January 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0177-1: clamav
by maintenance＠opensuse.org 30 Jan '15

30 Jan '15

openSUSE Recommended Update: clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0177-1 Rating: low References: #908731 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for clamav fixes the following issues: - Restore the updateclamconf script (bnc#908731). - Fix a step backwards in the soname version from 0.98.4 to 0.98.5 (https://bugzilla.clamav.net/show_bug.cgi?id=11193) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-83 - openSUSE 13.1: zypper in -t patch openSUSE-2015-83 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.98.5-2.9.2 clamav-debuginfo-0.98.5-2.9.2 clamav-debugsource-0.98.5-2.9.2 - openSUSE 13.1 (i586 x86_64): clamav-0.98.5-26.2 clamav-debuginfo-0.98.5-26.2 clamav-debugsource-0.98.5-26.2 References: https://bugzilla.suse.com/show_bug.cgi?id=908731

1 0

openSUSE-RU-2015:0176-1: coreutils
by maintenance＠opensuse.org 30 Jan '15

30 Jan '15

openSUSE Recommended Update: coreutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0176-1 Rating: low References: #866010 #901905 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for coreutils fixes the following issues: - Add upstream patches for df(1) from upstream, thus aligning with SLES12: * df: improve mount point selection with inaccurate mount list: - coreutils-df-improve-mount-point-selection.patch * doc: mention that df -a includes duplicate file systems (deb#737399) - coreutils-df-doc-df-a-includes-duplicate-file-systems.patch * df: ensure -a shows all remote file system entries (deb#737399) - coreutils-df-show-all-remote-file-systems.patch * df: only suppress remote mounts of separate exports with --total (deb#737399, rh#920806, boo#866010, boo#901905) - coreutils-df-total-suppress-separate-remotes.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-82 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): coreutils-8.23-2.6.1 coreutils-debuginfo-8.23-2.6.1 coreutils-debugsource-8.23-2.6.1 coreutils-testsuite-8.23-2.6.2 - openSUSE 13.2 (noarch): coreutils-lang-8.23-2.6.1 References: https://bugzilla.suse.com/show_bug.cgi?id=866010 https://bugzilla.suse.com/show_bug.cgi?id=901905

1 0

openSUSE-SU-2015:0174-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 29 Jan '15

29 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0174-1 Rating: critical References: #856386 #913057 #914333 #914463 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 CVE-2015-0310 CVE-2015-0311 Affected Products: openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463): * APSA15-01, CVE-2015-0311 - Update of flashplayer (executable binary) for i386 is not available. This binary was disabled. - Security update to 11.2.202.438 (bsc#914333): * APSB15-02, CVE-2015-0310 - Security update to 11.2.202.429 (bsc#913057): * APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309. - Disable flash player on machines without SSE2 (bnc#856386). - Remove outdated README and keep only up-to-date readme.txt. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2015-81 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.440-2.115.1 flash-player-gnome-11.2.202.440-2.115.1 flash-player-kde4-11.2.202.440-2.115.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html http://support.novell.com/security/cve/CVE-2015-0310.html http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 https://bugzilla.suse.com/show_bug.cgi?id=914333 https://bugzilla.suse.com/show_bug.cgi?id=914463

1 0

openSUSE-SU-2015:0162-1: critical: glibc
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0162-1 Rating: critical References: #913646 Cross-References: 2015-0235 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-6 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): glibc-2.11.3-12.62.1 glibc-debuginfo-2.11.3-12.62.1 glibc-debugsource-2.11.3-12.62.1 glibc-devel-2.11.3-12.62.1 glibc-devel-debuginfo-2.11.3-12.62.1 glibc-html-2.11.3-12.62.1 glibc-i18ndata-2.11.3-12.62.1 glibc-info-2.11.3-12.62.1 glibc-locale-2.11.3-12.62.1 glibc-locale-debuginfo-2.11.3-12.62.1 glibc-obsolete-2.11.3-12.62.1 glibc-profile-2.11.3-12.62.1 nscd-2.11.3-12.62.1 nscd-debuginfo-2.11.3-12.62.1 - openSUSE Evergreen 11.4 (i586): glibc-obsolete-debuginfo-2.11.3-12.62.1 References: http://support.novell.com/security/cve/2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646

1 0

openSUSE-SU-2015:0161-1: important: Security update for libpng16
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0161-1 Rating: important References: #912076 #912929 Cross-References: CVE-2014-9495 CVE-2015-0973 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libpng was updated to fix some security issues: * CVE-2014-9495 [bnc#912076]: Heap-buffer overflow png_combine_row() with very wide interlaced images * CVE-2015-0973 [bnc#912929]: overflow in png_read_IDAT_data libpng is now also build with -DPNG_SAFE_LIMITS_SUPPORTED. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-79 - openSUSE 13.1: zypper in -t patch openSUSE-2015-79 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpng16-16-1.6.13-2.4.1 libpng16-16-debuginfo-1.6.13-2.4.1 libpng16-compat-devel-1.6.13-2.4.1 libpng16-debugsource-1.6.13-2.4.1 libpng16-devel-1.6.13-2.4.1 libpng16-tools-1.6.13-2.4.1 libpng16-tools-debuginfo-1.6.13-2.4.1 - openSUSE 13.2 (x86_64): libpng16-16-32bit-1.6.13-2.4.1 libpng16-16-debuginfo-32bit-1.6.13-2.4.1 libpng16-compat-devel-32bit-1.6.13-2.4.1 libpng16-devel-32bit-1.6.13-2.4.1 - openSUSE 13.1 (i586 x86_64): libpng16-16-1.6.6-16.1 libpng16-16-debuginfo-1.6.6-16.1 libpng16-compat-devel-1.6.6-16.1 libpng16-debugsource-1.6.6-16.1 libpng16-devel-1.6.6-16.1 libpng16-tools-1.6.6-16.1 libpng16-tools-debuginfo-1.6.6-16.1 - openSUSE 13.1 (x86_64): libpng16-16-32bit-1.6.6-16.1 libpng16-16-debuginfo-32bit-1.6.6-16.1 libpng16-compat-devel-32bit-1.6.6-16.1 libpng16-devel-32bit-1.6.6-16.1 References: http://support.novell.com/security/cve/CVE-2014-9495.html http://support.novell.com/security/cve/CVE-2015-0973.html https://bugzilla.suse.com/show_bug.cgi?id=912076 https://bugzilla.suse.com/show_bug.cgi?id=912929

1 0

openSUSE-SU-2015:0159-1: moderate: Security update for git
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0159-1 Rating: moderate References: #910756 Cross-References: CVE-2014-9390 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue: - CVE-2014-9390: arbitrary command execution vulnerability on case-insensitive file system ( bnc#910756) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-80 - openSUSE 13.1: zypper in -t patch openSUSE-2015-80 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): git-2.1.4-9.6 git-arch-2.1.4-9.6 git-core-2.1.4-9.6 git-core-debuginfo-2.1.4-9.6 git-cvs-2.1.4-9.6 git-daemon-2.1.4-9.6 git-daemon-debuginfo-2.1.4-9.6 git-debugsource-2.1.4-9.6 git-email-2.1.4-9.6 git-gui-2.1.4-9.6 git-svn-2.1.4-9.6 git-svn-debuginfo-2.1.4-9.6 git-web-2.1.4-9.6 gitk-2.1.4-9.6 - openSUSE 13.2 (noarch): git-doc-2.1.4-9.7 - openSUSE 13.2 (i586): git-2.1.4-9.7 git-arch-2.1.4-9.7 git-core-2.1.4-9.7 git-core-debuginfo-2.1.4-9.7 git-cvs-2.1.4-9.7 git-daemon-2.1.4-9.7 git-daemon-debuginfo-2.1.4-9.7 git-debugsource-2.1.4-9.7 git-email-2.1.4-9.7 git-gui-2.1.4-9.7 git-svn-2.1.4-9.7 git-svn-debuginfo-2.1.4-9.7 git-web-2.1.4-9.7 gitk-2.1.4-9.7 - openSUSE 13.1 (i586 x86_64): git-1.8.4.5-3.8.4 git-arch-1.8.4.5-3.8.4 git-core-1.8.4.5-3.8.4 git-core-debuginfo-1.8.4.5-3.8.4 git-cvs-1.8.4.5-3.8.4 git-daemon-1.8.4.5-3.8.4 git-daemon-debuginfo-1.8.4.5-3.8.4 git-debugsource-1.8.4.5-3.8.4 git-email-1.8.4.5-3.8.4 git-gui-1.8.4.5-3.8.4 git-remote-helpers-1.8.4.5-3.8.4 git-svn-1.8.4.5-3.8.4 git-svn-debuginfo-1.8.4.5-3.8.4 git-web-1.8.4.5-3.8.4 gitk-1.8.4.5-3.8.4 References: http://support.novell.com/security/cve/CVE-2014-9390.html https://bugzilla.suse.com/show_bug.cgi?id=910756

1 0

openSUSE-SU-2015:0150-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0150-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found on https://helpx.adobe.com/security/products/flash-player/apsa15-01.html An update of flashplayer (executable binary) for i386 is currently not available. Disabled! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-78 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-78 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.440-2.29.1 flash-player-gnome-11.2.202.440-2.29.1 flash-player-kde4-11.2.202.440-2.29.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.440-94.1 flash-player-gnome-11.2.202.440-94.1 flash-player-kde4-11.2.202.440-94.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463

1 0

openSUSE-RU-2015:0149-1: subversion
by maintenance＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Recommended Update: subversion ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0149-1 Rating: low References: #911620 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for subversion fixes the following issues: - fixes sysconfig file generation (bnc#911620) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-77 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.11-2.11.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.11-2.11.1 libsvn_auth_kwallet-1-0-1.8.11-2.11.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.11-2.11.1 subversion-1.8.11-2.11.1 subversion-debuginfo-1.8.11-2.11.1 subversion-debugsource-1.8.11-2.11.1 subversion-devel-1.8.11-2.11.1 subversion-perl-1.8.11-2.11.1 subversion-perl-debuginfo-1.8.11-2.11.1 subversion-python-1.8.11-2.11.1 subversion-python-ctypes-1.8.11-2.11.1 subversion-python-debuginfo-1.8.11-2.11.1 subversion-ruby-1.8.11-2.11.1 subversion-ruby-debuginfo-1.8.11-2.11.1 subversion-server-1.8.11-2.11.1 subversion-server-debuginfo-1.8.11-2.11.1 subversion-tools-1.8.11-2.11.1 subversion-tools-debuginfo-1.8.11-2.11.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.11-2.11.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911620

1 0

openSUSE-SU-2015:0147-1: critical: update for Flash player
by opensuse-security＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Security Update: update for Flash player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0147-1 Rating: critical References: Cross-References: 2015-0310 2015-0311 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Flash player fixes known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-5 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.440-143.1 flash-player-gnome-11.2.202.440-143.1 flash-player-kde4-11.2.202.440-143.1 References: http://support.novell.com/security/cve/2015-0310.html http://support.novell.com/security/cve/2015-0311.html

1 0

openSUSE-RU-2015:0143-1: xdm
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0143-1 Rating: low References: #897803 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xdm fixes the following issues: - part of solution of bnc#897803 * modify /etc/X11/xdm/keytable to don't truncate too much *.map.gz names with dot. * rpm post script: * move away /etc/X11/xorg.conf.d/00-keyboard.conf * run /etc/X11/xdm/keytable Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-76 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xdm-1.1.11-3.8.1 xdm-debuginfo-1.1.11-3.8.1 xdm-debugsource-1.1.11-3.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=897803

