October 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:1710-1: moderate: Recommended update for fail2ban
by maintenance＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Recommended Update: Recommended update for fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1710-1 Rating: moderate References: #917818 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: fail2ban received a major version update to 0.9.3. The changes are listed in /usr/share/doc/packages/fail2ban/ChangeLog It also fixes a small systemd related issue (bnc#917818) Upstream changes: - Update to version 0.9.3 - IMPORTANT incompatible changes: * filter.d/roundcube-auth.conf - Changed logpath to 'errors' log (was 'userlogins') * action.d/iptables-common.conf - All calls to iptables command now use -w switch introduced in iptables 1.4.20 (some distribution could have patched their earlier base version as well) to provide this locking mechanism useful under heavy load to avoid contesting on iptables calls. If you need to disable, define 'action.d/iptables-common.local' with empty value for 'lockingopt' in `[Init]` section. * mail-whois-lines, sendmail-geoip-lines and sendmail-whois-lines actions now include by default only the first 1000 log lines in the emails. Adjust <grepopts> to augment the behavior. - Fixes: * reload in interactive mode appends all the jails twice (gh-825) * reload server/jail failed if database used (but was not changed) and some jail active (gh-1072) * filter.d/dovecot.conf - also match unknown user in passwd-file. Thanks Anton Shestakov * Fix fail2ban-regex not parsing journalmatch correctly from filter config * filter.d/asterisk.conf - fix security log support for Asterisk 12+ * filter.d/roundcube-auth.conf - Updated regex to work with 'errors' log (1.0.5 and 1.1.1) - Added regex to work with 'userlogins' log * action.d/sendmail*.conf - use LC_ALL (superseeding LC_TIME) to override locale on systems with customized LC_ALL * performance fix: minimizes connection overhead, close socket only at communication end (gh-1099) * unbanip always deletes ip from database (independent of bantime, also if currently not banned or persistent) * guarantee order of dbfile to be before dbpurgeage (gh-1048) * always set 'dbfile' before other database options (gh-1050) * kill the entire process group of the child process upon timeout (gh-1129). Otherwise could lead to resource exhaustion due to hanging whois processes. * resolve /var/run/fail2ban path in setup.py to help installation on platforms with /var/run -> /run symlink (gh-1142) - New Features: * RETURN iptables target is now a variable: <returntype> * New type of operation: pass2allow, use fail2ban for "knocking", opening a closed port by swapping blocktype and returntype * New filters: - froxlor-auth - Thanks Joern Muehlencord - apache-pass - filter Apache access log for successful authentication * New actions: - shorewall-ipset-proto6 - using proto feature of the Shorewall. Still requires manual pre-configuration of the shorewall. See the action file for detail. * New jails: - pass2allow-ftp - allows FTP traffic after successful HTTP authentication - Enhancements: * action.d/cloudflare.conf - improved documentation on how to allow multiple CF accounts, and jail.conf got new compound action definition action_cf_mwl to submit cloudflare report. * Check access to socket for more detailed logging on error (gh-595) * fail2ban-testcases man page * filter.d/apache-badbots.conf, filter.d/nginx-botsearch.conf - add HEAD method verb * Revamp of Travis and coverage automated testing * Added a space between IP address and the following colon in notification emails for easier text selection * Character detection heuristics for whois output via optional setting in mail-whois*.conf. Thanks Thomas Mayer. Not enabled by default, if _whois_command is set to be %(_whois_convert_charset)s (e.g. in action.d/mail-whois-common.local), it - detects character set of whois output (which is undefined by RFC 3912) via heuristics of the file command - converts whois data to UTF-8 character set with iconv - sends the whois output in UTF-8 character set to mail program - avoids that heirloom mailx creates binary attachment for input with unknown character set - Update to version 0.9.2 (requested in boo#917818) * jail.conf was heavily refactored and now is similar to how it looked on Debian systems: - default action could be configured once for all jails - jails definitions only provide customizations (port, logpath) - no need to specify 'filter' if name matches jail name * Added fail2ban persistent database - default location at /var/lib/fail2ban/fail2ban.sqlite3 - allows active bans to be reinstated on restart - log files read from last position after restart * Added systemd journal backend - Dependency on python-systemd - New "journalmatch" option added to filter configs files - New "systemd-journal" option added to fail2ban-regex * Support %z (Timezone offset) and %f (sub-seconds) support for datedetector. Enhanced existing date/time have been updated patterns to support these. ISO8601 now defaults to localtime unless specified otherwise. Some