-8.1 rpm-4.11.3-8.1 rpm-build-4.11.3-8.1 rpm-build-debuginfo-4.11.3-8.1 rpm-debuginfo-4.11.3-8.1 rpm-debugsource-4.11.3-8.1 rpm-devel-4.11.3-8.1 rpm-python-4.11.3-8.1 rpm-python-debuginfo-4.11.3-8.1 rpm-python-debugsource-4.11.3-8.1 - openSUSE 13.2 (x86_64): rpm-32bit-4.11.3-8.1 rpm-debuginfo-32bit-4.11.3-8.1 - openSUSE 13.1 (i586 x86_64): python3-rpm-4.11.1-6.13.1 python3-rpm-debuginfo-4.11.1-6.13.1 python3-rpm-debugsource-4.11.1-6.13.1 rpm-4.11.1-6.13.1 rpm-build-4.11.1-6.13.1 rpm-build-debuginfo-4.11.1-6.13.1 rpm-debuginfo-4.11.1-6.13.1 rpm-debugsource-4.11.1-6.13.1 rpm-devel-4.11.1-6.13.1 rpm-python-4.11.1-6.13.1 rpm-python-debuginfo-4.11.1-6.13.1 rpm-python-debugsource-4.11.1-6.13.1 - openSUSE 13.1 (x86_64): rpm-32bit-4.11.1-6.13.1 rpm-debuginfo-32bit-4.11.1-6.13.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911228

1 0

openSUSE-RU-2015:0090-1: findutils
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: findutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0090-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for findutils fixes the following issues: - Add upstream patch to fix 'oldfind' which skipped all files starting with ".." (e.g. "..file"). - Add BuildRequires:dejagnu - otherwise only a very limited set of the tests was run by 'make check'. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): findutils-4.5.14-2.4.1 findutils-debuginfo-4.5.14-2.4.1 findutils-debugsource-4.5.14-2.4.1 - openSUSE 13.2 (noarch): findutils-lang-4.5.14-2.4.1 References:

1 0

openSUSE-RU-2015:0089-1: fonts-config
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: fonts-config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0089-1 Rating: low References: #912279 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for fonts-config fixes the following issues: - Run fonts-config whenever sysconfig variable is changed via yast sysconfig module. - bnc#912279: added Command "metadata" to relevant sysconfig variables Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-44 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): fonts-config-20140604-3.5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912279