1 0

openSUSE-RU-2015:0142-1: dosfstools
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: dosfstools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0142-1 Rating: low References: #912607 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for dosfstools fixes the following issues: - Fix attempt to rename root dir in fsck due to uninitialized fields [bnc#912607] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-73 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dosfstools-3.0.26-3.5.1 dosfstools-debuginfo-3.0.26-3.5.1 dosfstools-debugsource-3.0.26-3.5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912607

1 0

openSUSE-RU-2015:0141-1: cronie
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: cronie ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0141-1 Rating: low References: #900604 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for cronie fixes the following issues: - patch in order to fix loading the PAM environment from the pam_env module as documented in the manualpage. - fixes memory leak of environment returned by pam_getenvlist() (bnc#900604). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-75 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cron-4.2-50.4.1 cronie-1.4.8-50.4.1 cronie-anacron-1.4.8-50.4.1 cronie-anacron-debuginfo-1.4.8-50.4.1 cronie-debuginfo-1.4.8-50.4.1 cronie-debugsource-1.4.8-50.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900604

1 0

openSUSE-RU-2015:0140-1: aws-cli
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: aws-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0140-1 Rating: low References: #905354 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for aws-cli fixes the following issues: - Update to version 1.7.1 (bnc#905354) + bugfix:``aws s3 cp``: Fix issue with parts of a file being downloaded more than once when streaming to stdout (`issue 1087 <https://github.com/aws/aws-cli/pull/1087>`__) + bugfix:``--no-sign-request``: Fix issue where requests were still trying to be signed even though user used the ``--no-sign-request`` flag. (`botocore issue 433 <https://github.com/boto/botocore/pull/433>`__) + bugfix:``aws cloudsearchdomain search``: Fix invalid signatures when using the ``aws cloudsearchdomain search`` command (`issue 976 <https://github.com/aws/aws-cli/issues/976>`__) + feature:``aws cloudhsm``: Add support for AWS CloudHSM. + feature:``aws ecs``: Add support for ``aws ecs``, the Amazon EC2 Container Service (ECS) + feature:``aws rds``: Add Encryption at Rest and CloudHSM Support. + feature:``aws ec2``: Add Classic Link support + feature:``aws cloudsearch``: Update ``aws cloudsearch`` command to latest version + bugfix:``aws cloudfront wait``: Fix issue where wait commands did not stop waiting when a success state was reached. (`botocore issue 426 <https://github.com/boto/botocore/pull/426>`_) + bugfix:``aws ec2 run-instances``: Allow binary files to be passed to ``--user-data`` (`botocore issue 416 <https://github.com/boto/botocore/pull/416>`_) + bugfix:``aws cloudsearchdomain suggest``: Add ``--suggest-query`` option to fix the argument being shadowed by the top level ``--query`` option. (`issue 1068 <https://github.com/aws/aws-cli/pull/1068>`__) + bugfix:``aws emr``: Fix issue with endpoints for ``eu-central-1`` and ``cn-north-1`` (`botocore issue 423 <https://github.com/boto/botocore/pull/423>`__) + bugfix:``aws s3``: Fix issue where empty XML nodes are now parsed as an empty string ``""`` instead of ``null``, which allows for round tripping ``aws s3 get/put-bucket-lifecycle`` (`issue 1076 <https://github.com/aws/aws-cli/issues/1076>`__) + bugfix:AssumeRole: Fix issue with cache filenames when assuming a role on Windows (`issue 1063 <https://github.com/aws/aws-cli/issues/1063>`__) + bugfix:``aws s3 ls``: Fix issue when listing Amazon S3 objects containing non-ascii characters in eu-central-1 (`issue 1046 <https://github.com/aws/aws-cli/issues/1046>`__) + feature:``aws storagegateway``: Update the ``aws storagegateway`` command to the latest version + feature:``aws emr``: Update the ``aws emr`` command to the latest version + bugfix:``aws emr create-cluster``: Fix script runnner jar to the current region location when ``--enable-debugging`` is specified in the ``aws emr create-cluster`` command + bugfix:``aws datapipeline get-pipeline-definition``: Rename operation parameter ``--version`` to ``--pipeline-version`` to avoid shadowinga built in parameter (`issue 1058 <https://github.com/aws/aws-cli/pull/1058>`__) + bugfix:pip installation: Fix issue where pip installations would cause an error due to the system's python configuration (`issue 1051 <https://github.com/aws/aws-cli/issues/1051>`__) + feature:``aws elastictranscoder``: Update the ``aws elastictranscoder`` command to the latest version + bugfix:Non-ascii chars: Fix issue where escape sequences were being printed instead of the non-ascii chars (`issue 1048 <https://github.com/aws/aws-cli/issues/1048>`__) + bugfix:``aws iam create-virtual-mfa-device``: Fix issue with ``--outfile`` not supporting relative paths (`issue 1002 <https://github.com/aws/aws-cli/pull/1002>`__) + feature:``aws sqs``: Add support for Amazon Simple Queue Service purge queue which allows users to delete the messages in their queue. + feature:``aws opsworks``: Add AWS OpsWorks support for registering and assigning existing Amazon EC2 instances and on-premises servers. + feature:``aws opsworks register``: Registers an EC2 instance or machine with AWS OpsWorks. Registering a machine using this command will install the AWS OpsWorks agent on the target machine and register it with an existing OpsWorks stack. + bugfix:``aws s3``: Fix issue with expired signatures when retrying failed requests (`botocore issue 399 <https://github.com/boto/botocore/pull/399>`__) + bugfix:``aws cloudformation get-template``: Fix error message when template does not exist (`issue 1044 <https://github.com/aws/aws-cli/issues/1044>`__) + feature:``aws kinesis put-records``: Add support for PutRecord operation. It writes multiple data records from a producer into an Amazon Kinesis stream in a single call + feature:``aws iam get-account-authorization-details``: Add support for GetAccountAuthorizationDetails operation. It retrieves information about all IAM users, groups, and roles in your account, including their relationships to one another and their attached policies. + feature:``aws route53 update-hosted-zone-comment``: Add support for updating the comment of a hosted zone. + bugfix:Timestamp Arguments: Fix issue where certain timestamps were not being accepted as valid input (`botocore issue 389 <https://github.com/boto/botocore/pull/389>`__) + bugfix:``aws s3``: Skip files whose names cannot be properly decoded (`issue 1038 <https://github.com/aws/aws-cli/pull/1038>`__) + bugfix:``aws kinesis put-record``: Fix issue where ``--data`` argument was not being base64 encoded (`issue 1033 <https://github.com/aws/aws-cli/issues/1033>`__) + bugfix:``aws cloudwatch put-metric-data``: Fix issue where the values for ``--statistic-values`` were not being parsed properly (`issue 1036 <https://github.com/aws/aws-cli/issues/1036>`__) + feature:``aws datapipeline``: Add support for using AWS Data Pipeline templates to create pipelines and bind values to parameters in the pipeline + feature:``aws elastictranscoder``: Add support for encryption of files in Amazon S3 + bugfix:``aws s3``: Fix issue where requests were not being resigned correctly when using Signature Version 4 (`botocore issue 388 <https://github.com/boto/botocore/pull/388>`__) + bugfix:``aws s3``: Fix issue where KMS encrypted objects could not be downloaded (`issue 1026 <https://github.com/aws/aws-cli/pull/1026>`__) + bugfix:``aws s3``: Fix issue where datetime's were not being parsed properly when a profile was specified (`issue 1020 <https://github.com/aws/aws-cli/issues/1020>`__) + bugfix:Assume Role Credential Provider: Fix issue with parsing expiry time from assume role credential provider (`botocore issue 387 <https://github.com/boto/botocore/pull/387>`__) + feature:``aws redshift``: Add support for integration with KMS + bugfix:``aws cloudtrail create-subscription``: Set a bucket config location constraint on buckets created outside of us-east-1. (`issue 1013 <https://github.com/aws/aws-cli/pull/1013>`__) + bugfix:``aws deploy push``: Fix s3 multipart uploads + bugfix:``aws s3 ls``: Fix return codes for non existing objects (`issue 1008 <https://github.com/aws/aws-cli/pull/1008>`__) + bugfix:Retrying Signed Requests: Fix issue where requests using Signature Version 4 signed with temporary credentials were not being retried properly, resulting in auth errors (`botocore issue 379 <https://github.com/boto/botocore/pull/379>`__) + bugfix:``aws s3api get-bucket-location``: Fix issue where getting the bucket location for a bucket in eu-central-1 required specifying ``--region eu-central-1`` (`botocore issue 380 <https://github.com/boto/botocore/pull/380>`__) + bugfix:Timestamp Input: Fix regression where timestamps without any timezone information were not being handled properly (`issue 982 <https://github.com/aws/aws-cli/issues/982>`__) + bugfix:Signature Version 4: You can enable Signature Version 4 for Amazon S3 commands by running ``aws configure set default.s3.signature_version s3v4`` (`issue 1006 <https://github.com/aws/aws-cli/issues/1006>`__, `botocore issue 382 <https://github.com/boto/botocore/pull/382>`__) + bugfix:``aws emr``: Fix issue where ``--ssh``, ``--get``, ``--put`` would not work when the cluster was in a waiting state (`issue 1007 <https://github.com/aws/aws-cli/issues/1007>`__) + feature:Binary File Input: Add support for reading file contents as binary by prepending the filename with ``fileb://`` (`issue 1010 <https://github.com/aws/aws-cli/pull/1010>`__) + bugfix:Streaming Output File: Fix issue when streaming a response to a file and an error response is returned (`issue 1012 <https://github.com/aws/aws-cli/pull/1012>`__) + bugfix:Binary Output: Fix regression where binary output was no longer being base64 encoded (`issue 1001 <https://github.com/aws/aws-cli/pull/1001>`__, `issue 970 <https://github.com/aws/aws-cli/pull/970>`__) + feature:``aws lambda``: Add support for Amazon Lambda + feature:``aws s3``: Add support for S3 notifications + bugfix:``aws configservice get-status``: Fix connecting to endpoint without using ssl. (`issue 998 <https://github.com/aws/aws-cli/pull/998>`__) + bugfix:``aws deploy push``: Fix some python compatibility issues (`issue 1000 <https://github.com/aws/aws-cli/pull/1000>`__) + feature:``aws deploy``: Adds support for AWS CodeDeploy + feature:``aws configservice``: Adds support for AWS Config + feature:``aws kms``: Adds support AWS Key Management Service + feature:``aws s3api``: Adds support for S3 server-side encryption using KMS + feature:``aws ec2``: Adds support for EBS encryption using KMS + feature:``aws cloudtrail``: Adds support for CloudWatch Logs delivery + feature:``aws cloudformation``: Adds support for template summary. + feature:AssumeRole Credential Provider: Add support for assuming a role by configuring a ``role_arn`` and a ``source_profile`` in the AWS config file (`issue 991 <https://github.com/aws/aws-cli/pull/991>`__, `issue 990 <https://github.com/aws/aws-cli/pull/990>`__) + feature:Waiters: Add a ``wait`` subcommand that allows for a command to block until an AWS resource reaches a given state (`issue 992 <https://github.com/aws/aws-cli/pull/992>`__, `issue 985 <https://github.com/aws/aws-cli/pull/985>`__) + bugfix:``aws s3``: Fix issue where request was not properly signed on retried requests for ``aws s3`` (`issue 986 <https://github.com/aws/aws-cli/issues/986>`__, `botocore issue 375 <https://github.com/boto/botocore/pull/375>`__) + bugfix:``aws s3``: Fix issue where ``--exclude`` and ``--include`` were not being properly applied when a s3 prefix was provided. (`issue 993 <https://github.com/aws/aws-cli/pull/993>`__) + feature:``aws cloudfront``: Adds support for wildcard cookie names and options caching. + feature:``aws route53``: Add further support for private dns and sigv4. + feature:``aws cognito-sync``: Add support for push sync. + bugfix:Pagination: Only display ``--page-size`` when an operation can be paginated (`issue 956 <https://github.com/aws/aws-cli/pull/956>`__) + feature:``--generate-cli-skeleton``: Generates a JSON skeleton to fill out and be used as input to ``--cli-input-json``. (`issue 963 <https://github.com/aws/aws-cli/pull/963>`_) + feature:``--cli-input-json``: Runs an operation using a global JSON file that supplies all of the operation's arguments. This JSON file can be generated by ``--generate-cli-skeleton``. (`issue 963 <https://github.com/aws/aws-cli/pull/963>`_) + feature:``aws s3/s3api``: Show hint about using the correct region when the corresponding error occurs (`issue 968 <https://github.com/aws/aws-cli/pull/968>`__) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-72 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): aws-cli-1.7.1-2.8.1 python-botocore-0.82.0-2.8.1 python-jmespath-0.5.0-2.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=905354