filters have been change as required to capture these elements in the right timezone correctly. * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR. * Optionally can read log files starting from "head" or "tail". See "logpath" option in jail.conf(5) man page. * Can now set log encoding for files per jail.Default uses systemd locale. * iptables-common.conf replaced iptables-blocktype.conf (iptables-blocktype.local should still be read) and now also provides defaults for the chain, port, protocol and name tags - Update to version 0.9.1 - Refactoring (IMPORTANT -- Please review your setup and configuration): * iptables-common.conf replaced iptables-blocktype.conf (iptables-blocktype.local should still be read) and now also provides defaults for the chain, port, protocol and name tags - Fixes: * start of file2ban aborted (on slow hosts, systemd considers the server has been timed out and kills him), see gh-824 * UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806. * systemd backend error on bad utf-8 in python3 * badips.py action error when logging HTTP error raised with badips request * fail2ban-regex failed to work in python3 due to space/tab mix * recidive regex samples incorrect log level * journalmatch for recidive incorrect PRIORITY * loglevel couldn't be changed in fail2ban.conf * Handle case when no sqlite library is available for persistent database * Only reban once per IP from database on fail2ban restart * Nginx filter to support missing server_name. Closes gh-676 * fail2ban-regex assertion error caused by miscount missed lines with multiline regex * Fix actions failing to execute for Python 3.4.0. Workaround for http://bugs.python.org/issue21207 * Database now returns persistent bans on restart (bantime < 0) * Recursive action tags now fully processed. Fixes issue with bsd-ipfw action * Fixed TypeError with "ipfailures" and "ipjailfailures" action tags. Thanks Serg G. Brester * Correct times for non-timezone date times formats during DST * Pass a copy of, not original, aInfo into actions to avoid side-effects * Per-distribution paths to the exim's main log * Ignored IPs are no longer banned when being restored from persistent database * Manually unbanned IPs are now removed from persistent database, such they wont be banned again when Fail2Ban is restarted * Pass "bantime" parameter to the actions in default jail's action definition(s) * filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park * cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). Regression was introduced while strengthening failregex in 0.8.11 (bd175f) Debian bug #755173 * postfix-sasl - added journalmatch. Thanks Luc Maisonobe * postfix* - match with a new daemon string (postfix/submission/smtpd). Closes gh-804 . Thanks Paul Traina * apache - added filter for AH01630 client denied by server configuration. - New features: - New filters: - monit Thanks Jason H Martin - directadmin Thanks niorg - apache-shellshock Thanks Eugene Hopkinson (SlowRiot) - New actions: - symbiosis-blacklist-allports for Bytemark symbiosis firewall - fail2ban-client can fetch the running server version - Added Cloudflare API action - Enhancements * Start performance of fail2ban-client (and tests) increased, start time and cpu usage rapidly reduced. Introduced a shared storage logic, to bypass reading lots of config files (see gh-824). Thanks to Joost Molenaar for good catch (reported gh-820). * Fail2ban-regex - add print-all-matched option. Closes gh-652 * Suppress fail2ban-client warnings for non-critical config options * Match non "Bye Bye" disconnect messages for sshd locked account regex * courier-smtp filter: - match lines with user names - match lines containing "535 Authentication failed" attempts * Add <chain> tag to iptables-ipsets * Realign fail2ban log output with white space to improve readability. Does not affect SYSLOG output * Log unhandled exceptions * cyrus-imap: catch "user not found" attempts * Add support for Portsentry - Update to version 0.9.0 Carries all fixes, features and enhancements from 0.8.13 (unreleased) with major changes. Please take note of release notes: https://github.com/fail2ban/fail2ban/releases/tag/0.9.0 Please test your configuration before relying on it. Nearly all development is thanks to Steven Hiscocks (THANKS!), merging, testcases and timezone support from Daniel Black, and code-review and minor additions from Yaroslav Halchenko. - Refactoring (IMPORTANT -- Please review your setup and configuration): * [..bddbf1e] jail.conf was heavily refactored and now is similar to how it looked on Debian systems: - default action could be configured once for all jails - jails definitions only provide customizations (port, logpath) - no need to specify 'filter' if name matches jail name * [..5aef036] Core functionality moved into fail2ban/ module. Closes gh-26 - tests included in module to aid testing and debugging * Added fail2ban persistent database - default location at /var/lib/fail2ban/fail2ban.sqlite3 - allows active bans to be reinstated on restart - log files read from last position after restart * Added systemd journal backend - Dependency on