October 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1830-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 27 Oct '15

27 Oct '15

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1830-1 Rating: moderate References: #950707 #950708 Cross-References: CVE-2015-5333 CVE-2015-5334 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libressl was updated to fix two security issues. These security issues were fixed: - CVE-2015-5333: Memory leak when decoding X.509 certificates (boo#950707) - CVE-2015-5334: Buffer overflow when decoding X.509 certificates (boo#950708) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-681=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcrypto34-2.2.1-2.6.1 libcrypto34-debuginfo-2.2.1-2.6.1 libressl-2.2.1-2.6.1 libressl-debuginfo-2.2.1-2.6.1 libressl-debugsource-2.2.1-2.6.1 libressl-devel-2.2.1-2.6.1 libssl33-2.2.1-2.6.1 libssl33-debuginfo-2.2.1-2.6.1 libtls4-2.2.1-2.6.1 libtls4-debuginfo-2.2.1-2.6.1 - openSUSE 13.2 (x86_64): libcrypto34-32bit-2.2.1-2.6.1 libcrypto34-debuginfo-32bit-2.2.1-2.6.1 libressl-devel-32bit-2.2.1-2.6.1 libssl33-32bit-2.2.1-2.6.1 libssl33-debuginfo-32bit-2.2.1-2.6.1 libtls4-32bit-2.2.1-2.6.1 libtls4-debuginfo-32bit-2.2.1-2.6.1 - openSUSE 13.2 (noarch): libressl-devel-doc-2.2.1-2.6.1 References: https://www.suse.com/security/cve/CVE-2015-5333.html https://www.suse.com/security/cve/CVE-2015-5334.html https://bugzilla.suse.com/950707 https://bugzilla.suse.com/950708

1 0

openSUSE-SU-2015:1825-1: fix boo#948602 boo#948045
by opensuse-security＠opensuse.org 27 Oct '15

27 Oct '15

openSUSE Security Update: fix boo#948602 boo#948045 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1825-1 Rating: low References: #948045 #948602 Cross-References: CVE-2015-7384 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: * boo#948602/cve#2015-7384: HTTP Denial of Service Vulnerability * boo#948045: addon-rpm.gypi wasn't installed * Leap: update nodejs to 4.2.1 from 0.12.7 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-680=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-680=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): nodejs-4.2.1-2.6.1 nodejs-debuginfo-4.2.1-2.6.1 nodejs-debugsource-4.2.1-2.6.1 nodejs-devel-4.2.1-2.6.1 - openSUSE 13.2 (noarch): nodejs-doc-4.2.1-2.6.1 - openSUSE 13.1 (i586 x86_64): nodejs-4.2.1-3.10.1 nodejs-debuginfo-4.2.1-3.10.1 nodejs-debugsource-4.2.1-3.10.1 nodejs-devel-4.2.1-3.10.1 - openSUSE 13.1 (noarch): nodejs-doc-4.2.1-3.10.1 References: https://www.suse.com/security/cve/CVE-2015-7384.html https://bugzilla.suse.com/948045 https://bugzilla.suse.com/948602

1 0

openSUSE-SU-2015:1817-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 24 Oct '15

24 Oct '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1817-1 Rating: important References: #949983 #950686 Cross-References: CVE-2015-7184 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: MozillaFirefox was updated to version 41.0.2 to fix one security issue. This security issue was fixed: - CVE-2015-7184: Cross-origin restriction bypass using Fetch (bsc#950686). These non-security issues were fixed: * Fix a startup crash related to Yandex toolbar and Adblock Plus (bmo#1209124) * Fix potential hangs with Flash plugins (bmo#1185639) * Fix a regression in the bookmark creation (bmo#1206376) * Fix a startup crash with some Intel Media Accelerator 3150 graphic cards (bmo#1207665) * Fix a graphic crash, occurring occasionally on Facebook (bmo#1178601) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-678=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-678=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (ppc64 ppc64le): MozillaFirefox-41.0.2-47.1 MozillaFirefox-branding-upstream-41.0.2-47.1 MozillaFirefox-debuginfo-41.0.2-47.1 MozillaFirefox-debugsource-41.0.2-47.1 MozillaFirefox-devel-41.0.2-47.1 MozillaFirefox-translations-common-41.0.2-47.1 MozillaFirefox-translations-other-41.0.2-47.1 - openSUSE 13.1 (ppc64): MozillaFirefox-41.0.2-91.1 MozillaFirefox-branding-upstream-41.0.2-91.1 MozillaFirefox-debuginfo-41.0.2-91.1 MozillaFirefox-debugsource-41.0.2-91.1 MozillaFirefox-devel-41.0.2-91.1 MozillaFirefox-translations-common-41.0.2-91.1 MozillaFirefox-translations-other-41.0.2-91.1 References: https://www.suse.com/security/cve/CVE-2015-7184.html https://bugzilla.suse.com/949983 https://bugzilla.suse.com/950686