1 0

openSUSE-RU-2015:0139-1: namazu
by maintenance＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Recommended Update: namazu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0139-1 Rating: low References: #912784 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for namazu fixes the following issues: - fixes bnc#912784: /usr/bin/mknz gives Perl warning: "Useless use of greediness modifier '?' in regex Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-74 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): namazu-2.0.21-8.4.1 namazu-cgi-2.0.21-8.4.1 namazu-cgi-debuginfo-2.0.21-8.4.1 namazu-debuginfo-2.0.21-8.4.1 namazu-debugsource-2.0.21-8.4.1 namazu-devel-2.0.21-8.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912784

1 0

openSUSE-SU-2015:0138-1: important: Firefox update to latest 31ESR release
by opensuse-security＠opensuse.org 25 Jan '15

25 Jan '15

openSUSE Security Update: Firefox update to latest 31ESR release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0138-1 Rating: important References: #876833 #894370 #900639 #900941 #908009 #910669 Cross-References: 2013-5611 2013-5612 2013-5614 2013-5619 2013-6672 2014-1480 2014-1483 2014-1484 2014-1485 2014-1488 2014-1489 2014-1492 2014-1498 2014-1499 2014-1500 2014-1502 2014-1504 2014-1519 2014-1522 2014-1525 2014-1526 2014-1528 2014-1539 2014-1540 2014-1542 2014-1543 2014-1549 2014-1550 2014-1552 2014-1553 2014-1558 2014-1559 2014-1560 2014-1561 2014-1563 2014-1564 2014-1565 2014-1574 2014-1576 2014-1577 2014-1578 2014-1581 2014-1583 2014-1585 2014-1586 2014-1587 2014-1590 2014-1592 2014-1593 2014-1594 2014-8634 2014-8635 2014-8638 2014-8639 2014-8641 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1569 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 74 vulnerabilities is now available. Description: This update lifts Firefox to the latest 31 ESR release to fix known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-4 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.4.0-133.1 MozillaFirefox-branding-upstream-31.4.0-133.1 MozillaFirefox-buildsymbols-31.4.0-133.1 MozillaFirefox-debuginfo-31.4.0-133.1 MozillaFirefox-debugsource-31.4.0-133.1 MozillaFirefox-devel-31.4.0-133.1 MozillaFirefox-translations-common-31.4.0-133.1 MozillaFirefox-translations-other-31.4.0-133.1 libfreebl3-3.17.3-104.1 libfreebl3-debuginfo-3.17.3-104.1 libsoftokn3-3.17.3-104.1 libsoftokn3-debuginfo-3.17.3-104.1 mozilla-nspr-4.10.7-49.1 mozilla-nspr-debuginfo-4.10.7-49.1 mozilla-nspr-debugsource-4.10.7-49.1 mozilla-nspr-devel-4.10.7-49.1 mozilla-nss-3.17.3-104.1 mozilla-nss-certs-3.17.3-104.1 mozilla-nss-certs-debuginfo-3.17.3-104.1 mozilla-nss-debuginfo-3.17.3-104.1 mozilla-nss-debugsource-3.17.3-104.1 mozilla-nss-devel-3.17.3-104.1 mozilla-nss-sysinit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-3.17.3-104.1 mozilla-nss-tools-3.17.3-104.1 mozilla-nss-tools-debuginfo-3.17.3-104.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.17.3-104.1 libfreebl3-debuginfo-32bit-3.17.3-104.1 libsoftokn3-32bit-3.17.3-104.1 libsoftokn3-debuginfo-32bit-3.17.3-104.1 mozilla-nspr-32bit-4.10.7-49.1 mozilla-nspr-debuginfo-32bit-4.10.7-49.1 mozilla-nss-32bit-3.17.3-104.1 mozilla-nss-certs-32bit-3.17.3-104.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-104.1 mozilla-nss-debuginfo-32bit-3.17.3-104.1 mozilla-nss-sysinit-32bit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-32bit-3.17.3-104.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.17.3-104.1 libfreebl3-x86-3.17.3-104.1 libsoftokn3-debuginfo-x86-3.17.3-104.1 libsoftokn3-x86-3.17.3-104.1 mozilla-nspr-debuginfo-x86-4.10.7-49.1 mozilla-nspr-x86-4.10.7-49.1 mozilla-nss-certs-debuginfo-x86-3.17.3-104.1 mozilla-nss-certs-x86-3.17.3-104.1 mozilla-nss-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-x86-3.17.3-104.1 mozilla-nss-x86-3.17.3-104.1 References: http://support.novell.com/security/cve/2013-5611.html http://support.novell.com/security/cve/2013-5612.html http://support.novell.com/security/cve/2013-5614.html http://support.novell.com/security/cve/2013-5619.html http://support.novell.com/security/cve/2013-6672.html http://support.novell.com/security/cve/2014-1480.html http://support.novell.com/security/cve/2014-1483.html http://support.novell.com/security/cve/2014-1484.html http://support.novell.com/security/cve/2014-1485.html http://support.novell.com/security/cve/2014-1488.html http://support.novell.com/security/cve/2014-1489.html http://support.novell.com/security/cve/2014-1492.html http://support.novell.com/security/cve/2014-1498.html http://support.novell.com/security/cve/2014-1499.html http://support.novell.com/security/cve/2014-1500.html http://support.novell.com/security/cve/2014-1502.html http://support.novell.com/security/cve/2014-1504.html http://support.novell.com/security/cve/2014-1519.html http://support.novell.com/security/cve/2014-1522.html http://support.novell.com/security/cve/2014-1525.html http://support.novell.com/security/cve/2014-1526.html http://support.novell.com/security/cve/2014-1528.html http://support.novell.com/security/cve/2014-1539.html http://support.novell.com/security/cve/2014-1540.html http://support.novell.com/security/cve/2014-1542.html http://support.novell.com/security/cve/2014-1543.html http://support.novell.com/security/cve/2014-1549.html http://support.novell.com/security/cve/2014-1550.html http://support.novell.com/security/cve/2014-1552.html http://support.novell.com/security/cve/2014-1553.html http://support.novell.com/security/cve/2014-1558.html http://support.novell.com/security/cve/2014-1559.html http://support.novell.com/security/cve/2014-1560.html http://support.novell.com/security/cve/2014-1561.html http://support.novell.com/security/cve/2014-1563.html http://support.novell.com/security/cve/2014-1564.html http://support.novell.com/security/cve/2014-1565.html http://support.novell.com/security/cve/2014-1574.html http://support.novell.com/security/cve/2014-1576.html http://support.novell.com/security/cve/2014-1577.html http://support.novell.com/security/cve/2014-1578.html http://support.novell.com/security/cve/2014-1581.html http://support.novell.com/security/cve/2014-1583.html http://support.novell.com/security/cve/2014-1585.html http://support.novell.com/security/cve/2014-1586.html http://support.novell.com/security/cve/2014-1587.html http://support.novell.com/security/cve/2014-1590.html http://support.novell.com/security/cve/2014-1592.html http://support.novell.com/security/cve/2014-1593.html http://support.novell.com/security/cve/2014-1594.html http://support.novell.com/security/cve/2014-8634.html http://support.novell.com/security/cve/2014-8635.html http://support.novell.com/security/cve/2014-8638.html http://support.novell.com/security/cve/2014-8639.html http://support.novell.com/security/cve/2014-8641.html http://support.novell.com/security/cve/CVE-2014-1553.html http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1563.html http://support.novell.com/security/cve/CVE-2014-1564.html http://support.novell.com/security/cve/CVE-2014-1565.html http://support.novell.com/security/cve/CVE-2014-1567.html http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-1574.html http://support.novell.com/security/cve/CVE-2014-1576.html http://support.novell.com/security/cve/CVE-2014-1577.html http://support.novell.com/security/cve/CVE-2014-1578.html http://support.novell.com/security/cve/CVE-2014-1581.html http://support.novell.com/security/cve/CVE-2014-1585.html http://support.novell.com/security/cve/CVE-2014-1586.html http://support.novell.com/security/cve/CVE-2014-1587.html http://support.novell.com/security/cve/CVE-2014-1590.html http://support.novell.com/security/cve/CVE-2014-1592.html http://support.novell.com/security/cve/CVE-2014-1593.html http://support.novell.com/security/cve/CVE-2014-1594.html https://bugzilla.suse.com/show_bug.cgi?id=876833 https://bugzilla.suse.com/show_bug.cgi?id=894370 https://bugzilla.suse.com/show_bug.cgi?id=900639 https://bugzilla.suse.com/show_bug.cgi?id=900941 https://bugzilla.suse.com/show_bug.cgi?id=908009 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0

openSUSE-RU-2015:0137-1: moderate: fix compatibility with latest Python upgrade
by maintenance＠opensuse.org 25 Jan '15

25 Jan '15

openSUSE Recommended Update: fix compatibility with latest Python upgrade ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0137-1 Rating: moderate References: Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This patch contains a set of packages which needed a rebuild against latest Python because of binary incompatiblity. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-3 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): apache2-mod_python-3.3.1-161.8.1 apache2-mod_python-debuginfo-3.3.1-161.8.1 apache2-mod_python-debugsource-3.3.1-161.8.1 xchat-2.8.8-8.1 xchat-debuginfo-2.8.8-8.1 xchat-debugsource-2.8.8-8.1 xchat-perl-2.8.8-8.1 xchat-perl-debuginfo-2.8.8-8.1 xchat-python-2.8.8-8.1 xchat-python-debuginfo-2.8.8-8.1 xchat-tcl-2.8.8-8.1 xchat-tcl-debuginfo-2.8.8-8.1 - openSUSE Evergreen 11.4 (noarch): xchat-lang-2.8.8-8.1 References:

1 0

openSUSE-RU-2015:0134-1: xdg-utils
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: xdg-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0134-1 Rating: low References: #906625 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xdg-utils fixes the following issues: - added patch to fix not opening files with standard application (bnc#906625) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-71 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): xdg-utils-20140922-8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=906625

