October 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1681-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 05 Oct '15

05 Oct '15

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1681-1 Rating: important References: #935979 #947003 Cross-References: CVE-2015-4500 CVE-2015-4501 CVE-2015-4502 CVE-2015-4503 CVE-2015-4504 CVE-2015-4505 CVE-2015-4506 CVE-2015-4507 CVE-2015-4509 CVE-2015-4510 CVE-2015-4511 CVE-2015-4512 CVE-2015-4516 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7178 CVE-2015-7179 CVE-2015-7180 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: seamonkey was updated to fix 25 security issues. These security issues were fixed: - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header (bsc#947003). - CVE-2015-4521: The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-4522: The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). - CVE-2015-4502: js/src/proxy/Proxy.cpp in Mozilla Firefox before 41.0 mishandled certain receiver arguments, which allowed remote attackers to bypass intended window access restrictions via a crafted web site (bsc#947003). - CVE-2015-4503: The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandled array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allowed remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application (bsc#947003). - CVE-2015-4500: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bsc#947003). - CVE-2015-4501: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bsc#947003). - CVE-2015-4506: Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allowed remote attackers to execute arbitrary code via a crafted VP9 file (bsc#947003). - CVE-2015-4507: The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allowed remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site (bsc#947003). - CVE-2015-4504: The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allowed remote attackers to obtain sensitive information or cause a denial of service (buffer over-read and application crash) via crafted attributes in the ICC 4 profile of an image (bsc#947003). - CVE-2015-4505: updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allowed local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service (bsc#947003). - CVE-2015-7180: The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-4509: Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176 (bsc#947003). - CVE-2015-7178: The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content (bsc#947003). - CVE-2015-7179: The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content (bsc#947003). - CVE-2015-7176: The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 used an incorrect argument to the sscanf function, which might allowed remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-7177: The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-7174: The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). - CVE-2015-7175: The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). - CVE-2015-4511: Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to execute arbitrary code via a crafted header in a WebM video (bsc#947003). - CVE-2015-4510: Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation (bsc#947003). - CVE-2015-4512: gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allowed remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering (bsc#947003). - CVE-2015-4517: NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-4516: Mozilla Firefox before 41.0 allowed remote attackers to bypass certain ECMAScript 5 (aka ES5) API protection mechanisms and modify immutable properties, and consequently execute arbitrary JavaScript code with chrome privileges, via a crafted web page that did not use ES5 APIs (bsc#947003). - CVE-2015-4519: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element (bsc#947003). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-632=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-632=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): seamonkey-2.38-20.2 seamonkey-debuginfo-2.38-20.2 seamonkey-debugsource-2.38-20.2 seamonkey-dom-inspector-2.38-20.2 seamonkey-irc-2.38-20.2 seamonkey-translations-common-2.38-20.2 seamonkey-translations-other-2.38-20.2 - openSUSE 13.1 (i586 x86_64): seamonkey-2.38-56.1 seamonkey-debuginfo-2.38-56.1 seamonkey-debugsource-2.38-56.1 seamonkey-dom-inspector-2.38-56.1 seamonkey-irc-2.38-56.1 seamonkey-translations-common-2.38-56.1 seamonkey-translations-other-2.38-56.1 References: https://www.suse.com/security/cve/CVE-2015-4500.html https://www.suse.com/security/cve/CVE-2015-4501.html https://www.suse.com/security/cve/CVE-2015-4502.html https://www.suse.com/security/cve/CVE-2015-4503.html https://www.suse.com/security/cve/CVE-2015-4504.html https://www.suse.com/security/cve/CVE-2015-4505.html https://www.suse.com/security/cve/CVE-2015-4506.html https://www.suse.com/security/cve/CVE-2015-4507.html https://www.suse.com/security/cve/CVE-2015-4509.html https://www.suse.com/security/cve/CVE-2015-4510.html https://www.suse.com/security/cve/CVE-2015-4511.html https://www.suse.com/security/cve/CVE-2015-4512.html https://www.suse.com/security/cve/CVE-2015-4516.html https://www.suse.com/security/cve/CVE-2015-4517.html https://www.suse.com/security/cve/CVE-2015-4519.html https://www.suse.com/security/cve/CVE-2015-4520.html https://www.suse.com/security/cve/CVE-2015-4521.html https://www.suse.com/security/cve/CVE-2015-4522.html https://www.suse.com/security/cve/CVE-2015-7174.html https://www.suse.com/security/cve/CVE-2015-7175.html https://www.suse.com/security/cve/CVE-2015-7176.html https://www.suse.com/security/cve/CVE-2015-7177.html https://www.suse.com/security/cve/CVE-2015-7178.html https://www.suse.com/security/cve/CVE-2015-7179.html https://www.suse.com/security/cve/CVE-2015-7180.html https://bugzilla.suse.com/935979 https://bugzilla.suse.com/947003