1 0

openSUSE-RU-2015:0085-1: moderate: recommended softwarestack-update for openSUSE 13.2
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: recommended softwarestack-update for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0085-1 Rating: moderate References: #848054 #892431 #899510 #899781 #901590 #901691 #903675 #904737 #906549 #908135 #908345 #908976 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 12 recommended fixes can now be installed. Description: This recommended softwarestack-update for openSUSE fixes the following issues: - zypper: + Warn about repositories with 'gpgcheck=0' (bnc#848054) + search: fix --verbose implies --details + Enhance 'Digest verification failed' dialog (FATE#315008) + Summary: quote names including spaces (bnc#903675) + Provide missing man pages + Create man pages from asciidoc + Warn if legacy CLI options are used (bnc#899781) + Update translations - libzypp: + Adapt to gpg-2.1 (bnc#908135) + rpm: do not obsolete yast2-packagemanager-devel by libzypp-devel-doc + replaceAll: fix endless loop on empty search string + Do not provide/obsolete yast2-packagemanager-devel by the -doc package: the -devel package already does that. + Call rpm with '--noglob' (bnc#892431) + Downloader: unify workflow downloading a (signed) master index file + Fix iostream includes + Explicitly call libsolv:pool_setdisttype + doc: add hint to code 12 pattern packages + MediaCurl: Fix URL path concatenation (bnc#901590) + Move doxygen html doc to libzypp-devel-doc (bnc#901691) + Remove non-breaking spaces from changes file + Control lifetime of downloaded mirrorlist + Store baseurls in list as order expresses preference + Support parsing multiple baseurls from a repo file (bnc#899510) + Fix handling local mirrorlist= files in .repo (bnc#899510) + Provide missing man pages + Enable building autodocs, translations and test per default on debian + Fix several typos in output messages and comments + Make the include dir path configurable + Update translations - libzypp-bindings + Adapt to libzypp changes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-42 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): PackageKit-1.0.3-7.1 PackageKit-backend-zypp-1.0.3-7.1 PackageKit-backend-zypp-debuginfo-1.0.3-7.1 PackageKit-browser-plugin-1.0.3-7.1 PackageKit-browser-plugin-debuginfo-1.0.3-7.1 PackageKit-debuginfo-1.0.3-7.1 PackageKit-debugsource-1.0.3-7.1 PackageKit-devel-1.0.3-7.1 PackageKit-devel-debuginfo-1.0.3-7.1 PackageKit-gstreamer-plugin-1.0.3-7.1 PackageKit-gstreamer-plugin-debuginfo-1.0.3-7.1 PackageKit-gtk3-module-1.0.3-7.1 PackageKit-gtk3-module-debuginfo-1.0.3-7.1 libpackagekit-glib2-18-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-1.0.3-7.1 libpackagekit-glib2-devel-1.0.3-7.1 libyui-gtk-pkg-debugsource-2.43.2-2.3.2 libyui-gtk-pkg-devel-2.43.2-2.3.2 libyui-gtk-pkg6-2.43.2-2.3.2 libyui-gtk-pkg6-debuginfo-2.43.2-2.3.2 libyui-ncurses-pkg-debugsource-2.46.1-2.3.2 libyui-ncurses-pkg-devel-2.46.1-2.3.2 libyui-ncurses-pkg6-2.46.1-2.3.2 libyui-ncurses-pkg6-debuginfo-2.46.1-2.3.2 libyui-qt-pkg-debugsource-2.44.7-3.2 libyui-qt-pkg-devel-2.44.7-3.2 libyui-qt-pkg6-2.44.7-3.2 libyui-qt-pkg6-debuginfo-2.44.7-3.2 libzypp-14.32.0-5.3 libzypp-bindings-debugsource-0.6.4-6.1 libzypp-debuginfo-14.32.0-5.3 libzypp-debugsource-14.32.0-5.3 libzypp-devel-14.32.0-5.3 libzypp-devel-doc-14.32.0-5.3 perl-zypp-0.6.4-6.1 perl-zypp-debuginfo-0.6.4-6.1 python-zypp-0.6.4-6.1 python-zypp-debuginfo-0.6.4-6.1 ruby-zypp-0.6.4-6.1 ruby-zypp-debuginfo-0.6.4-6.1 typelib-1_0-PackageKitGlib-1_0-1.0.3-7.1 yast2-pkg-bindings-3.1.20-3.2 yast2-pkg-bindings-debuginfo-3.1.20-3.2 yast2-pkg-bindings-debugsource-3.1.20-3.2 zypper-1.11.17-5.1 zypper-debuginfo-1.11.17-5.1 zypper-debugsource-1.11.17-5.1 - openSUSE 13.2 (x86_64): libpackagekit-glib2-18-32bit-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-32bit-1.0.3-7.1 libpackagekit-glib2-devel-32bit-1.0.3-7.1 - openSUSE 13.2 (noarch): PackageKit-branding-openSUSE-13.2-2.4.1 PackageKit-branding-upstream-1.0.3-7.1 PackageKit-lang-1.0.3-7.1 libyui-gtk-pkg-doc-2.43.2-2.3.2 libyui-ncurses-pkg-doc-2.46.1-2.3.2 libyui-qt-pkg-doc-2.44.7-3.2 yast2-pkg-bindings-devel-doc-3.1.20-3.2 zypper-aptitude-1.11.17-5.1 zypper-log-1.11.17-5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=848054 https://bugzilla.suse.com/show_bug.cgi?id=892431 https://bugzilla.suse.com/show_bug.cgi?id=899510 https://bugzilla.suse.com/show_bug.cgi?id=899781 https://bugzilla.suse.com/show_bug.cgi?id=901590 https://bugzilla.suse.com/show_bug.cgi?id=901691 https://bugzilla.suse.com/show_bug.cgi?id=903675 https://bugzilla.suse.com/show_bug.cgi?id=904737 https://bugzilla.suse.com/show_bug.cgi?id=906549 https://bugzilla.suse.com/show_bug.cgi?id=908135 https://bugzilla.suse.com/show_bug.cgi?id=908345 https://bugzilla.suse.com/show_bug.cgi?id=908976