1 0

openSUSE-SU-2015:0133-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0133-1 Rating: moderate References: #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 31.4.0 (bnc#910669) * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-69 - openSUSE 13.1: zypper in -t patch openSUSE-2015-69 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-31.4.0-8.1 MozillaThunderbird-buildsymbols-31.4.0-8.1 MozillaThunderbird-debuginfo-31.4.0-8.1 MozillaThunderbird-debugsource-31.4.0-8.1 MozillaThunderbird-devel-31.4.0-8.1 MozillaThunderbird-translations-common-31.4.0-8.1 MozillaThunderbird-translations-other-31.4.0-8.1 - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-31.4.0-70.43.1 MozillaThunderbird-buildsymbols-31.4.0-70.43.1 MozillaThunderbird-debuginfo-31.4.0-70.43.1 MozillaThunderbird-debugsource-31.4.0-70.43.1 MozillaThunderbird-devel-31.4.0-70.43.1 MozillaThunderbird-translations-common-31.4.0-70.43.1 MozillaThunderbird-translations-other-31.4.0-70.43.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0

openSUSE-SU-2015:0132-1: moderate: Security update for libevent
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for libevent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0132-1 Rating: moderate References: #897243 Cross-References: CVE-2014-6272 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libevent was updated to fixed heap overflows in buffer API (bsc#897243 CVE-2014-6272) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-68 - openSUSE 13.1: zypper in -t patch openSUSE-2015-68 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libevent-2_0-5-2.0.21-4.4.1 libevent-2_0-5-debuginfo-2.0.21-4.4.1 libevent-debugsource-2.0.21-4.4.1 libevent-devel-2.0.21-4.4.1 - openSUSE 13.2 (x86_64): libevent-2_0-5-32bit-2.0.21-4.4.1 libevent-2_0-5-debuginfo-32bit-2.0.21-4.4.1 - openSUSE 13.1 (i586 x86_64): libevent-2_0-5-2.0.21-2.4.1 libevent-2_0-5-debuginfo-2.0.21-2.4.1 libevent-debugsource-2.0.21-2.4.1 libevent-devel-2.0.21-2.4.1 - openSUSE 13.1 (x86_64): libevent-2_0-5-32bit-2.0.21-2.4.1 libevent-2_0-5-debuginfo-32bit-2.0.21-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-6272.html https://bugzilla.suse.com/show_bug.cgi?id=897243

1 0

openSUSE-SU-2015:0131-1: moderate: Security update for shotwell, vala
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for shotwell, vala ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0131-1 Rating: moderate References: #913071 Cross-References: CVE-2014-8154 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: vala was updated to fix a heap buffer overflow in generated code during build (boo#913071, CVE-2014-8154). shotwell was rebuilt using above fixed vala. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-70 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libvala-0_26-0-0.26.1-4.1 libvala-0_26-0-debuginfo-0.26.1-4.1 libvala-0_26-devel-0.26.1-4.1 shotwell-0.20.1-5.2 shotwell-debuginfo-0.20.1-5.2 shotwell-debugsource-0.20.1-5.2 vala-0.26.1-4.1 vala-debuginfo-0.26.1-4.1 vala-debugsource-0.26.1-4.1 - openSUSE 13.2 (noarch): shotwell-lang-0.20.1-5.2 References: http://support.novell.com/security/cve/CVE-2014-8154.html https://bugzilla.suse.com/show_bug.cgi?id=913071

1 0

openSUSE-SU-2015:0130-1: important: Security update for openssl
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0130-1 Rating: important References: #911399 #912014 #912015 #912018 #912292 #912293 #912294 #912296 Cross-References: CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: openssl was updated to 1.0.1k to fix various security issues and bugs. More information can be found in the openssl advisory: http://openssl.org/news/secadv_20150108.txt Following issues were fixed: * CVE-2014-3570 (bsc#912296): Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. * CVE-2014-3571 (bsc#912294): Fixed crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. * CVE-2014-3572 (bsc#912015): Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. * CVE-2014-8275 (bsc#912018): Fixed various certificate fingerprint issues. * CVE-2015-0204 (bsc#912014): Only allow ephemeral RSA keys in export ciphersuites * CVE-2015-0205 (bsc#912293): A fixwas added to prevent use of DH client certificates without sending certificate verify message. * CVE-2015-0206 (bsc#912292): A memory leak was fixed in dtls1_buffer_record. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-67 - openSUSE 13.1: zypper in -t patch openSUSE-2015-67 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.16.2 libopenssl1_0_0-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-1.0.1k-2.16.2 libopenssl1_0_0-hmac-1.0.1k-2.16.2 openssl-1.0.1k-2.16.2 openssl-debuginfo-1.0.1k-2.16.2 openssl-debugsource-1.0.1k-2.16.2 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.16.2 libopenssl1_0_0-32bit-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.16.2 libopenssl1_0_0-hmac-32bit-1.0.1k-2.16.2 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.16.2 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.64.2 libopenssl1_0_0-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-1.0.1k-11.64.2 openssl-1.0.1k-11.64.2 openssl-debuginfo-1.0.1k-11.64.2 openssl-debugsource-1.0.1k-11.64.2 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.64.2 libopenssl1_0_0-32bit-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.64.2 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.64.2 References: http://support.novell.com/security/cve/CVE-2014-3569.html http://support.novell.com/security/cve/CVE-2014-3570.html http://support.novell.com/security/cve/CVE-2014-3571.html http://support.novell.com/security/cve/CVE-2014-3572.html http://support.novell.com/security/cve/CVE-2014-8275.html http://support.novell.com/security/cve/CVE-2015-0204.html http://support.novell.com/security/cve/CVE-2015-0205.html http://support.novell.com/security/cve/CVE-2015-0206.html https://bugzilla.suse.com/show_bug.cgi?id=911399 https://bugzilla.suse.com/show_bug.cgi?id=912014 https://bugzilla.suse.com/show_bug.cgi?id=912015 https://bugzilla.suse.com/show_bug.cgi?id=912018 https://bugzilla.suse.com/show_bug.cgi?id=912292 https://bugzilla.suse.com/show_bug.cgi?id=912293 https://bugzilla.suse.com/show_bug.cgi?id=912294 https://bugzilla.suse.com/show_bug.cgi?id=912296

1 0

openSUSE-RU-2015:0128-1: moderate: open-vm-tools
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: open-vm-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0128-1 Rating: moderate References: #905420 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for open-vm-tools fixes the following issues: - boo#905420: Enable building of kmps and split it into own spec file open-vm-tools-KMP. - Fix building of vmhgfs with Kernel 3.17.7+ and Kernel 3.18.0+. - Fix bashisms in vmware-user-autostart-wrapper script - Fix build with Linux 3.17.0. - Remove unused DEPRECATED-macro - Conditionally define g_info-macro - Add kuid_t- and kgid_t-compatibility-layer - Use new link helpers - Update hgfs file operations for newer kernels - Fix vmxnet-module on 3.16 kernels - Fix vmhgfs-module on 3.16 kernels - Fix segfault in vmhgfs - Fix bashisms in preun script. - Do not generate timestamps in the doxygen docs. - Add -Wno-cpp to CFLAGS. - Release matching the vSphere 5.5p02 release - "which" as separate package does not exist on older opensuse versions so removed from Requires for older distributions - used autoreconf as source package does not provide configure script anymore - removed vmsync module from OS12.3 build target as it does not compile Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-66 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libvmtools-devel-9.4.6-4.4.1 libvmtools0-9.4.6-4.4.1 libvmtools0-debuginfo-9.4.6-4.4.1 open-vm-tools-9.4.6-4.4.1 open-vm-tools-debuginfo-9.4.6-4.4.1 open-vm-tools-debugsource-9.4.6-4.4.1 open-vm-tools-desktop-9.4.6-4.4.1 open-vm-tools-desktop-debuginfo-9.4.6-4.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=905420

1 0

openSUSE-RU-2015:0126-1: Recommended update for lvm2
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0126-1 Rating: low References: #901859 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for lvm2 fixes the following issue: - Change default locking type to 1 (bnc#901859) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-65 - openSUSE 13.1: zypper in -t patch openSUSE-2015-65 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): lvm2-2.02.98-43.5.1 lvm2-clvm-2.02.98-43.5.1 lvm2-clvm-debuginfo-2.02.98-43.5.1 lvm2-cmirrord-2.02.98-43.5.1 lvm2-cmirrord-debuginfo-2.02.98-43.5.1 lvm2-debuginfo-2.02.98-43.5.1 lvm2-debugsource-2.02.98-43.5.1 lvm2-devel-2.02.98-43.5.1 - openSUSE 13.1 (i586 x86_64): lvm2-2.02.98-0.28.22.2 lvm2-clvm-2.02.98-28.22.2 lvm2-clvm-debuginfo-2.02.98-28.22.2 lvm2-cmirrord-2.02.98-28.22.2 lvm2-cmirrord-debuginfo-2.02.98-28.22.2 lvm2-debuginfo-2.02.98-0.28.22.2 lvm2-debugsource-2.02.98-0.28.22.2 References: https://bugzilla.suse.com/show_bug.cgi?id=901859

1 0

openSUSE-RU-2015:0125-1: moderate: Recommended update for docbook-xsl-stylesheets
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for docbook-xsl-stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0125-1 Rating: moderate References: #912669 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for docbook-xsl-stylesheets provides the following fix: - Fixed missing image directory (bnc#912669) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-63 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): docbook-xsl-stylesheets-1.78.1+svn9743-3.4.2 docbook-xsl-stylesheets-scripts-1.78.1+svn9743-3.4.2 References: https://bugzilla.suse.com/show_bug.cgi?id=912669

1 0

openSUSE-RU-2015:0124-1: moderate: sysconfig
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: sysconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0124-1 Rating: moderate References: #895447 #900982 #912891 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for sysconfig provides version 0.83.8 with various fixes and improvements: - netconfig: use domain name from hostname (boo#912891) + When there is no dns domain or search list provided (by dhcp), but a hostname as FQDN, use it's domain for /etc/resolv.conf search list. - netconfig: merge NetworkManager settings on -m (boo#900982) - rpm: kill all NetworkManager child processes on migration + Before we stop (the always running) NetworkManager.service, ensure to kill all (child) processes when migrating from the NETWORKMANAGER=no variable (boo#895447). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-55 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): sysconfig-0.83.8-5.1 sysconfig-debuginfo-0.83.8-5.1 sysconfig-debugsource-0.83.8-5.1 sysconfig-netconfig-0.83.8-5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=895447 https://bugzilla.suse.com/show_bug.cgi?id=900982 https://bugzilla.suse.com/show_bug.cgi?id=912891