1 0

openSUSE-SU-2015:1816-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 24 Oct '15

24 Oct '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1816-1 Rating: moderate References: #950290 Cross-References: CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 CVE-2015-6764 CVE-2015-7834 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Chromium was update do the stable release 46.0.2490.71 to fix security issues. The following vulnerabilities were fixed: * CVE-2015-6755: Cross-origin bypass in Blink * CVE-2015-6756: Use-after-free in PDFium * CVE-2015-6757: Use-after-free in ServiceWorker * CVE-2015-6758: Bad-cast in PDFium * CVE-2015-6759: Information leakage in LocalStorage * CVE-2015-6760: Improper error handling in libANGLE * CVE-2015-6761: Memory corruption in FFMpeg * CVE-2015-6762: CORS bypass via CSS fonts * CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives. * CVE-2015-7834: Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-679=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-679=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (armv7hl): chromedriver-46.0.2490.71-54.1 chromedriver-debuginfo-46.0.2490.71-54.1 chromium-46.0.2490.71-54.1 chromium-debuginfo-46.0.2490.71-54.1 chromium-debugsource-46.0.2490.71-54.1 chromium-desktop-gnome-46.0.2490.71-54.1 chromium-desktop-kde-46.0.2490.71-54.1 chromium-ffmpegsumo-46.0.2490.71-54.1 chromium-ffmpegsumo-debuginfo-46.0.2490.71-54.1 - openSUSE 13.1 (armv7hl): chromedriver-46.0.2490.71-109.1 chromedriver-debuginfo-46.0.2490.71-109.1 chromium-46.0.2490.71-109.1 chromium-debuginfo-46.0.2490.71-109.1 chromium-debugsource-46.0.2490.71-109.1 chromium-desktop-gnome-46.0.2490.71-109.1 chromium-desktop-kde-46.0.2490.71-109.1 chromium-ffmpegsumo-46.0.2490.71-109.1 chromium-ffmpegsumo-debuginfo-46.0.2490.71-109.1 References: https://www.suse.com/security/cve/CVE-2015-6755.html https://www.suse.com/security/cve/CVE-2015-6756.html https://www.suse.com/security/cve/CVE-2015-6757.html https://www.suse.com/security/cve/CVE-2015-6758.html https://www.suse.com/security/cve/CVE-2015-6759.html https://www.suse.com/security/cve/CVE-2015-6760.html https://www.suse.com/security/cve/CVE-2015-6761.html https://www.suse.com/security/cve/CVE-2015-6762.html https://www.suse.com/security/cve/CVE-2015-6763.html https://www.suse.com/security/cve/CVE-2015-6764.html https://www.suse.com/security/cve/CVE-2015-7834.html https://bugzilla.suse.com/950290

1 0

openSUSE-SU-2015:1813-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 23 Oct '15

23 Oct '15

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1813-1 Rating: moderate References: #937522 #937523 Cross-References: CVE-2015-5143 CVE-2015-5144 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: python-django was updated to fix two security issues. These security issues were fixed: - CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used an incorrect regular expression, which allowed remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator (bsc#937523). - CVE-2015-5143: The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allowed remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys (bsc#937522). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-677=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-Django-1.6.11-3.10.1 References: https://www.suse.com/security/cve/CVE-2015-5143.html https://www.suse.com/security/cve/CVE-2015-5144.html https://bugzilla.suse.com/937522 https://bugzilla.suse.com/937523

