October 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1734-1: important: Security update for polkit
by opensuse-security＠opensuse.org 14 Oct '15

14 Oct '15

openSUSE Security Update: Security update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1734-1 Rating: important References: #933922 #935119 #939246 #943816 Cross-References: CVE-2015-3218 CVE-2015-3255 CVE-2015-3256 CVE-2015-4625 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Polkit was updated to 0.113 to fix four security issues. The following vulnerabilities were fixed: * CVE-2015-4625: a local privilege escalation due to predictable authentication session cookie values. (boo#935119) * CVE-2015-3256: various memory corruption vulnerabilities in use of the JavaScript interpreter, possibly leading to local privilege escalation. (boo#943816) * CVE-2015-3255: a memory corruption vulnerability in handling duplicate action IDs, possibly leading to local privilege escalation. (boo#939246) * CVE-2015-3218: Allowed any local user to crash polkitd. (boo#933922) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-655=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-655=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpolkit0-0.113-3.8.1 libpolkit0-debuginfo-0.113-3.8.1 polkit-0.113-3.8.1 polkit-debuginfo-0.113-3.8.1 polkit-debugsource-0.113-3.8.1 polkit-devel-0.113-3.8.1 polkit-devel-debuginfo-0.113-3.8.1 typelib-1_0-Polkit-1_0-0.113-3.8.1 - openSUSE 13.2 (x86_64): libpolkit0-32bit-0.113-3.8.1 libpolkit0-debuginfo-32bit-0.113-3.8.1 - openSUSE 13.2 (noarch): polkit-doc-0.113-3.8.1 - openSUSE 13.1 (i586 x86_64): libpolkit0-0.113-9.1 libpolkit0-debuginfo-0.113-9.1 polkit-0.113-9.1 polkit-debuginfo-0.113-9.1 polkit-debugsource-0.113-9.1 polkit-devel-0.113-9.1 polkit-devel-debuginfo-0.113-9.1 typelib-1_0-Polkit-1_0-0.113-9.1 - openSUSE 13.1 (x86_64): libpolkit0-32bit-0.113-9.1 libpolkit0-debuginfo-32bit-0.113-9.1 - openSUSE 13.1 (noarch): polkit-doc-0.113-9.1 References: https://www.suse.com/security/cve/CVE-2015-3218.html https://www.suse.com/security/cve/CVE-2015-3255.html https://www.suse.com/security/cve/CVE-2015-3256.html https://www.suse.com/security/cve/CVE-2015-4625.html https://bugzilla.suse.com/933922 https://bugzilla.suse.com/935119 https://bugzilla.suse.com/939246 https://bugzilla.suse.com/943816

1 0

openSUSE-RU-2015:1724-1: moderate: Recommended update for PostfixAdmin
by maintenance＠opensuse.org 12 Oct '15

12 Oct '15

openSUSE Recommended Update: Recommended update for PostfixAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1724-1 Rating: moderate References: #949909 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: PostfixAdmin was updated to 2.3.8 to deliver bugs fixed upstream. * don't prefill username in users/ login on failed logins - fixes (probably harmless) XSS * properly escape mail addresses in query (#356) * fix escaping in create-admin, create-mailbox and fetchmail templates * fixes (harmless) XSS on form validation errors * don't echo the password back to the browser in the fetchmail form * enforce minimum password length in create-mailbox Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-654=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): postfixadmin-2.3.8-5.7.1 References: https://bugzilla.suse.com/949909

1 0

openSUSE-RU-2015:1723-1: Recommended update for WindowMaker
by maintenance＠opensuse.org 12 Oct '15

12 Oct '15

openSUSE Recommended Update: Recommended update for WindowMaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1723-1 Rating: low References: #900820 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: WindowMaker was updated to fix one bug: * boo#900820: Always use default openSUSE wallpaper for theme 'SUSE' Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-653=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-653=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): WindowMaker-0.95.5-4.6.1 WindowMaker-debuginfo-0.95.5-4.6.1 WindowMaker-debugsource-0.95.5-4.6.1 WindowMaker-devel-0.95.5-4.6.1 - openSUSE 13.1 (i586 x86_64): WindowMaker-0.95.4-5.10.1 WindowMaker-debuginfo-0.95.4-5.10.1 WindowMaker-debugsource-0.95.4-5.10.1 WindowMaker-devel-0.95.4-5.10.1 References: https://bugzilla.suse.com/900820