python-systemd - New "journalmatch" option added to filter configs files - New "systemd-journal" option added to fail2ban-regex * Added python3 support * Support %z (Timezone offset) and %f (sub-seconds) support for datedetector. Enhanced existing date/time have been updated patterns to support these. ISO8601 now defaults to localtime unless specified otherwise. Some filters have been change as required to capture these elements in the right timezone correctly. * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR. - Log level INFO is now more verbose * Optionally can read log files starting from "head" or "tail". - See "logpath" option in jail.conf(5) man page. * Can now set log encoding for files per jail. - Default uses systemd locale. - New features: * [..c7ae460] Multiline failregex. Close gh-54 * [8af32ed] Guacamole filter and support for Apache Tomcat date format * [..b6059f4] 'timeout' option for actions Close gh-60 and Debian bug #410077. Also it would now capture and include stdout and stderr into logging messages in case of error or at DEBUG loglevel. * Added action xarf-login-attack to report formatted attack messages according to the XARF standard (v0.2). Close gh-105 * Support PyPy * Add filter for apache-botsearch * Add filter for kerio. Thanks Tony Lawrence for blog of regexs and providing samples. Close gh-120 * Filter for stunnel * Filter for Counter Strike 1.6. Thanks to onorua for logs. Close gh-347 * Filter for squirrelmail. Close gh-261 * Filter for tine20. Close gh-583 * Custom date formats (strptime) can now be set in filters and jail.conf * Python based actions can now be created. - SMTP action for sending emails on jail start, stop and ban. * Added action to use badips.com reporting and blacklist - Requires Python 2.7+ - Enhancements * Fail2ban-regex - don't accumulate lines if not printing them. add options to suppress output of missed/ignored lines. Close gh-644 * Asterisk now supports syslog format * Jail names increased to 26 characters and iptables prefix reduced from fail2ban- to f2b- as suggested by buanzo in gh-462. * Multiline filter for sendmail-spam. Close gh-418 * Multiline regex for Disconnecting: Too many authentication failures for root [preauth]\nConnection closed by 6X.XXX.XXX.XXX [preauth] * Multiline regex for Disconnecting: Connection from 61.XX.XX.XX port 51353\nToo many authentication failures for root [preauth]. Thanks Helmut Grohne. Close gh-457 * Replacing use of deprecated API (.warning, .assertEqual, etc) * [..a648cc2] Filters can have options now too which are substituted into failregex / ignoreregex * [..e019ab7] Multiple instances of the same action are allowed in the same jail -- use actname option to disambiguate. * Add honeypot email address to exim-spam filter as argument * Properties and methods of actions accessible from fail2ban-client - Use of properties replaces command actions "cinfo" interface - Whereever possible, path-definitions have been moved paths-opensuse.conf which has been submittet upstream - Use default fail2ban.service including fail2ban-opensuse-service.patch - Use default suse-initd from upstream - Tests have been moved to a seperate page Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-642=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-642=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libipa_hbac-devel-1.12.2-3.9.1 libipa_hbac0-1.12.2-3.9.1 libipa_hbac0-debuginfo-1.12.2-3.9.1 libnfsidmap-sss-1.12.2-3.9.1 libnfsidmap-sss-debuginfo-1.12.2-3.9.1 libsss_idmap-devel-1.12.2-3.9.1 libsss_idmap0-1.12.2-3.9.1 libsss_idmap0-debuginfo-1.12.2-3.9.1 libsss_nss_idmap-devel-1.12.2-3.9.1 libsss_nss_idmap0-1.12.2-3.9.1 libsss_nss_idmap0-debuginfo-1.12.2-3.9.1 libsss_simpleifp-devel-1.12.2-3.9.1 libsss_simpleifp0-1.12.2-3.9.1 libsss_simpleifp0-debuginfo-1.12.2-3.9.1 libsss_sudo-1.12.2-3.9.1 libsss_sudo-debuginfo-1.12.2-3.9.1 python-ipa_hbac-1.12.2-3.9.1 python-ipa_hbac-debuginfo-1.12.2-3.9.1 python-sss_nss_idmap-1.12.2-3.9.1 python-sss_nss_idmap-debuginfo-1.12.2-3.9.1 python-sssd-config-1.12.2-3.9.1 python-sssd-config-debuginfo-1.12.2-3.9.1 sssd-1.12.2-3.9.1 sssd-ad-1.12.2-3.9.1 sssd-ad-debuginfo-1.12.2-3.9.1 sssd-dbus-1.12.2-3.9.1 sssd-dbus-debuginfo-1.12.2-3.9.1 sssd-debuginfo-1.12.2-3.9.1 sssd-debugsource-1.12.2-3.9.1 sssd-ipa-1.12.2-3.9.1 sssd-ipa-debuginfo-1.12.2-3.9.1 sssd-krb5-1.12.2-3.9.1 sssd-krb5-common-1.12.2-3.9.1 sssd-krb5-common-debuginfo-1.12.2-3.9.1 sssd-krb5-debuginfo-1.12.2-3.9.1 sssd-ldap-1.12.2-3.9.1 sssd-ldap-debuginfo-1.12.2-3.9.1 sssd-proxy-1.12.2-3.9.1 sssd-proxy-debuginfo-1.12.2-3.9.1 sssd-tools-1.12.2-3.9.1 sssd-tools-debuginfo-1.12.2-3.9.1 sssd-wbclient-1.12.2-3.9.1 sssd-wbclient-debuginfo-1.12.2-3.9.1 sssd-wbclient-devel-1.12.2-3.9.1 - openSUSE 13.2 (x86_64): sssd-32bit-1.12.2-3.9.1 sssd-debuginfo-32bit-1.12.2-3.9.1 - openSUSE 13.2 (noarch): SuSEfirewall2-fail2ban-0.9.3-2.18.1 fail2ban-0.9.3-2.18.1 fail2ban-tests-0.9.3-2.18.1 nagios-plugins-fail2ban-0.9.3-2.18.1 - openSUSE 13.1 (noarch): SuSEfirewall2-fail2ban-0.9.3-2.27.1 fail2ban-0.9.3-2.27.1 fail2ban-tests-0.9.3-2.27.1 nagios-plugins-fail2ban-0.9.3-2.27.1 References: https://bugzilla.suse.com/917818