1 0

openSUSE-SU-2015:0123-1: moderate: Security update for elfutils
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for elfutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0123-1 Rating: moderate References: #911662 Cross-References: CVE-2014-9447 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: elfutils was updated to fix a directory traversal vulnerability (bnc#911662 CVE-2014-9447) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-59 - openSUSE 13.1: zypper in -t patch openSUSE-2015-59 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): elfutils-0.158-4.5.1 elfutils-debuginfo-0.158-4.5.1 elfutils-debugsource-0.158-4.5.1 libasm-devel-0.158-4.5.1 libasm1-0.158-4.5.1 libasm1-debuginfo-0.158-4.5.1 libdw-devel-0.158-4.5.1 libdw1-0.158-4.5.1 libdw1-debuginfo-0.158-4.5.1 libebl-devel-0.158-4.5.1 libebl1-0.158-4.5.1 libebl1-debuginfo-0.158-4.5.1 libelf-devel-0.158-4.5.1 libelf1-0.158-4.5.1 libelf1-debuginfo-0.158-4.5.1 - openSUSE 13.2 (x86_64): libasm1-32bit-0.158-4.5.1 libasm1-debuginfo-32bit-0.158-4.5.1 libdw1-32bit-0.158-4.5.1 libdw1-debuginfo-32bit-0.158-4.5.1 libebl1-32bit-0.158-4.5.1 libebl1-debuginfo-32bit-0.158-4.5.1 libelf-devel-32bit-0.158-4.5.1 libelf1-32bit-0.158-4.5.1 libelf1-debuginfo-32bit-0.158-4.5.1 - openSUSE 13.1 (i586 x86_64): elfutils-0.155-6.8.1 elfutils-debuginfo-0.155-6.8.1 elfutils-debugsource-0.155-6.8.1 libasm-devel-0.155-6.8.1 libasm1-0.155-6.8.1 libasm1-debuginfo-0.155-6.8.1 libdw-devel-0.155-6.8.1 libdw1-0.155-6.8.1 libdw1-debuginfo-0.155-6.8.1 libebl-devel-0.155-6.8.1 libebl1-0.155-6.8.1 libebl1-debuginfo-0.155-6.8.1 libelf-devel-0.155-6.8.1 libelf1-0.155-6.8.1 libelf1-debuginfo-0.155-6.8.1 - openSUSE 13.1 (x86_64): libasm1-32bit-0.155-6.8.1 libasm1-debuginfo-32bit-0.155-6.8.1 libdw1-32bit-0.155-6.8.1 libdw1-debuginfo-32bit-0.155-6.8.1 libebl1-32bit-0.155-6.8.1 libebl1-debuginfo-32bit-0.155-6.8.1 libelf-devel-32bit-0.155-6.8.1 libelf1-32bit-0.155-6.8.1 libelf1-debuginfo-32bit-0.155-6.8.1 References: http://support.novell.com/security/cve/CVE-2014-9447.html https://bugzilla.suse.com/show_bug.cgi?id=911662

1 0

openSUSE-RU-2015:0122-1: moderate: recommended udpate for llvm
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: recommended udpate for llvm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0122-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended udpate for llvm fixes the following issue: - Conditionalize libcxx{abi} build on build_libcxx variable - Turn libc++.so into an ldscript so it links to libc++abi automatically. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-61 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libLLVM-3.5.0-7.1 libLLVM-debuginfo-3.5.0-7.1 libclang-3.5.0-7.1 libclang-debuginfo-3.5.0-7.1 llvm-3.5.0-7.1 llvm-clang-3.5.0-7.1 llvm-clang-debuginfo-3.5.0-7.1 llvm-clang-devel-3.5.0-7.1 llvm-debuginfo-3.5.0-7.1 llvm-debugsource-3.5.0-7.1 llvm-devel-3.5.0-7.1 llvm-devel-debuginfo-3.5.0-7.1 llvm-vim-plugins-3.5.0-7.1 python-clang-3.5.0-7.1 - openSUSE 13.2 (x86_64): libLLVM-32bit-3.5.0-7.1 libLLVM-debuginfo-32bit-3.5.0-7.1 libclang-32bit-3.5.0-7.1 libclang-debuginfo-32bit-3.5.0-7.1 lldb-3.5.0-7.1 lldb-debuginfo-3.5.0-7.1 lldb-devel-3.5.0-7.1 References:

1 0

openSUSE-RU-2015:0121-1: moderate: Recommended update for docker
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0121-1 Rating: moderate References: #913211 #913213 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for docker provides the following fixes: - Update from 1.4.0 to 1.4.1 + Runtime: * Fix issue with volumes-from and bind mounts not being honored after create (bnc#913213) + Added e2fsprogs as runtime dependency, this is required when the devicemapper driver is used. (bnc#913211). + Fixed owner and group for docker.socket Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-57 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): docker-1.4.1-17.1 docker-debuginfo-1.4.1-17.1 docker-debugsource-1.4.1-17.1 - openSUSE 13.2 (noarch): docker-bash-completion-1.4.1-17.1 docker-zsh-completion-1.4.1-17.1 References: https://bugzilla.suse.com/show_bug.cgi?id=913211 https://bugzilla.suse.com/show_bug.cgi?id=913213

1 0

openSUSE-RU-2015:0120-1: python-wxWidgets
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: python-wxWidgets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0120-1 Rating: low References: #907703 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for python-wxWidgets fixes the following issues: - bnc#907703: fixes plot library to make it compatible with a new version of NumPy. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-64 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-wxWidgets-2.8.12.1-10.4.1 python-wxWidgets-debuginfo-2.8.12.1-10.4.1 python-wxWidgets-debugsource-2.8.12.1-10.4.1 python-wxWidgets-devel-2.8.12.1-10.4.1 python-wxWidgets-lang-2.8.12.1-10.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=907703

1 0

openSUSE-RU-2015:0119-1: moderate: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0119-1 Rating: moderate References: #888534 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The system root SSL certificates were updated to match Mozilla NSS 2.2. Some removed/disabled 1024 bit certificates were temporarily reenabled/readded, as openssl and gnutls have a different handling of intermediates than mozilla nss and would otherwise not recognize SSL certificates from sites like Amazon. Updated to 2.2 (bnc#888534) - The following CAs were added: + COMODO_RSA_Certification_Authority codeSigning emailProtection serverAuth + GlobalSign_ECC_Root_CA_-_R4 codeSigning emailProtection serverAuth + GlobalSign_ECC_Root_CA_-_R5 codeSigning emailProtection serverAuth + USERTrust_ECC_Certification_Authority codeSigning emailProtection serverAuth + USERTrust_RSA_Certification_Authority codeSigning emailProtection serverAuth + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal - The following CAs were changed: + Equifax_Secure_eBusiness_CA_1 remote code signing and https trust, leave email trust + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2 only trust emailProtection - Updated to 2.1 (bnc#888534) - The following 1024-bit CA certificates were removed - Entrust.net Secure Server Certification Authority - ValiCert Class 1 Policy Validation Authority - ValiCert Class 2 Policy Validation Authority - ValiCert Class 3 Policy Validation Authority - TDC Internet Root CA - The following CA certificates were added: - Certification Authority of WoSign - CA 沃通根证书 - DigiCert Assured ID Root G2 - DigiCert Assured ID Root G3 - DigiCert Global Root G2 - DigiCert Global Root G3 - DigiCert Trusted Root G4 - QuoVadis Root CA 1 G3 - QuoVadis Root CA 2 G3 - QuoVadis Root CA 3 G3 - The Trust Bits were changed for the following CA certificates - Class 3 Public Primary Certification Authority - Class 3 Public Primary Certification Authority - Class 2 Public Primary Certification Authority - G2 - VeriSign Class 2 Public Primary Certification Authority - G3 - AC Raíz Certicámara S.A. - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado Temporary reenable some root ca trusts, as openssl/gnutls have trouble using intermediates as root CA. - GTE CyberTrust Global Root - Thawte Server CA - Thawte Premium Server CA - ValiCert Class 1 VA - ValiCert Class 2 VA - RSA Root Certificate 1 - Entrust.net Secure Server CA - America Online Root Certification Authority 1 - America Online Root Certification Authority 2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-56 - openSUSE 13.1: zypper in -t patch openSUSE-2015-56 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): ca-certificates-mozilla-2.2-3.4.1 - openSUSE 13.1 (noarch): ca-certificates-mozilla-2.2-3.17.1 References: https://bugzilla.suse.com/show_bug.cgi?id=888534

1 0

openSUSE-RU-2015:0118-1: libqt5-qtbase
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0118-1 Rating: low References: #870151 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for libqt5-qtbase fixes the following issues: - Added patch from upstream to fix Qt5 Apllication crashed in rendering when executing over ssh (qtbug#43623, boo#870151) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-60 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libQt5Bootstrap-devel-static-5.3.2-12.2 libQt5Concurrent-devel-5.3.2-12.2 libQt5Concurrent5-5.3.2-12.2 libQt5Concurrent5-debuginfo-5.3.2-12.2 libQt5Core-devel-5.3.2-12.2 libQt5Core5-5.3.2-12.2 libQt5Core5-debuginfo-5.3.2-12.2 libQt5DBus-devel-5.3.2-12.2 libQt5DBus-devel-debuginfo-5.3.2-12.2 libQt5DBus5-5.3.2-12.2 libQt5DBus5-debuginfo-5.3.2-12.2 libQt5Gui-devel-5.3.2-12.2 libQt5Gui5-5.3.2-12.2 libQt5Gui5-debuginfo-5.3.2-12.2 libQt5Network-devel-5.3.2-12.2 libQt5Network5-5.3.2-12.2 libQt5Network5-debuginfo-5.3.2-12.2 libQt5OpenGL-devel-5.3.2-12.2 libQt5OpenGL5-5.3.2-12.2 libQt5OpenGL5-debuginfo-5.3.2-12.2 libQt5OpenGLExtensions-devel-static-5.3.2-12.2 libQt5PlatformSupport-devel-static-5.3.2-12.2 libQt5PrintSupport-devel-5.3.2-12.2 libQt5PrintSupport5-5.3.2-12.2 libQt5PrintSupport5-debuginfo-5.3.2-12.2 libQt5Sql-devel-5.3.2-12.2 libQt5Sql5-5.3.2-12.2 libQt5Sql5-debuginfo-5.3.2-12.2 libQt5Sql5-mysql-5.3.2-12.2 libQt5Sql5-mysql-debuginfo-5.3.2-12.2 libQt5Sql5-postgresql-5.3.2-12.2 libQt5Sql5-postgresql-debuginfo-5.3.2-12.2 libQt5Sql5-sqlite-5.3.2-12.2 libQt5Sql5-sqlite-debuginfo-5.3.2-12.2 libQt5Sql5-unixODBC-5.3.2-12.2 libQt5Sql5-unixODBC-debuginfo-5.3.2-12.2 libQt5Test-devel-5.3.2-12.2 libQt5Test5-5.3.2-12.2 libQt5Test5-debuginfo-5.3.2-12.2 libQt5Widgets-devel-5.3.2-12.2 libQt5Widgets5-5.3.2-12.2 libQt5Widgets5-debuginfo-5.3.2-12.2 libQt5Xml-devel-5.3.2-12.2 libQt5Xml5-5.3.2-12.2 libQt5Xml5-debuginfo-5.3.2-12.2 libqt5-qtbase-common-devel-5.3.2-12.2 libqt5-qtbase-common-devel-debuginfo-5.3.2-12.2 libqt5-qtbase-debugsource-5.3.2-12.2 libqt5-qtbase-devel-5.3.2-12.2 libqt5-qtbase-doc-5.3.2-12.2 libqt5-qtbase-doc-debuginfo-5.3.2-12.2 libqt5-qtbase-examples-5.3.2-12.2 libqt5-qtbase-examples-debuginfo-5.3.2-12.2 - openSUSE 13.2 (x86_64): libQt5Bootstrap-devel-static-32bit-5.3.2-12.2 libQt5Concurrent-devel-32bit-5.3.2-12.2 libQt5Concurrent5-32bit-5.3.2-12.2 libQt5Concurrent5-debuginfo-32bit-5.3.2-12.2 libQt5Core-devel-32bit-5.3.2-12.2 libQt5Core5-32bit-5.3.2-12.2 libQt5Core5-debuginfo-32bit-5.3.2-12.2 libQt5DBus-devel-32bit-5.3.2-12.2 libQt5DBus-devel-debuginfo-32bit-5.3.2-12.2 libQt5DBus5-32bit-5.3.2-12.2 libQt5DBus5-debuginfo-32bit-5.3.2-12.2 libQt5Gui-devel-32bit-5.3.2-12.2 libQt5Gui5-32bit-5.3.2-12.2 libQt5Gui5-debuginfo-32bit-5.3.2-12.2 libQt5Network-devel-32bit-5.3.2-12.2 libQt5Network5-32bit-5.3.2-12.2 libQt5Network5-debuginfo-32bit-5.3.2-12.2 libQt5OpenGL-devel-32bit-5.3.2-12.2 libQt5OpenGL5-32bit-5.3.2-12.2 libQt5OpenGL5-debuginfo-32bit-5.3.2-12.2 libQt5OpenGLExtensions-devel-static-32bit-5.3.2-12.2 libQt5PlatformSupport-devel-static-32bit-5.3.2-12.2 libQt5PrintSupport-devel-32bit-5.3.2-12.2 libQt5PrintSupport5-32bit-5.3.2-12.2 libQt5PrintSupport5-debuginfo-32bit-5.3.2-12.2 libQt5Sql-devel-32bit-5.3.2-12.2 libQt5Sql5-32bit-5.3.2-12.2 libQt5Sql5-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-mysql-32bit-5.3.2-12.2 libQt5Sql5-mysql-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-postgresql-32bit-5.3.2-12.2 libQt5Sql5-postgresql-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-sqlite-32bit-5.3.2-12.2 libQt5Sql5-sqlite-debuginfo-32bit-5.3.2-12.2 libQt5Sql5-unixODBC-32bit-5.3.2-12.2 libQt5Sql5-unixODBC-debuginfo-32bit-5.3.2-12.2 libQt5Test-devel-32bit-5.3.2-12.2 libQt5Test5-32bit-5.3.2-12.2 libQt5Test5-debuginfo-32bit-5.3.2-12.2 libQt5Widgets-devel-32bit-5.3.2-12.2 libQt5Widgets5-32bit-5.3.2-12.2 libQt5Widgets5-debuginfo-32bit-5.3.2-12.2 libQt5Xml-devel-32bit-5.3.2-12.2 libQt5Xml5-32bit-5.3.2-12.2 libQt5Xml5-debuginfo-32bit-5.3.2-12.2 libqt5-qtbase-examples-32bit-5.3.2-12.2 libqt5-qtbase-examples-debuginfo-32bit-5.3.2-12.2 - openSUSE 13.2 (noarch): libQt5Core-private-headers-devel-5.3.2-12.2 libQt5DBus-private-headers-devel-5.3.2-12.2 libQt5Gui-private-headers-devel-5.3.2-12.2 libQt5Network-private-headers-devel-5.3.2-12.2 libQt5OpenGL-private-headers-devel-5.3.2-12.2 libQt5PlatformSupport-private-headers-devel-5.3.2-12.2 libQt5PrintSupport-private-headers-devel-5.3.2-12.2 libQt5Sql-private-headers-devel-5.3.2-12.2 libQt5Test-private-headers-devel-5.3.2-12.2 libQt5Widgets-private-headers-devel-5.3.2-12.2 libqt5-qtbase-private-headers-devel-5.3.2-12.2 References: https://bugzilla.suse.com/show_bug.cgi?id=870151