1 0

openSUSE-RU-2015:1721-1: moderate: Recommended update for apache2
by maintenance＠opensuse.org 12 Oct '15

12 Oct '15

openSUSE Recommended Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1721-1 Rating: moderate References: #949218 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: apache2 was updated to fix one regression (bsc#949218) caused by the patch for CVE-2015-3183. In this update the patch for CVE-2015-3183 was removed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-651=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.53.1 apache2-debuginfo-2.4.6-6.53.1 apache2-debugsource-2.4.6-6.53.1 apache2-devel-2.4.6-6.53.1 apache2-event-2.4.6-6.53.1 apache2-event-debuginfo-2.4.6-6.53.1 apache2-example-pages-2.4.6-6.53.1 apache2-prefork-2.4.6-6.53.1 apache2-prefork-debuginfo-2.4.6-6.53.1 apache2-utils-2.4.6-6.53.1 apache2-utils-debuginfo-2.4.6-6.53.1 apache2-worker-2.4.6-6.53.1 apache2-worker-debuginfo-2.4.6-6.53.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.53.1 References: https://bugzilla.suse.com/949218

1 0

openSUSE-RU-2015:1720-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 11 Oct '15

11 Oct '15

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1720-1 Rating: moderate References: #948392 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: tigervnc was updated to fix one bug: boo#948392: a stale pid file could be created when using incorrect options Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-650=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.38.1 tigervnc-debuginfo-1.4.1-6.38.1 tigervnc-debugsource-1.4.1-6.38.1 xorg-x11-Xvnc-1.4.1-6.38.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.38.1 References: https://bugzilla.suse.com/948392

1 0

openSUSE-SU-2015:1719-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 11 Oct '15

11 Oct '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1719-1 Rating: important References: #947504 #947507 Cross-References: CVE-2015-1303 CVE-2015-1304 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Chromium was updated to 45.0.2454.101 to fix two security issues. The following vulnerabilities were fixed: * CVE-2015-1303: Cross-origin bypass in DOM [boo#947504] * CVE-2015-1304: Cross-origin bypass in V8 [boo#947507] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-649=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-649=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-45.0.2454.101-50.1 chromedriver-debuginfo-45.0.2454.101-50.1 chromium-45.0.2454.101-50.1 chromium-debuginfo-45.0.2454.101-50.1 chromium-debugsource-45.0.2454.101-50.1 chromium-desktop-gnome-45.0.2454.101-50.1 chromium-desktop-kde-45.0.2454.101-50.1 chromium-ffmpegsumo-45.0.2454.101-50.1 chromium-ffmpegsumo-debuginfo-45.0.2454.101-50.1 - openSUSE 13.1 (i586 x86_64): chromedriver-45.0.2454.101-105.1 chromedriver-debuginfo-45.0.2454.101-105.1 chromium-45.0.2454.101-105.1 chromium-debuginfo-45.0.2454.101-105.1 chromium-debugsource-45.0.2454.101-105.1 chromium-desktop-gnome-45.0.2454.101-105.1 chromium-desktop-kde-45.0.2454.101-105.1 chromium-ffmpegsumo-45.0.2454.101-105.1 chromium-ffmpegsumo-debuginfo-45.0.2454.101-105.1 References: https://www.suse.com/security/cve/CVE-2015-1303.html https://www.suse.com/security/cve/CVE-2015-1304.html https://bugzilla.suse.com/947504 https://bugzilla.suse.com/947507

1 0

openSUSE-RU-2015:1718-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 10 Oct '15