1 0

openSUSE-RU-2015:1709-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1709-1 Rating: moderate References: #936254 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for virtualbox fixes the following issue: - Several of the commands for vboxadd-service operations were mistakenly placed under the main package rather that the virtualbox-guest-tools package. See comment #10 in boo#936254. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-640=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-virtualbox-4.3.30-28.1 python-virtualbox-debuginfo-4.3.30-28.1 virtualbox-4.3.30-28.1 virtualbox-debuginfo-4.3.30-28.1 virtualbox-debugsource-4.3.30-28.1 virtualbox-devel-4.3.30-28.1 virtualbox-guest-kmp-default-4.3.30_k3.16.7_24-28.1 virtualbox-guest-kmp-default-debuginfo-4.3.30_k3.16.7_24-28.1 virtualbox-guest-kmp-desktop-4.3.30_k3.16.7_24-28.1 virtualbox-guest-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-28.1 virtualbox-guest-tools-4.3.30-28.1 virtualbox-guest-tools-debuginfo-4.3.30-28.1 virtualbox-guest-x11-4.3.30-28.1 virtualbox-guest-x11-debuginfo-4.3.30-28.1 virtualbox-host-kmp-default-4.3.30_k3.16.7_24-28.1 virtualbox-host-kmp-default-debuginfo-4.3.30_k3.16.7_24-28.1 virtualbox-host-kmp-desktop-4.3.30_k3.16.7_24-28.1 virtualbox-host-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-28.1 virtualbox-qt-4.3.30-28.1 virtualbox-qt-debuginfo-4.3.30-28.1 virtualbox-websrv-4.3.30-28.1 virtualbox-websrv-debuginfo-4.3.30-28.1 - openSUSE 13.2 (noarch): virtualbox-guest-desktop-icons-4.3.30-28.1 virtualbox-host-source-4.3.30-28.1 - openSUSE 13.2 (i586): virtualbox-guest-kmp-pae-4.3.30_k3.16.7_24-28.1 virtualbox-guest-kmp-pae-debuginfo-4.3.30_k3.16.7_24-28.1 virtualbox-host-kmp-pae-4.3.30_k3.16.7_24-28.1 virtualbox-host-kmp-pae-debuginfo-4.3.30_k3.16.7_24-28.1 References: https://bugzilla.suse.com/936254