1 0

openSUSE-RU-2015:0081-1: moderate: Recommended update for polkit
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: Recommended update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0081-1 Rating: moderate References: #912889 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The polkit library was updated to fix a memory leak that was exposed by the KDE PowerDevil application. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-41 - openSUSE 13.1: zypper in -t patch openSUSE-2015-41 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpolkit0-0.112-3.5.1 libpolkit0-debuginfo-0.112-3.5.1 polkit-0.112-3.5.1 polkit-debuginfo-0.112-3.5.1 polkit-debugsource-0.112-3.5.1 polkit-devel-0.112-3.5.1 polkit-devel-debuginfo-0.112-3.5.1 typelib-1_0-Polkit-1_0-0.112-3.5.1 - openSUSE 13.2 (x86_64): libpolkit0-32bit-0.112-3.5.1 libpolkit0-debuginfo-32bit-0.112-3.5.1 - openSUSE 13.2 (noarch): polkit-doc-0.112-3.5.1 - openSUSE 13.1 (i586 x86_64): libpolkit0-0.112-6.1 libpolkit0-debuginfo-0.112-6.1 polkit-0.112-6.1 polkit-debuginfo-0.112-6.1 polkit-debugsource-0.112-6.1 polkit-devel-0.112-6.1 polkit-devel-debuginfo-0.112-6.1 typelib-1_0-Polkit-1_0-0.112-6.1 - openSUSE 13.1 (x86_64): libpolkit0-32bit-0.112-6.1 libpolkit0-debuginfo-32bit-0.112-6.1 - openSUSE 13.1 (noarch): polkit-doc-0.112-6.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912889

1 0

openSUSE-SU-2015:0077-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-2 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-35.0-9.1 MozillaFirefox-branding-upstream-35.0-9.1 MozillaFirefox-buildsymbols-35.0-9.1 MozillaFirefox-debuginfo-35.0-9.1 MozillaFirefox-debugsource-35.0-9.1 MozillaFirefox-devel-35.0-9.1 MozillaFirefox-translations-common-35.0-9.1 MozillaFirefox-translations-other-35.0-9.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0

openSUSE-SU-2015:0079-1: Security update for vsftpd
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0079-1 Rating: low References: #900326 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for vsftpd fixes the following security issue: - Fixed deny_file parsing to do more what is expected. bnc#900326 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-38 - openSUSE 13.1: zypper in -t patch openSUSE-2015-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): vsftpd-3.0.2-14.5.1 vsftpd-debuginfo-3.0.2-14.5.1 vsftpd-debugsource-3.0.2-14.5.1 - openSUSE 13.1 (i586 x86_64): vsftpd-3.0.2-10.8.1 vsftpd-debuginfo-3.0.2-10.8.1 vsftpd-debugsource-3.0.2-10.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900326