1 0

openSUSE-RU-2015:1812-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 23 Oct '15

23 Oct '15

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1812-1 Rating: moderate References: #950147 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with tigervnc. - Prefer ANON-ECDH over ANON-DH cipher to avoid java bug. (bsc#950147) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-675=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.41.1 tigervnc-debuginfo-1.4.1-6.41.1 tigervnc-debugsource-1.4.1-6.41.1 xorg-x11-Xvnc-1.4.1-6.41.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.41.1 References: https://bugzilla.suse.com/950147

1 0

openSUSE-RU-2015:1811-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 23 Oct '15

23 Oct '15

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1811-1 Rating: moderate References: #940100 #947518 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut provides the following fixes and improvements. - Always install dm-snaphost module if lvm dracut module is needed, even if dm-snampshot is not loaded on the host yet (bsc#947518) - Revert 0176-Parse-rootflags-correctly.patch (bsc#940100) + The patch caused a regression and added quite some complexity. The bug (912734) which got fixed by the reverted patch is solved via documentation TID for now. It is worked (mainline/factory) for a proper solution which might get added later when properly tested. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-676=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dracut-037-17.27.1 dracut-debuginfo-037-17.27.1 dracut-debugsource-037-17.27.1 dracut-fips-037-17.27.1 References: https://bugzilla.suse.com/940100 https://bugzilla.suse.com/947518

1 0

openSUSE-SU-2015:1802-1: moderate: Security update for python-django
by opensuse-security＠opensuse.org 22 Oct '15

22 Oct '15

openSUSE Security Update: Security update for python-django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1802-1 Rating: moderate References: #937522 #937523 Cross-References: CVE-2015-5143 CVE-2015-5144 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: python-django was updated to fix two security issues. These security issues were fixed: - CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used an incorrect regular expression, which allowed remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator (bsc#937523). - CVE-2015-5143: The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allowed remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys (bsc#937522). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-674=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python-django-1.5.12-0.2.14.1 References: https://www.suse.com/security/cve/CVE-2015-5143.html https://www.suse.com/security/cve/CVE-2015-5144.html https://bugzilla.suse.com/937522 https://bugzilla.suse.com/937523

1 0

openSUSE-RU-2015:1797-1: Recommended udpate for at
by maintenance＠opensuse.org 21 Oct '15

21 Oct '15

openSUSE Recommended Update: Recommended udpate for at ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1797-1 Rating: low References: #945124 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for at fixes the following issue: - Prevent creation of corrupted files and their looping in malformed jobs (bsc#945124) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-673=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-673=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): at-3.1.15-7.1 at-debuginfo-3.1.15-7.1 at-debugsource-3.1.15-7.1 - openSUSE 13.1 (i586 x86_64): at-3.1.13-5.20.1 at-debuginfo-3.1.13-5.20.1 at-debugsource-3.1.13-5.20.1 References: https://bugzilla.suse.com/945124

1 0

openSUSE-RU-2015:1794-1: moderate: Recommended update for cifs-utils
by maintenance＠opensuse.org 21 Oct '15

21 Oct '15

openSUSE Recommended Update: Recommended update for cifs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1794-1 Rating: moderate References: #902947 #908023 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for cifs-utils fixes the following issues: - Ignore samba-client-libs at build-time on post-22 Fedora systems. - Add include_paths.h_for__PATH_MOUNTED.patch - Use rccifs -> service symlink for proper status (bnc#908023). - Remove dependency on gpg-offline as signature checking is implemented in the source validator. - Add README.cifstab.migration to document the cifstab removal; (bnc#902947). - Fix broken rccifs symbolic link. - Remove dead code associated with cifstab file which is no longer used. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-672=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cifs-utils-6.4-3.4.1 cifs-utils-debuginfo-6.4-3.4.1 cifs-utils-debugsource-6.4-3.4.1 cifs-utils-devel-6.4-3.4.1 pam_cifscreds-6.4-3.4.1 pam_cifscreds-debuginfo-6.4-3.4.1 References: https://bugzilla.suse.com/902947 https://bugzilla.suse.com/908023

1 0