1 0

openSUSE-RU-2015:1708-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1708-1 Rating: moderate References: #936254 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for virtualbox fixes the following issue: - Fix placement of scriptlet call for vboxadd-service. As noted in Comment #10 at boo#936254, one of the calls was scheduled for the main package rather than virtualbox-guest-tools. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-641=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-virtualbox-4.2.32-2.49.1 python-virtualbox-debuginfo-4.2.32-2.49.1 virtualbox-4.2.32-2.49.1 virtualbox-debuginfo-4.2.32-2.49.1 virtualbox-debugsource-4.2.32-2.49.1 virtualbox-devel-4.2.32-2.49.1 virtualbox-guest-kmp-default-4.2.32_k3.11.10_29-2.49.1 virtualbox-guest-kmp-default-debuginfo-4.2.32_k3.11.10_29-2.49.1 virtualbox-guest-kmp-desktop-4.2.32_k3.11.10_29-2.49.1 virtualbox-guest-kmp-desktop-debuginfo-4.2.32_k3.11.10_29-2.49.1 virtualbox-guest-tools-4.2.32-2.49.1 virtualbox-guest-tools-debuginfo-4.2.32-2.49.1 virtualbox-guest-x11-4.2.32-2.49.1 virtualbox-guest-x11-debuginfo-4.2.32-2.49.1 virtualbox-host-kmp-default-4.2.32_k3.11.10_29-2.49.1 virtualbox-host-kmp-default-debuginfo-4.2.32_k3.11.10_29-2.49.1 virtualbox-host-kmp-desktop-4.2.32_k3.11.10_29-2.49.1 virtualbox-host-kmp-desktop-debuginfo-4.2.32_k3.11.10_29-2.49.1 virtualbox-qt-4.2.32-2.49.1 virtualbox-qt-debuginfo-4.2.32-2.49.1 virtualbox-websrv-4.2.32-2.49.1 virtualbox-websrv-debuginfo-4.2.32-2.49.1 - openSUSE 13.1 (noarch): virtualbox-host-source-4.2.32-2.49.1 - openSUSE 13.1 (i586): virtualbox-guest-kmp-pae-4.2.32_k3.11.10_29-2.49.1 virtualbox-guest-kmp-pae-debuginfo-4.2.32_k3.11.10_29-2.49.1 virtualbox-host-kmp-pae-4.2.32_k3.11.10_29-2.49.1 virtualbox-host-kmp-pae-debuginfo-4.2.32_k3.11.10_29-2.49.1 References: https://bugzilla.suse.com/936254

1 0

openSUSE-SU-2015:1704-1: moderate: Security update for freetype2
by opensuse-security＠opensuse.org 09 Oct '15

09 Oct '15

openSUSE Security Update: Security update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1704-1 Rating: moderate References: #945849 #947966 Cross-References: CVE-2014-9745 CVE-2014-9747 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of the freetype2 library fixes two security issues. These security issues were fixed: - CVE-2014-9745: Infinite loop in parse_encoding in t1load.c (bsc#945849) - CVE-2014-9747: Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix (bsc#947966) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-639=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): freetype2-debugsource-2.5.0.1-2.10.1 freetype2-devel-2.5.0.1-2.10.1 ft2demos-2.5.0-2.10.1 ft2demos-debuginfo-2.5.0-2.10.1 ft2demos-debugsource-2.5.0-2.10.1 libfreetype6-2.5.0.1-2.10.1 libfreetype6-debuginfo-2.5.0.1-2.10.1 - openSUSE 13.1 (x86_64): freetype2-devel-32bit-2.5.0.1-2.10.1 libfreetype6-32bit-2.5.0.1-2.10.1 libfreetype6-debuginfo-32bit-2.5.0.1-2.10.1 References: https://www.suse.com/security/cve/CVE-2014-9745.html https://www.suse.com/security/cve/CVE-2014-9747.html https://bugzilla.suse.com/945849 https://bugzilla.suse.com/947966