1 0

openSUSE-SU-2015:0117-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0117-1 Rating: moderate References: #910988 Cross-References: CVE-2014-9324 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following issue: CVE-2014-9324: The GenericInterface in OTRS Help Desk access-control problems (bnc#910988) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-53 - openSUSE 13.1: zypper in -t patch openSUSE-2015-53 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): otrs-3.3.11-4.1 otrs-doc-3.3.11-4.1 otrs-itsm-3.3.11-4.1 - openSUSE 13.1 (noarch): otrs-3.2.17-31.13.1 otrs-doc-3.2.17-31.13.1 otrs-itsm-3.2.9-31.13.1 References: http://support.novell.com/security/cve/CVE-2014-9324.html https://bugzilla.suse.com/show_bug.cgi?id=910988

1 0

openSUSE-SU-2015:0116-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0116-1 Rating: moderate References: #913095 Cross-References: CVE-2014-9587 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: roundcubemail was updated to 1.0.4 fixing bugs and security issues. Changes: * Disable TinyMCE contextmenu plugin as there are more cons than pros in using it (#1490118) * Fix bug where show_real_foldernames setting wasn't honored on compose page (#1490153) * Fix issue where Archive folder wasn't protected in Folder Manager (#1490154) * Fix compatibility with PHP 5.2. in rcube_imap_generic (#1490115) * Fix setting flags on servers with no PERMANENTFLAGS response (#1490087) * Fix regression in SHAA password generation in ldap driver of password plugin (#1490094) * Fix displaying of HTML messages with absolutely positioned elements in Larry skin (#1490103) * Fix font style display issue in HTML messages with styled <span> elements (#1490101) * Fix download of attachments that are part of TNEF message (#1490091) * Fix handling of uuencoded messages if messages_cache is enabled (#1490108) * Fix handling of base64-encoded attachments with extra spaces (#1490111) * Fix handling of UNKNOWN-CTE response, try do decode content client-side (#1490046) * Fix bug where creating subfolders in shared folders wasn't possible without ACL extension (#1490113) * Fix reply scrolling issue with text mode and start message below the quote (#1490114) * Fix possible issues in skin/skin_path config handling (#1490125) * Fix lack of delimiter for recipient addresses in smtp_log (#1490150) * Fix generation of Blowfish-based password hashes (#1490184) * Fix bugs where CSRF attacks were still possible on some requests (CVE-2014-9587) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-58 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.4-4.1 References: http://support.novell.com/security/cve/CVE-2014-9587.html https://bugzilla.suse.com/show_bug.cgi?id=913095

1 0

openSUSE-RU-2015:0115-1: moderate: alpine-branding-openSUSE
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: alpine-branding-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0115-1 Rating: moderate References: #912611 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for alpine-branding-openSUSE fixes the following issue: - boo#912611: Disable IMAP-over-SSH by defualt Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-51 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): alpine-branding-openSUSE-0-2.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912611

1 0

openSUSE-SU-2015:0114-1: moderate: Security update for strongswan
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0114-1 Rating: moderate References: #897048 #897512 #910491 Cross-References: CVE-2014-9221 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update fixes the following security issues: - denial-of-service vulnerability, which can be triggered by an IKEv2 Key Exchange payload, that contains the Diffie-Hellman group 1025 (bsc#910491,CVE-2014-9221). - Applied an upstream patch reverting to store algorithms in the registration order again as ordering them by identifier caused weaker algorithms to be proposed first by default (bsc#897512). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-54 - openSUSE 13.1: zypper in -t patch openSUSE-2015-54 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): strongswan-5.1.3-4.4.1 strongswan-debugsource-5.1.3-4.4.1 strongswan-ipsec-5.1.3-4.4.1 strongswan-ipsec-debuginfo-5.1.3-4.4.1 strongswan-libs0-5.1.3-4.4.1 strongswan-libs0-debuginfo-5.1.3-4.4.1 strongswan-mysql-5.1.3-4.4.1 strongswan-mysql-debuginfo-5.1.3-4.4.1 strongswan-nm-5.1.3-4.4.1 strongswan-nm-debuginfo-5.1.3-4.4.1 strongswan-sqlite-5.1.3-4.4.1 strongswan-sqlite-debuginfo-5.1.3-4.4.1 - openSUSE 13.2 (noarch): strongswan-doc-5.1.3-4.4.1 - openSUSE 13.1 (i586 x86_64): strongswan-5.1.1-8.1 strongswan-debugsource-5.1.1-8.1 strongswan-ipsec-5.1.1-8.1 strongswan-ipsec-debuginfo-5.1.1-8.1 strongswan-libs0-5.1.1-8.1 strongswan-libs0-debuginfo-5.1.1-8.1 strongswan-mysql-5.1.1-8.1 strongswan-mysql-debuginfo-5.1.1-8.1 strongswan-nm-5.1.1-8.1 strongswan-nm-debuginfo-5.1.1-8.1 strongswan-sqlite-5.1.1-8.1 strongswan-sqlite-debuginfo-5.1.1-8.1 - openSUSE 13.1 (noarch): strongswan-doc-5.1.1-8.1 References: http://support.novell.com/security/cve/CVE-2014-9221.html https://bugzilla.suse.com/show_bug.cgi?id=897048 https://bugzilla.suse.com/show_bug.cgi?id=897512 https://bugzilla.suse.com/show_bug.cgi?id=910491

1 0

openSUSE-SU-2015:0113-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0113-1 Rating: moderate References: #912365 #912368 #912369 #912370 #912372 Cross-References: CVE-2015-0559 CVE-2015-0560 CVE-2015-0561 CVE-2015-0562 CVE-2015-0563 CVE-2015-0564 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update fixes the following security issues: + The WCCP dissector could crash wnpa-sec-2015-01 CVE-2015-0559 CVE-2015-0560 [boo#912365] + The LPP dissector could crash. wnpa-sec-2015-02 CVE-2015-0561 [boo#912368] + The DEC DNA Routing Protocol dissector could crash. wnpa-sec-2015-03 CVE-2015-0562 [boo#912369] + The SMTP dissector could crash. wnpa-sec-2015-04 CVE-2015-0563 [boo#912370] + Wireshark could crash while decypting TLS/SSL sessions. wnpa-sec-2015-05 CVE-2015-0564 [boo#912372] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-52 - openSUSE 13.1: zypper in -t patch openSUSE-2015-52 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wireshark-1.12.3-8.1 wireshark-debuginfo-1.12.3-8.1 wireshark-debugsource-1.12.3-8.1 wireshark-devel-1.12.3-8.1 wireshark-ui-gtk-1.12.3-8.1 wireshark-ui-gtk-debuginfo-1.12.3-8.1 wireshark-ui-qt-1.12.3-8.1 wireshark-ui-qt-debuginfo-1.12.3-8.1 - openSUSE 13.1 (i586 x86_64): wireshark-1.10.12-32.1 wireshark-debuginfo-1.10.12-32.1 wireshark-debugsource-1.10.12-32.1 wireshark-devel-1.10.12-32.1 References: http://support.novell.com/security/cve/CVE-2015-0559.html http://support.novell.com/security/cve/CVE-2015-0560.html http://support.novell.com/security/cve/CVE-2015-0561.html http://support.novell.com/security/cve/CVE-2015-0562.html http://support.novell.com/security/cve/CVE-2015-0563.html http://support.novell.com/security/cve/CVE-2015-0564.html https://bugzilla.suse.com/show_bug.cgi?id=912365 https://bugzilla.suse.com/show_bug.cgi?id=912368 https://bugzilla.suse.com/show_bug.cgi?id=912369 https://bugzilla.suse.com/show_bug.cgi?id=912370 https://bugzilla.suse.com/show_bug.cgi?id=912372

1 0

openSUSE-RU-2015:0112-1: moderate: Recommended update for spamassassin
by maintenance＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Recommended Update: Recommended update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0112-1 Rating: moderate References: #911355 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for spamassassin fixes the following issue: - Run sa-update before starting service (bnc#911355) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-62 - openSUSE 13.1: zypper in -t patch openSUSE-2015-62 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): perl-Mail-SpamAssassin-3.4.0-44.4.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-44.4.1 spamassassin-3.4.0-44.4.1 spamassassin-debuginfo-3.4.0-44.4.1 spamassassin-debugsource-3.4.0-44.4.1 - openSUSE 13.1 (i586 x86_64): perl-Mail-SpamAssassin-3.3.2-37.8.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-37.8.1 spamassassin-3.3.2-37.8.1 spamassassin-debuginfo-3.3.2-37.8.1 spamassassin-debugsource-3.3.2-37.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911355