10 Oct '15

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1718-1 Rating: moderate References: #948227 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The timezone database was updated to 2015g, incorporating the following changes: * Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25 [boo#948227] * Adjustments for upcoming changes in Norfolk, Fiji, Fort Nelson * New zone America/Fort_Nelson. * localtime no longer mishandles America/Anchorage after 2037. * On hosts with signed 32-bit time_t, localtime no longer mishandles Pacific/Fiji after 2038-01-16 14:00 UTC. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-647=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-647=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2015g-32.1 timezone-debuginfo-2015g-32.1 timezone-debugsource-2015g-32.1 - openSUSE 13.2 (noarch): timezone-java-2015g-32.1 - openSUSE 13.1 (i586 x86_64): timezone-2015g-37.1 timezone-debuginfo-2015g-37.1 timezone-debugsource-2015g-37.1 - openSUSE 13.1 (noarch): timezone-java-2015g-37.1 References: https://bugzilla.suse.com/948227

1 0

openSUSE-SU-2015:1717-1: moderate: Security update for lxc
by opensuse-security＠opensuse.org 10 Oct '15

10 Oct '15

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1717-1 Rating: moderate References: #946744 Cross-References: CVE-2015-1335 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: lxc was update to fix one security issue. The following vulnerability was fixed: * CVE-2015-1335: A directory traversal flaw while lxc-start is initially setting up the mounts for a container (boo#946744) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-648=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-648=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): lxc-1.0.6-9.1 lxc-debuginfo-1.0.6-9.1 lxc-debugsource-1.0.6-9.1 lxc-devel-1.0.6-9.1 - openSUSE 13.1 (i586 x86_64): lxc-0.9.0-3.11.1 lxc-debuginfo-0.9.0-3.11.1 lxc-debugsource-0.9.0-3.11.1 lxc-devel-0.9.0-3.11.1 References: https://www.suse.com/security/cve/CVE-2015-1335.html https://bugzilla.suse.com/946744

1 0

openSUSE-RU-2015:1712-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1712-1 Rating: moderate References: #904533 #919179 #922676 #932981 #934736 #943312 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This recommended update for dracut fixes the following issues: - Replace 0180-dracut-add-trivial-vconsole-fontmap.patch (bad workaround, only works for a single case) and 0172-10i18n-module-setup.sh-For-FONT_MAP-also-check-wheth.patch (didn't work) by 0172-i18n_add_correct_fontmaps.patch. - Solves bsc#943312, boo#932981 and bnc#904533 correctly. - Check for existance of link targets (/run) bsc#922676 - Remove exit 0 from do-convertfs.sh which is used as a pre-pivot hook and hooks get sourced, cmp with: modules.d/99base/dracut-lib.sh: source_all "/lib/dracut/hooks/$_dir" "$@" So hooks must not use exit! bsc#922676 This fixes the critical bug for s390x kiwi images which need the symlink from /var/run to /run and additional later hooks. Modify: 0106-dracut-Enable-converting-of-directory-var-run-var-lo.patch - Incorporate other convertfs patch (one liner) into this patch as well and delete: 0168-convertrunfs-Fix-typo.patch - Fix installing of keyctl (bnc#934736) Add 0201-modsign_fix_keyctl_install.patch - port iscsi network setup and multipath fixes from SLES12 GM to SP1 (bsc#919179) Add 0305-static_network_setup_return_zero.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-644=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dracut-037-17.24.1 dracut-debuginfo-037-17.24.1 dracut-debugsource-037-17.24.1 dracut-fips-037-17.24.1 References: https://bugzilla.suse.com/904533 https://bugzilla.suse.com/919179 https://bugzilla.suse.com/922676 https://bugzilla.suse.com/932981 https://bugzilla.suse.com/934736 https://bugzilla.suse.com/943312

1 0

openSUSE-RU-2015:1711-1: moderate: Recommended update for ypbind
by maintenance＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Recommended Update: Recommended update for ypbind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1711-1 Rating: moderate References: #945236 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for ypbind fixes the following issue: - Add ExecReload to service (bnc#945236) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-643=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ypbind-1.37.1-2.3.1 ypbind-debuginfo-1.37.1-2.3.1 ypbind-debugsource-1.37.1-2.3.1 References: https://bugzilla.suse.com/945236

1 0