1 0

openSUSE-SU-2015:1699-1: moderate: Security update for IPython, python3-IPython
by opensuse-security＠opensuse.org 08 Oct '15

08 Oct '15

openSUSE Security Update: Security update for IPython, python3-IPython ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1699-1 Rating: moderate References: #945828 Cross-References: CVE-2015-6938 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: IPython was updated to fix a cross-site-scripting vulnerability in handling local foldernames. (CVE-2015-6938, bnc#945828) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-638=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-638=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): IPython-2.2.0-2.5.1 IPython-doc-2.2.0-2.5.1 python3-IPython-2.2.0-2.4.1 python3-IPython-doc-2.2.0-2.4.1 - openSUSE 13.1 (noarch): IPython-1.0.0-2.7.1 IPython-doc-1.0.0-2.7.1 References: https://www.suse.com/security/cve/CVE-2015-6938.html https://bugzilla.suse.com/945828

1 0

openSUSE-SU-2015:1688-1: moderate: Security update for conntrack-tools
by opensuse-security＠opensuse.org 06 Oct '15

06 Oct '15

openSUSE Security Update: Security update for conntrack-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1688-1 Rating: moderate References: #942149 Cross-References: CVE-2015-6496 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: conntrack-tools was updated to fix one security issue. The following vulnerability was fixed: * CVE-2015-6496: Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. (boo#942149) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-637=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-637=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): conntrack-tools-1.4.2-4.4.1 conntrack-tools-debuginfo-1.4.2-4.4.1 conntrack-tools-debugsource-1.4.2-4.4.1 - openSUSE 13.1 (i586 x86_64): conntrack-tools-1.4.2-2.3.1 conntrack-tools-debuginfo-1.4.2-2.3.1 conntrack-tools-debugsource-1.4.2-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-6496.html https://bugzilla.suse.com/942149

1 0

openSUSE-SU-2015:1687-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 06 Oct '15

06 Oct '15

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1687-1 Rating: moderate References: #934048 Cross-References: CVE-2015-4335 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: redis was updated to version 2.8.22 (boo#934048) to fix a LUA sandbox update. (CVE-2015-4335) Details can be found on http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ For the other changes see in the package: /usr/share/doc/packages/redis/00-RELEASENOTES Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-634=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-634=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libipa_hbac-devel-1.12.2-3.11.1 libipa_hbac0-1.12.2-3.11.1 libipa_hbac0-debuginfo-1.12.2-3.11.1 libnfsidmap-sss-1.12.2-3.11.1 libnfsidmap-sss-debuginfo-1.12.2-3.11.1 libsss_idmap-devel-1.12.2-3.11.1 libsss_idmap0-1.12.2-3.11.1 libsss_idmap0-debuginfo-1.12.2-3.11.1 libsss_nss_idmap-devel-1.12.2-3.11.1 libsss_nss_idmap0-1.12.2-3.11.1 libsss_nss_idmap0-debuginfo-1.12.2-3.11.1 libsss_simpleifp-devel-1.12.2-3.11.1 libsss_simpleifp0-1.12.2-3.11.1 libsss_simpleifp0-debuginfo-1.12.2-3.11.1 libsss_sudo-1.12.2-3.11.1 libsss_sudo-debuginfo-1.12.2-3.11.1 python-ipa_hbac-1.12.2-3.11.1 python-ipa_hbac-debuginfo-1.12.2-3.11.1 python-sss_nss_idmap-1.12.2-3.11.1 python-sss_nss_idmap-debuginfo-1.12.2-3.11.1 python-sssd-config-1.12.2-3.11.1 python-sssd-config-debuginfo-1.12.2-3.11.1 redis-2.8.22-2.6.1 redis-debuginfo-2.8.22-2.6.1 redis-debugsource-2.8.22-2.6.1 sssd-1.12.2-3.11.1 sssd-ad-1.12.2-3.11.1 sssd-ad-debuginfo-1.12.2-3.11.1 sssd-dbus-1.12.2-3.11.1 sssd-dbus-debuginfo-1.12.2-3.11.1 sssd-debuginfo-1.12.2-3.11.1 sssd-debugsource-1.12.2-3.11.1 sssd-ipa-1.12.2-3.11.1 sssd-ipa-debuginfo-1.12.2-3.11.1 sssd-krb5-1.12.2-3.11.1 sssd-krb5-common-1.12.2-3.11.1 sssd-krb5-common-debuginfo-1.12.2-3.11.1 sssd-krb5-debuginfo-1.12.2-3.11.1 sssd-ldap-1.12.2-3.11.1 sssd-ldap-debuginfo-1.12.2-3.11.1 sssd-proxy-1.12.2-3.11.1 sssd-proxy-debuginfo-1.12.2-3.11.1 sssd-tools-1.12.2-3.11.1 sssd-tools-debuginfo-1.12.2-3.11.1 sssd-wbclient-1.12.2-3.11.1 sssd-wbclient-debuginfo-1.12.2-3.11.1 sssd-wbclient-devel-1.12.2-3.11.1 - openSUSE 13.2 (x86_64): sssd-32bit-1.12.2-3.11.1 sssd-debuginfo-32bit-1.12.2-3.11.1 - openSUSE 13.1 (i586 x86_64): redis-2.8.22-3.6.1 redis-debuginfo-2.8.22-3.6.1 redis-debugsource-2.8.22-3.6.1 References: https://www.suse.com/security/cve/CVE-2015-4335.html https://bugzilla.suse.com/934048