1 0

openSUSE-SU-2015:0111-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0111-1 Rating: moderate References: #912016 Cross-References: CVE-2012-3524 CVE-2014-8148 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues: * CVE-2014-8148: - Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment. * CVE-2012-3524: Don't access environment variables (bnc#912016) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-50 - openSUSE 13.1: zypper in -t patch openSUSE-2015-50 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dbus-1-1.8.14-12.2 dbus-1-debuginfo-1.8.14-12.2 dbus-1-debugsource-1.8.14-12.1 dbus-1-devel-1.8.14-12.1 dbus-1-x11-1.8.14-12.2 dbus-1-x11-debuginfo-1.8.14-12.2 dbus-1-x11-debugsource-1.8.14-12.2 libdbus-1-3-1.8.14-12.1 libdbus-1-3-debuginfo-1.8.14-12.1 - openSUSE 13.2 (x86_64): dbus-1-debuginfo-32bit-1.8.14-12.2 dbus-1-devel-32bit-1.8.14-12.1 libdbus-1-3-32bit-1.8.14-12.1 libdbus-1-3-debuginfo-32bit-1.8.14-12.1 - openSUSE 13.2 (noarch): dbus-1-devel-doc-1.8.14-12.2 - openSUSE 13.1 (i586 x86_64): dbus-1-1.8.14-4.32.3 dbus-1-debuginfo-1.8.14-4.32.3 dbus-1-debugsource-1.8.14-4.32.1 dbus-1-devel-1.8.14-4.32.1 dbus-1-x11-1.8.14-4.32.3 dbus-1-x11-debuginfo-1.8.14-4.32.3 dbus-1-x11-debugsource-1.8.14-4.32.3 libdbus-1-3-1.8.14-4.32.1 libdbus-1-3-debuginfo-1.8.14-4.32.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.8.14-4.32.3 dbus-1-devel-32bit-1.8.14-4.32.1 libdbus-1-3-32bit-1.8.14-4.32.1 libdbus-1-3-debuginfo-32bit-1.8.14-4.32.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.8.14-4.32.3 References: http://support.novell.com/security/cve/CVE-2012-3524.html http://support.novell.com/security/cve/CVE-2014-8148.html https://bugzilla.suse.com/show_bug.cgi?id=912016

1 0

openSUSE-SU-2015:0110-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0110-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-49 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-49 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.438-2.25.1 flash-player-gnome-11.2.202.438-2.25.1 flash-player-kde4-11.2.202.438-2.25.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.438-90.1 flash-player-gnome-11.2.202.438-90.1 flash-player-kde4-11.2.202.438-90.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333

1 0

openSUSE-RU-2015:0098-1: moderate: apache2
by maintenance＠opensuse.org 21 Jan '15

21 Jan '15

openSUSE Recommended Update: apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0098-1 Rating: moderate References: #859439 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for apache2 fixes the following issues: - boo#859439: Fixed service reload can cause log data to be lost with logrotate under some circumstances. Remove "-t" from service reload. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-47 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): apache2-2.4.10-12.1 apache2-debuginfo-2.4.10-12.1 apache2-debugsource-2.4.10-12.1 apache2-devel-2.4.10-12.1 apache2-event-2.4.10-12.1 apache2-event-debuginfo-2.4.10-12.1 apache2-example-pages-2.4.10-12.1 apache2-prefork-2.4.10-12.1 apache2-prefork-debuginfo-2.4.10-12.1 apache2-utils-2.4.10-12.1 apache2-utils-debuginfo-2.4.10-12.1 apache2-worker-2.4.10-12.1 apache2-worker-debuginfo-2.4.10-12.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-12.1 apache2-doc-2.4.10-8.1 - openSUSE 13.2 (i586): apache2-2.4.10-8.1 apache2-debuginfo-2.4.10-8.1 apache2-debugsource-2.4.10-8.1 apache2-devel-2.4.10-8.1 apache2-event-2.4.10-8.1 apache2-event-debuginfo-2.4.10-8.1 apache2-example-pages-2.4.10-8.1 apache2-prefork-2.4.10-8.1 apache2-prefork-debuginfo-2.4.10-8.1 apache2-utils-2.4.10-8.1 apache2-utils-debuginfo-2.4.10-8.1 apache2-worker-2.4.10-8.1 apache2-worker-debuginfo-2.4.10-8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=859439

1 0

openSUSE-RU-2015:0097-1: moderate: tigervnc
by maintenance＠opensuse.org 21 Jan '15

21 Jan '15

openSUSE Recommended Update: tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0097-1 Rating: moderate References: #911577 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This reommended update provides the current version 1.4.1 for tigervnc and 1.16.1 for X server with various fixes and improvements. - boo#911577: fixed unresolved symbol in libvnc - For a detailed changelog please see https://github.com/TigerVNC/tigervnc/releases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.18.1 tigervnc-debuginfo-1.4.1-6.18.1 tigervnc-debugsource-1.4.1-6.18.1 xorg-x11-Xvnc-1.4.1-6.18.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.18.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911577

1 0

openSUSE-RU-2015:0091-1: moderate: rpm
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: rpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0091-1 Rating: moderate References: #911228 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended udpate for rpm fixes the following issue: - boo#911228: fix noglob patch, which broke files with spaces Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-45 - openSUSE 13.1: zypper in -t patch openSUSE-2015-45 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python3-rpm-4.11.3-8.1 python3-rpm-debuginfo-4.11.3-8.1 python3-rpm-debugsource-4.11.3-8.1 rpm-4.11.3-8.1 rpm-build-4.11.3-8.1 rpm-build-debuginfo-4.11.3-8.1 rpm-debuginfo-4.11.3-8.1 rpm-debugsource-4.11.3-8.1 rpm-devel-4.11.3-8.1 rpm-python-4.11.3-8.1 rpm-python-debuginfo-4.11.3-8.1 rpm-python-debugsource-4.11.3-8.1 - openSUSE 13.2 (x86_64): rpm-32bit-4.11.3-8.1 rpm-debuginfo-32bit-4.11.3-8.1 - openSUSE 13.1 (i586 x86_64): python3-rpm-4.11.1-6.13.1 python3-rpm-debuginfo-4.11.1-6.13.1 python3-rpm-debugsource-4.11.1-6.13.1 rpm-4.11.1-6.13.1 rpm-build-4.11.1-6.13.1 rpm-build-debuginfo-4.11.1-6.13.1 rpm-debuginfo-4.11.1-6.13.1 rpm-debugsource-4.11.1-6.13.1 rpm-devel-4.11.1-6.13.1 rpm-python-4.11.1-6.13.1 rpm-python-debuginfo-4.11.1-6.13.1 rpm-python-debugsource-4.11.1-6.13.1 - openSUSE 13.1 (x86_64): rpm-32bit-4.11.1-6.13.1 rpm-debuginfo-32bit-4.11.1-6.13.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911228

1 0

openSUSE-RU-2015:0090-1: findutils
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: findutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0090-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for findutils fixes the following issues: - Add upstream patch to fix 'oldfind' which skipped all files starting with ".." (e.g. "..file"). - Add BuildRequires:dejagnu - otherwise only a very limited set of the tests was run by 'make check'. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): findutils-4.5.14-2.4.1 findutils-debuginfo-4.5.14-2.4.1 findutils-debugsource-4.5.14-2.4.1 - openSUSE 13.2 (noarch): findutils-lang-4.5.14-2.4.1 References:

1 0

openSUSE-RU-2015:0089-1: fonts-config
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: fonts-config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0089-1 Rating: low References: #912279 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for fonts-config fixes the following issues: - Run fonts-config whenever sysconfig variable is changed via yast sysconfig module. - bnc#912279: added Command "metadata" to relevant sysconfig variables Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-44 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): fonts-config-20140604-3.5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912279

1 0

openSUSE-RU-2015:0085-1: moderate: recommended softwarestack-update for openSUSE 13.2
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: recommended softwarestack-update for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0085-1 Rating: moderate References: #848054 #892431 #899510 #899781 #901590 #901691 #903675 #904737 #906549 #908135 #908345 #908976 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 12 recommended fixes can now be installed. Description: This recommended softwarestack-update for openSUSE fixes the following issues: - zypper: + Warn about repositories with 'gpgcheck=0' (bnc#848054) + search: fix --verbose implies --details + Enhance 'Digest verification failed' dialog (FATE#315008) + Summary: quote names including spaces (bnc#903675) + Provide missing man pages + Create man pages from asciidoc + Warn if legacy CLI options are used (bnc#899781) + Update translations - libzypp: + Adapt to gpg-2.1 (bnc#908135) + rpm: do not obsolete yast2-packagemanager-devel by libzypp-devel-doc + replaceAll: fix endless loop on empty search string + Do not provide/obsolete yast2-packagemanager-devel by the -doc package: the -devel package already does that. + Call rpm with '--noglob' (bnc#892431) + Downloader: unify workflow downloading a (signed) master index file + Fix iostream includes + Explicitly call libsolv:pool_setdisttype + doc: add hint to code 12 pattern packages + MediaCurl: Fix URL path concatenation (bnc#901590) + Move doxygen html doc to libzypp-devel-doc (bnc#901691) + Remove non-breaking spaces from changes file + Control lifetime of downloaded mirrorlist + Store baseurls in list as order expresses preference + Support parsing multiple baseurls from a repo file (bnc#899510) + Fix handling local mirrorlist= files in .repo (bnc#899510) + Provide missing man pages + Enable building autodocs, translations and test per default on debian + Fix several typos in output messages and comments + Make the include dir path configurable + Update translations - libzypp-bindings + Adapt to libzypp changes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-42 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): PackageKit-1.0.3-7.1 PackageKit-backend-zypp-1.0.3-7.1 PackageKit-backend-zypp-debuginfo-1.0.3-7.1 PackageKit-browser-plugin-1.0.3-7.1 PackageKit-browser-plugin-debuginfo-1.0.3-7.1 PackageKit-debuginfo-1.0.3-7.1 PackageKit-debugsource-1.0.3-7.1 PackageKit-devel-1.0.3-7.1 PackageKit-devel-debuginfo-1.0.3-7.1 PackageKit-gstreamer-plugin-1.0.3-7.1 PackageKit-gstreamer-plugin-debuginfo-1.0.3-7.1 PackageKit-gtk3-module-1.0.3-7.1 PackageKit-gtk3-module-debuginfo-1.0.3-7.1 libpackagekit-glib2-18-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-1.0.3-7.1 libpackagekit-glib2-devel-1.0.3-7.1 libyui-gtk-pkg-debugsource-2.43.2-2.3.2 libyui-gtk-pkg-devel-2.43.2-2.3.2 libyui-gtk-pkg6-2.43.2-2.3.2 libyui-gtk-pkg6-debuginfo-2.43.2-2.3.2 libyui-ncurses-pkg-debugsource-2.46.1-2.3.2 libyui-ncurses-pkg-devel-2.46.1-2.3.2 libyui-ncurses-pkg6-2.46.1-2.3.2 libyui-ncurses-pkg6-debuginfo-2.46.1-2.3.2 libyui-qt-pkg-debugsource-2.44.7-3.2 libyui-qt-pkg-devel-2.44.7-3.2 libyui-qt-pkg6-2.44.7-3.2 libyui-qt-pkg6-debuginfo-2.44.7-3.2 libzypp-14.32.0-5.3 libzypp-bindings-debugsource-0.6.4-6.1 libzypp-debuginfo-14.32.0-5.3 libzypp-debugsource-14.32.0-5.3 libzypp-devel-14.32.0-5.3 libzypp-devel-doc-14.32.0-5.3 perl-zypp-0.6.4-6.1 perl-zypp-debuginfo-0.6.4-6.1 python-zypp-0.6.4-6.1 python-zypp-debuginfo-0.6.4-6.1 ruby-zypp-0.6.4-6.1 ruby-zypp-debuginfo-0.6.4-6.1 typelib-1_0-PackageKitGlib-1_0-1.0.3-7.1 yast2-pkg-bindings-3.1.20-3.2 yast2-pkg-bindings-debuginfo-3.1.20-3.2 yast2-pkg-bindings-debugsource-3.1.20-3.2 zypper-1.11.17-5.1 zypper-debuginfo-1.11.17-5.1 zypper-debugsource-1.11.17-5.1 - openSUSE 13.2 (x86_64): libpackagekit-glib2-18-32bit-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-32bit-1.0.3-7.1 libpackagekit-glib2-devel-32bit-1.0.3-7.1 - openSUSE 13.2 (noarch): PackageKit-branding-openSUSE-13.2-2.4.1 PackageKit-branding-upstream-1.0.3-7.1 PackageKit-lang-1.0.3-7.1 libyui-gtk-pkg-doc-2.43.2-2.3.2 libyui-ncurses-pkg-doc-2.46.1-2.3.2 libyui-qt-pkg-doc-2.44.7-3.2 yast2-pkg-bindings-devel-doc-3.1.20-3.2 zypper-aptitude-1.11.17-5.1 zypper-log-1.11.17-5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=848054 https://bugzilla.suse.com/show_bug.cgi?id=892431 https://bugzilla.suse.com/show_bug.cgi?id=899510 https://bugzilla.suse.com/show_bug.cgi?id=899781 https://bugzilla.suse.com/show_bug.cgi?id=901590 https://bugzilla.suse.com/show_bug.cgi?id=901691 https://bugzilla.suse.com/show_bug.cgi?id=903675 https://bugzilla.suse.com/show_bug.cgi?id=904737 https://bugzilla.suse.com/show_bug.cgi?id=906549 https://bugzilla.suse.com/show_bug.cgi?id=908135 https://bugzilla.suse.com/show_bug.cgi?id=908345 https://bugzilla.suse.com/show_bug.cgi?id=908976