1 0

openSUSE-SU-2015:0078-1: moderate: Security Update for openstack-dashboard
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security Update for openstack-dashboard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0078-1 Rating: moderate References: #852175 #869696 #871855 #885588 #891815 #908199 Cross-References: CVE-2013-6858 CVE-2014-0157 CVE-2014-3473 CVE-2014-3474 CVE-2014-3475 CVE-2014-3594 CVE-2014-8124 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: OpenStack Dashboard was updated to fix bugs and security issues. Full changes: - Update to version horizon-2013.2.5.dev2.g9ee7273: * fix Horizon login page DOS attack (bnc#908199, CVE-2014-8124) * update version to 2013.2.5 * Updated from global requirements * Pin docutils to 0.9.1 * Set python hash seed to 0 in tox.ini * Check host is not none in each availability zone * Fix XSS issue with the unordered_list filter (bnc#891815, CVE-2014-3594) + 0001-Use-default_project_id-for-v3-users.patch (manually) * Replace UserManager with None in tests * Update test-requirements to fix sphinx build_doc * Fix multiple Cross-Site Scripting (XSS) vulnerabilities (bnc#885588, CVE-2014-3473, CVE-2014-3474, CVE-2014-3475) * Fix issues with importing the Login form Bug 869696 - Admin password injection on Horizon Dashboard is broken. - Update to version horizon-2013.2.4.dev8.g07c097f: * Bug fix on neutron's API to return the correct target ID * Fix display of images in Rebuild Instance * Get instance networking information from Neutron * Bump stable/havana next version to 2013.2.4 * Do not release FIP on disassociate action * Introduces escaping in Horizon/Orchestration 2013.2.3 (bnc#871855, CVE-2014-0157) - Update to version horizon-2013.2.3.dev8.g3d04c3c: * Reduce number of novaclient calls * Don't copy the flavorid when updating flavors * Allow snapshots of paused and suspended instances * Fixing tests to work with keystoneclient 0.6.0 * Bump stable/havana next version to 2013.2.3 + Use upstream URL as source (enables verification) + Import translations for Havana 2013.2.2 udpate - Update to version 2013.2.2.dev29.g96bd650: + Update Transifex resource name for havana + Fix inappropriate logouts on load-balanced Horizon - Update to version 2013.2.2.dev25.g6508afd: + disable volume creation, when cinder is disabled + Bad workflow-steps check: has_required_fields + Specify tenant_id when retrieving LBaaS/VPNaaS resource - Update to version 2013.2.2.dev19.g7a8eadc: + Give HealthMonitor a proper display name - Update to version 2013.2.2.dev17.gaa55b24: + Common keystone version fallback - Move settings.py (default settings) to branding-upstream subpackage: a branding package might want to change some default settings. - add 0001-Common-keystone-version-fallback.patch, 0001-Use-default_project_id-for-v3-users.patch - Update to version 2013.2.2.dev15.g2b6dfa7: + fix help text in "Create An image" window + Change how scrollShift is calculated + unify keypair name handling - Add 0001-Give-no-background-color-to-the-pie-charts.patch: do not give a background color to pie charts. - Update to version 2013.2.2.dev9.gc6d38a1: + Wrong marker sent to keystone - Update to version 2013.2.2.dev7.g2e11482: + Adding management_url to test mock client - add 0001-Bad-workflow-steps-check-has_required_fields.patch - Make python-horizon require the 2013.2 version of python-horizon-branding (and not the 2013.2.xyz version). This makes it easier to create non-upstream branding; we already do this for the other branding subpackage. - Update to version 2013.2.2.dev6.g2c1f1f3: + Add check for BlockDeviceMappingV2 nova extension + Gracefully handle Users with no email attribute + Import install_venv from oslo + Bump stable/havana next version to 2013.2.2 - Update to version 2013.2.1.dev41.g9668e80: + Updated from global requirements - put everything under /srv/www/openstack-dashboard - Update to version 2013.2.1.dev40.g852e5c8: + Import translations for Havana 2013.2.1 udpate + Deleting statistics tables from resource usage page + Allow "Working" in spinner to be translatable + lbaas/horizon - adds tcp protocol choice when create lb + Fix a bug some optional field in LBaaS are mandatory + Fix bug so that escaped html is not shown in volume detach dialog + Role name should not be translated in Domain Groups dialog + Fix incomplete translation of "Update members" widget + Fix translatable string for "Injected File Path Bytes" + Add extra extension file to makemessage command line + Add contextual markers to BatchAction messages + Logging user out after self password change + Add logging configuration for iso8601 module + Ensure all compute meters are listed in dropdown + Fix bug by escaping strings from Nova before displaying them (bnc#852175, CVE-2013-6858) - add/use generic openstack-branding provides - Update to version 2013.2.1.dev9.g842ba5f: + Fix default port of MS SQL in security group template + Provide missing hover hints for instance:<type> meters + translate text: "subnet"/"subnet details" + Change "Tenant" to "Project" + Avoid discarding precision of metering data - Use Django's signed_cookies session backend like upstream and drop the usage of cache_db - No need to set SECRET_KEY anymore, upstream learned it too python-django_openstack_auth was updated to 1.1.3: - Various i18n fixes - Revoke tokens when logging out or changing the tenant - Run tests locally, therefore merge test package back into main - Properly build HTML documentation and install it - Add pt_BR locale - Updated (build) requirements - Add django_openstack_auth-hacking-requires.patch: hacking dep is nonsense - include tests runner - add -test subpackage Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): openstack-dashboard-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-test-2013.2.5.dev2.g9ee7273-4.1 python-django_openstack_auth-1.1.3-4.1 python-horizon-2013.2.5.dev2.g9ee7273-4.1 python-horizon-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 References: http://support.novell.com/security/cve/CVE-2013-6858.html http://support.novell.com/security/cve/CVE-2014-0157.html http://support.novell.com/security/cve/CVE-2014-3473.html http://support.novell.com/security/cve/CVE-2014-3474.html http://support.novell.com/security/cve/CVE-2014-3475.html http://support.novell.com/security/cve/CVE-2014-3594.html http://support.novell.com/security/cve/CVE-2014-8124.html https://bugzilla.suse.com/show_bug.cgi?id=852175 https://bugzilla.suse.com/show_bug.cgi?id=869696 https://bugzilla.suse.com/show_bug.cgi?id=871855 https://bugzilla.suse.com/show_bug.cgi?id=885588 https://bugzilla.suse.com/show_bug.cgi?id=891815 https://bugzilla.suse.com/show_bug.cgi?id=908199

1 0

openSUSE-SU-2015:0077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-1 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-35.0-54.2 MozillaFirefox-branding-upstream-35.0-54.2 MozillaFirefox-buildsymbols-35.0-54.2 MozillaFirefox-debuginfo-35.0-54.2 MozillaFirefox-debugsource-35.0-54.2 MozillaFirefox-devel-35.0-54.2 MozillaFirefox-translations-common-35.0-54.2 MozillaFirefox-translations-other-35.0-54.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0