1 0

openSUSE-SU-2015:1686-1: moderate: Security update for vorbis-tools
by opensuse-security＠opensuse.org 06 Oct '15

06 Oct '15

openSUSE Security Update: Security update for vorbis-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1686-1 Rating: moderate References: #943795 Cross-References: CVE-2015-6749 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: vorbis-tools was updated to fix a buffer overflow in aiff_open(), that could be used to crash or potentially execute code when opening aiff format files. (CVE-2015-6749, bsc#943795). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-633=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-633=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libipa_hbac-devel-1.12.2-3.7.1 libipa_hbac0-1.12.2-3.7.1 libipa_hbac0-debuginfo-1.12.2-3.7.1 libnfsidmap-sss-1.12.2-3.7.1 libnfsidmap-sss-debuginfo-1.12.2-3.7.1 libsss_idmap-devel-1.12.2-3.7.1 libsss_idmap0-1.12.2-3.7.1 libsss_idmap0-debuginfo-1.12.2-3.7.1 libsss_nss_idmap-devel-1.12.2-3.7.1 libsss_nss_idmap0-1.12.2-3.7.1 libsss_nss_idmap0-debuginfo-1.12.2-3.7.1 libsss_simpleifp-devel-1.12.2-3.7.1 libsss_simpleifp0-1.12.2-3.7.1 libsss_simpleifp0-debuginfo-1.12.2-3.7.1 libsss_sudo-1.12.2-3.7.1 libsss_sudo-debuginfo-1.12.2-3.7.1 python-ipa_hbac-1.12.2-3.7.1 python-ipa_hbac-debuginfo-1.12.2-3.7.1 python-sss_nss_idmap-1.12.2-3.7.1 python-sss_nss_idmap-debuginfo-1.12.2-3.7.1 python-sssd-config-1.12.2-3.7.1 python-sssd-config-debuginfo-1.12.2-3.7.1 sssd-1.12.2-3.7.1 sssd-ad-1.12.2-3.7.1 sssd-ad-debuginfo-1.12.2-3.7.1 sssd-dbus-1.12.2-3.7.1 sssd-dbus-debuginfo-1.12.2-3.7.1 sssd-debuginfo-1.12.2-3.7.1 sssd-debugsource-1.12.2-3.7.1 sssd-ipa-1.12.2-3.7.1 sssd-ipa-debuginfo-1.12.2-3.7.1 sssd-krb5-1.12.2-3.7.1 sssd-krb5-common-1.12.2-3.7.1 sssd-krb5-common-debuginfo-1.12.2-3.7.1 sssd-krb5-debuginfo-1.12.2-3.7.1 sssd-ldap-1.12.2-3.7.1 sssd-ldap-debuginfo-1.12.2-3.7.1 sssd-proxy-1.12.2-3.7.1 sssd-proxy-debuginfo-1.12.2-3.7.1 sssd-tools-1.12.2-3.7.1 sssd-tools-debuginfo-1.12.2-3.7.1 sssd-wbclient-1.12.2-3.7.1 sssd-wbclient-debuginfo-1.12.2-3.7.1 sssd-wbclient-devel-1.12.2-3.7.1 vorbis-tools-1.4.0-17.11.1 vorbis-tools-debuginfo-1.4.0-17.11.1 vorbis-tools-debugsource-1.4.0-17.11.1 - openSUSE 13.2 (x86_64): sssd-32bit-1.12.2-3.7.1 sssd-debuginfo-32bit-1.12.2-3.7.1 - openSUSE 13.2 (noarch): vorbis-tools-lang-1.4.0-17.11.1 - openSUSE 13.1 (i586 x86_64): vorbis-tools-1.4.0-14.19.1 vorbis-tools-debuginfo-1.4.0-14.19.1 vorbis-tools-debugsource-1.4.0-14.19.1 - openSUSE 13.1 (noarch): vorbis-tools-lang-1.4.0-14.19.1 References: https://www.suse.com/security/cve/CVE-2015-6749.html https://bugzilla.suse.com/943795