1 0

openSUSE-RU-2015:0081-1: moderate: Recommended update for polkit
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: Recommended update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0081-1 Rating: moderate References: #912889 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The polkit library was updated to fix a memory leak that was exposed by the KDE PowerDevil application. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-41 - openSUSE 13.1: zypper in -t patch openSUSE-2015-41 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpolkit0-0.112-3.5.1 libpolkit0-debuginfo-0.112-3.5.1 polkit-0.112-3.5.1 polkit-debuginfo-0.112-3.5.1 polkit-debugsource-0.112-3.5.1 polkit-devel-0.112-3.5.1 polkit-devel-debuginfo-0.112-3.5.1 typelib-1_0-Polkit-1_0-0.112-3.5.1 - openSUSE 13.2 (x86_64): libpolkit0-32bit-0.112-3.5.1 libpolkit0-debuginfo-32bit-0.112-3.5.1 - openSUSE 13.2 (noarch): polkit-doc-0.112-3.5.1 - openSUSE 13.1 (i586 x86_64): libpolkit0-0.112-6.1 libpolkit0-debuginfo-0.112-6.1 polkit-0.112-6.1 polkit-debuginfo-0.112-6.1 polkit-debugsource-0.112-6.1 polkit-devel-0.112-6.1 polkit-devel-debuginfo-0.112-6.1 typelib-1_0-Polkit-1_0-0.112-6.1 - openSUSE 13.1 (x86_64): libpolkit0-32bit-0.112-6.1 libpolkit0-debuginfo-32bit-0.112-6.1 - openSUSE 13.1 (noarch): polkit-doc-0.112-6.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912889

1 0

openSUSE-SU-2015:0077-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-2 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-35.0-9.1 MozillaFirefox-branding-upstream-35.0-9.1 MozillaFirefox-buildsymbols-35.0-9.1 MozillaFirefox-debuginfo-35.0-9.1 MozillaFirefox-debugsource-35.0-9.1 MozillaFirefox-devel-35.0-9.1 MozillaFirefox-translations-common-35.0-9.1 MozillaFirefox-translations-other-35.0-9.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0

openSUSE-SU-2015:0079-1: Security update for vsftpd
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0079-1 Rating: low References: #900326 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for vsftpd fixes the following security issue: - Fixed deny_file parsing to do more what is expected. bnc#900326 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-38 - openSUSE 13.1: zypper in -t patch openSUSE-2015-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): vsftpd-3.0.2-14.5.1 vsftpd-debuginfo-3.0.2-14.5.1 vsftpd-debugsource-3.0.2-14.5.1 - openSUSE 13.1 (i586 x86_64): vsftpd-3.0.2-10.8.1 vsftpd-debuginfo-3.0.2-10.8.1 vsftpd-debugsource-3.0.2-10.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900326

1 0

openSUSE-SU-2015:0078-1: moderate: Security Update for openstack-dashboard
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security Update for openstack-dashboard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0078-1 Rating: moderate References: #852175 #869696 #871855 #885588 #891815 #908199 Cross-References: CVE-2013-6858 CVE-2014-0157 CVE-2014-3473 CVE-2014-3474 CVE-2014-3475 CVE-2014-3594 CVE-2014-8124 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: OpenStack Dashboard was updated to fix bugs and security issues. Full changes: - Update to version horizon-2013.2.5.dev2.g9ee7273: * fix Horizon login page DOS attack (bnc#908199, CVE-2014-8124) * update version to 2013.2.5 * Updated from global requirements * Pin docutils to 0.9.1 * Set python hash seed to 0 in tox.ini * Check host is not none in each availability zone * Fix XSS issue with the unordered_list filter (bnc#891815, CVE-2014-3594) + 0001-Use-default_project_id-for-v3-users.patch (manually) * Replace UserManager with None in tests * Update test-requirements to fix sphinx build_doc * Fix multiple Cross-Site Scripting (XSS) vulnerabilities (bnc#885588, CVE-2014-3473, CVE-2014-3474, CVE-2014-3475) * Fix issues with importing the Login form Bug 869696 - Admin password injection on Horizon Dashboard is broken. - Update to version horizon-2013.2.4.dev8.g07c097f: * Bug fix on neutron's API to return the correct target ID * Fix display of images in Rebuild Instance * Get instance networking information from Neutron * Bump stable/havana next version to 2013.2.4 * Do not release FIP on disassociate action * Introduces escaping in Horizon/Orchestration 2013.2.3 (bnc#871855, CVE-2014-0157) - Update to version horizon-2013.2.3.dev8.g3d04c3c: * Reduce number of novaclient calls * Don't copy the flavorid when updating flavors * Allow snapshots of paused and suspended instances * Fixing tests to work with keystoneclient 0.6.0 * Bump stable/havana next version to 2013.2.3 + Use upstream URL as source (enables verification) + Import translations for Havana 2013.2.2 udpate - Update to version 2013.2.2.dev29.g96bd650: + Update Transifex resource name for havana + Fix inappropriate logouts on load-balanced Horizon - Update to version 2013.2.2.dev25.g6508afd: + disable volume creation, when cinder is disabled + Bad workflow-steps check: has_required_fields + Specify tenant_id when retrieving LBaaS/VPNaaS resource - Update to version 2013.2.2.dev19.g7a8eadc: + Give HealthMonitor a proper display name - Update to version 2013.2.2.dev17.gaa55b24: + Common keystone version fallback - Move settings.py (default settings) to branding-upstream subpackage: a branding package might want to change some default settings. - add 0001-Common-keystone-version-fallback.patch, 0001-Use-default_project_id-for-v3-users.patch - Update to version 2013.2.2.dev15.g2b6dfa7: + fix help text in "Create An image" window + Change how scrollShift is calculated + unify keypair name handling - Add 0001-Give-no-background-color-to-the-pie-charts.patch: do not give a background color to pie charts. - Update to version 2013.2.2.dev9.gc6d38a1: + Wrong marker sent to keystone - Update to version 2013.2.2.dev7.g2e11482: + Adding management_url to test mock client - add 0001-Bad-workflow-steps-check-has_required_fields.patch - Make python-horizon require the 2013.2 version of python-horizon-branding (and not the 2013.2.xyz version). This makes it easier to create non-upstream branding; we already do this for the other branding subpackage. - Update to version 2013.2.2.dev6.g2c1f1f3: + Add check for BlockDeviceMappingV2 nova extension + Gracefully handle Users with no email attribute + Import install_venv from oslo + Bump stable/havana next version to 2013.2.2 - Update to version 2013.2.1.dev41.g9668e80: + Updated from global requirements - put everything under /srv/www/openstack-dashboard - Update to version 2013.2.1.dev40.g852e5c8: + Import translations for Havana 2013.2.1 udpate + Deleting statistics tables from resource usage page + Allow "Working" in spinner to be translatable + lbaas/horizon - adds tcp protocol choice when create lb + Fix a bug some optional field in LBaaS are mandatory + Fix bug so that escaped html is not shown in volume detach dialog + Role name should not be translated in Domain Groups dialog + Fix incomplete translation of "Update members" widget + Fix translatable string for "Injected File Path Bytes" + Add extra extension file to makemessage command line + Add contextual markers to BatchAction messages + Logging user out after self password change + Add logging configuration for iso8601 module + Ensure all compute meters are listed in dropdown + Fix bug by escaping strings from Nova before displaying them (bnc#852175, CVE-2013-6858) - add/use generic openstack-branding provides - Update to version 2013.2.1.dev9.g842ba5f: + Fix default port of MS SQL in security group template + Provide missing hover hints for instance:<type> meters + translate text: "subnet"/"subnet details" + Change "Tenant" to "Project" + Avoid discarding precision of metering data - Use Django's signed_cookies session backend like upstream and drop the usage of cache_db - No need to set SECRET_KEY anymore, upstream learned it too python-django_openstack_auth was updated to 1.1.3: - Various i18n fixes - Revoke tokens when logging out or changing the tenant - Run tests locally, therefore merge test package back into main - Properly build HTML documentation and install it - Add pt_BR locale - Updated (build) requirements - Add django_openstack_auth-hacking-requires.patch: hacking dep is nonsense - include tests runner - add -test subpackage Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): openstack-dashboard-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-test-2013.2.5.dev2.g9ee7273-4.1 python-django_openstack_auth-1.1.3-4.1 python-horizon-2013.2.5.dev2.g9ee7273-4.1 python-horizon-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 References: http://support.novell.com/security/cve/CVE-2013-6858.html http://support.novell.com/security/cve/CVE-2014-0157.html http://support.novell.com/security/cve/CVE-2014-3473.html http://support.novell.com/security/cve/CVE-2014-3474.html http://support.novell.com/security/cve/CVE-2014-3475.html http://support.novell.com/security/cve/CVE-2014-3594.html http://support.novell.com/security/cve/CVE-2014-8124.html https://bugzilla.suse.com/show_bug.cgi?id=852175 https://bugzilla.suse.com/show_bug.cgi?id=869696 https://bugzilla.suse.com/show_bug.cgi?id=871855 https://bugzilla.suse.com/show_bug.cgi?id=885588 https://bugzilla.suse.com/show_bug.cgi?id=891815 https://bugzilla.suse.com/show_bug.cgi?id=908199

1 0

openSUSE-SU-2015:0077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-1 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-35.0-54.2 MozillaFirefox-branding-upstream-35.0-54.2 MozillaFirefox-buildsymbols-35.0-54.2 MozillaFirefox-debuginfo-35.0-54.2 MozillaFirefox-debugsource-35.0-54.2 MozillaFirefox-devel-35.0-54.2 MozillaFirefox-translations-common-35.0-54.2 MozillaFirefox-translations-other-35.0-54.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0