1 0

openSUSE-SU-2015:1685-1: moderate: Security update for froxlor
by opensuse-security＠opensuse.org 06 Oct '15

06 Oct '15

openSUSE Security Update: Security update for froxlor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1685-1 Rating: moderate References: #846355 Cross-References: CVE-2014-0185 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: froxlor was updated to version 0.9.34 (bnc#846355), fixing bugs and bringing features. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-636=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-636=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): froxlor-0.9.34-3.3.1 - openSUSE 13.1 (noarch): froxlor-0.9.34-14.1 References: https://www.suse.com/security/cve/CVE-2014-0185.html https://bugzilla.suse.com/846355

1 0

openSUSE-SU-2015:1684-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 06 Oct '15

06 Oct '15

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1684-1 Rating: moderate References: #931723 #938723 #938728 Cross-References: CVE-2015-3183 CVE-2015-3185 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Apache2 was updated to fix security issues. - CVE-2015-3185: The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x did not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. [bnc#938723] - CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server did not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. [bnc#938728] On openSUSE 13.1: - CVE-2015-4000: Fix Logjam vulnerability: change the default SSLCipherSuite cipherstring to disable export cipher suites and deploy Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to generate a strong and unique Diffie Hellman Group and append it to the server certificate file [bnc#931723]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-635=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-635=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-2.4.10-28.1 apache2-debuginfo-2.4.10-28.1 apache2-debugsource-2.4.10-28.1 apache2-devel-2.4.10-28.1 apache2-event-2.4.10-28.1 apache2-event-debuginfo-2.4.10-28.1 apache2-example-pages-2.4.10-28.1 apache2-prefork-2.4.10-28.1 apache2-prefork-debuginfo-2.4.10-28.1 apache2-utils-2.4.10-28.1 apache2-utils-debuginfo-2.4.10-28.1 apache2-worker-2.4.10-28.1 apache2-worker-debuginfo-2.4.10-28.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-28.1 - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.50.1 apache2-debuginfo-2.4.6-6.50.1 apache2-debugsource-2.4.6-6.50.1 apache2-devel-2.4.6-6.50.1 apache2-event-2.4.6-6.50.1 apache2-event-debuginfo-2.4.6-6.50.1 apache2-example-pages-2.4.6-6.50.1 apache2-prefork-2.4.6-6.50.1 apache2-prefork-debuginfo-2.4.6-6.50.1 apache2-utils-2.4.6-6.50.1 apache2-utils-debuginfo-2.4.6-6.50.1 apache2-worker-2.4.6-6.50.1 apache2-worker-debuginfo-2.4.6-6.50.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.50.1 References: https://www.suse.com/security/cve/CVE-2015-3183.html https://www.suse.com/security/cve/CVE-2015-3185.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/931723 https://bugzilla.suse.com/938723 https://bugzilla.suse.com/938728

1 0