1 0

openSUSE-SU-2015:1679-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 05 Oct '15

05 Oct '15

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1679-1 Rating: important References: #947003 Cross-References: CVE-2015-4500 CVE-2015-4505 CVE-2015-4506 CVE-2015-4509 CVE-2015-4511 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7178 CVE-2015-7179 CVE-2015-7180 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaThunderbird was updated to fix 17 security issues. These security issues were fixed: - CVE-2015-4509: Use-after-free vulnerability in the HTMLVideoElement interface in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to execute arbitrary code via crafted JavaScript code that modifies the URI table of a media element, aka ZDI-CAN-3176 (bsc#947003). - CVE-2015-4520: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to bypass CORS preflight protection mechanisms by leveraging (1) duplicate cache-key generation or (2) retrieval of a value from an incorrect HTTP Access-Control-* response header (bsc#947003). - CVE-2015-4521: The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-4522: The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). - CVE-2015-4500: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (bsc#947003). - CVE-2015-4511: Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed remote attackers to execute arbitrary code via a crafted header in a WebM video (bsc#947003). - CVE-2015-7178: The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content (bsc#947003). - CVE-2015-7179: The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content (bsc#947003). - CVE-2015-4506: Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allowed remote attackers to execute arbitrary code via a crafted VP9 file (bsc#947003). - CVE-2015-4517: NetworkUtils.cpp in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-4505: updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allowed local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service (bsc#947003). - CVE-2015-4519: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allowed user-assisted remote attackers to bypass intended access restrictions and discover a redirect's target URL via crafted JavaScript code that executes after a drag-and-drop action of an image into a TEXTBOX element (bsc#947003). - CVE-2015-7180: The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-7176: The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 used an incorrect argument to the sscanf function, which might allowed remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-7177: The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors (bsc#947003). - CVE-2015-7174: The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). - CVE-2015-7175: The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow (bsc#947003). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-631=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-631=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.3.0-28.1 MozillaThunderbird-buildsymbols-38.3.0-28.1 MozillaThunderbird-debuginfo-38.3.0-28.1 MozillaThunderbird-debugsource-38.3.0-28.1 MozillaThunderbird-devel-38.3.0-28.1 MozillaThunderbird-translations-common-38.3.0-28.1 MozillaThunderbird-translations-other-38.3.0-28.1 - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.3.0-70.65.1 MozillaThunderbird-buildsymbols-38.3.0-70.65.1 MozillaThunderbird-debuginfo-38.3.0-70.65.1 MozillaThunderbird-debugsource-38.3.0-70.65.1 MozillaThunderbird-devel-38.3.0-70.65.1 MozillaThunderbird-translations-common-38.3.0-70.65.1 MozillaThunderbird-translations-other-38.3.0-70.65.1 References: https://www.suse.com/security/cve/CVE-2015-4500.html https://www.suse.com/security/cve/CVE-2015-4505.html https://www.suse.com/security/cve/CVE-2015-4506.html https://www.suse.com/security/cve/CVE-2015-4509.html https://www.suse.com/security/cve/CVE-2015-4511.html https://www.suse.com/security/cve/CVE-2015-4517.html https://www.suse.com/security/cve/CVE-2015-4519.html https://www.suse.com/security/cve/CVE-2015-4520.html https://www.suse.com/security/cve/CVE-2015-4521.html https://www.suse.com/security/cve/CVE-2015-4522.html https://www.suse.com/security/cve/CVE-2015-7174.html https://www.suse.com/security/cve/CVE-2015-7175.html https://www.suse.com/security/cve/CVE-2015-7176.html https://www.suse.com/security/cve/CVE-2015-7177.html https://www.suse.com/security/cve/CVE-2015-7178.html https://www.suse.com/security/cve/CVE-2015-7179.html https://www.suse.com/security/cve/CVE-2015-7180.html https://bugzilla.suse.com/947003

1 0

openSUSE-RU-2015:1675-1: moderate: Recommended update for gtk-doc
by maintenance＠opensuse.org 05 Oct '15

05 Oct '15

openSUSE Recommended Update: Recommended update for gtk-doc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1675-1 Rating: moderate References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: gtk-doc was updated to version 1.21: * Important notice - starting with the next release these long deprecated features will be removed. * gtkdoc-mktmpl - please move all the comments into the sources. * generating html via sgml tools (jade/openjade), using xsltproc and docbook-xslt is pretty common and preferred since version 1.6. * remove the docbook-dsssl-stylesheets require Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-630=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): gtk-doc-1.21-2.3.1 gtk-doc-lang-1.21-2.3.1 References:

1 0

openSUSE-SU-2015:1674-1: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 05 Oct '15

05 Oct '15

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1674-1 Rating: low References: #945420 Cross-References: CVE-2015-6830 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: phpMyAdmin was updated to the latest supported upstream release 4.4.14. Besides all upstream bug fixes and improvements, it fixes the following vulnerability: * CVE-2015-6830: reCaptcha bypass boo#945420 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-629=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-629=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15-14.1 - openSUSE 13.1 (noarch): phpMyAdmin-4.4.15-34.1 References: https://www.suse.com/security/cve/CVE-2015-6830.html https://bugzilla.suse.com/945420

1 0

openSUSE-RU-2015:1669-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 02 Oct '15

02 Oct '15

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1669-1 Rating: moderate References: #900558 #904214 #906900 #909358 #912334 #913517 #916420 #918118 #920195 #921831 #921898 #926169 #927457 #928265 #931388 #932284 #933365 #933512 #933521 #933533 #934077 #937512 #937900 #938908 #939571 #940264 #941576 #944132 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 28 recommended fixes can now be installed. Description: This recommended update for systemd fixes the following issues: - The patch fix-kexec-force-reboot.patch has been added (bsc#940264) - Add patch watchdog-ignore-ENOTTY.patch Not all watchdog drivers implement WDIOC_SETOPTIONS. Drivers which do not implement it have their device always enabled. So it's fine to report an error if WDIOS_DISABLECARD is passed and the ioctl is not implemented, however failing when WDIOS_ENABLECARD is passed and the ioctl is not implemented is not good: if the device was already enabled then WDIOS_ENABLECARD was a no-op and wasn't needed in the first place. So we can just ignore the error and continue (bsc#933533) - Add patch let-vconsole-setup-get-properties-only-once-to-copy-them.patch to avoid broken virtual console mapping due stressed ioctl API for the virtual consoles (boo#904214) - firstboot: remove SUSE specific bits for locale handling. The system locale handling is currently broken on SUSE distros and probably is going to be fixed. Until this happens, we shouldn't try to add another undefined behaviour during firstboot. Indeed the patch only copied /etc/sysconfig/language *or* /etc/locale.conf but not both. If locale setting was not copied but prompted, only /etc/locale.conf was initialized making any further locale changes done by YaST useless. - Removed patch firstboot_for_suse.patch included some fixes when setting permission bits on the copied locale.conf. Include a new single patch 0001-firstboot-fix-permission-bits-initialisation-done-on.patch for restoring these previous fixes. - rules: fix persistent net rule generation for KVM (bsc#938908). Add 1102-rules-fix-persistent-net-rule-generation-for-KVM.patch - Add upstream patches for detailed information look at the change file. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-627=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgudev-1_0-0-210-25.19.1 libgudev-1_0-0-debuginfo-210-25.19.1 libgudev-1_0-devel-210-25.19.1 libudev-devel-210-25.19.1 libudev-mini-devel-210-25.19.1 libudev-mini1-210-25.19.1 libudev-mini1-debuginfo-210-25.19.1 libudev1-210-25.19.1 libudev1-debuginfo-210-25.19.1 nss-myhostname-210-25.19.1 nss-myhostname-debuginfo-210-25.19.1 systemd-210-25.19.1 systemd-debuginfo-210-25.19.1 systemd-debugsource-210-25.19.1 systemd-devel-210-25.19.1 systemd-journal-gateway-210-25.19.1 systemd-journal-gateway-debuginfo-210-25.19.1 systemd-logger-210-25.19.1 systemd-mini-210-25.19.1 systemd-mini-debuginfo-210-25.19.1 systemd-mini-debugsource-210-25.19.1 systemd-mini-devel-210-25.19.1 systemd-mini-sysvinit-210-25.19.1 systemd-sysvinit-210-25.19.1 typelib-1_0-GUdev-1_0-210-25.19.1 udev-210-25.19.1 udev-debuginfo-210-25.19.1 udev-mini-210-25.19.1 udev-mini-debuginfo-210-25.19.1 - openSUSE 13.2 (x86_64): libgudev-1_0-0-32bit-210-25.19.1 libgudev-1_0-0-debuginfo-32bit-210-25.19.1 libudev1-32bit-210-25.19.1 libudev1-debuginfo-32bit-210-25.19.1 nss-myhostname-32bit-210-25.19.1 nss-myhostname-debuginfo-32bit-210-25.19.1 systemd-32bit-210-25.19.1 systemd-debuginfo-32bit-210-25.19.1 - openSUSE 13.2 (noarch): systemd-bash-completion-210-25.19.1 References: https://bugzilla.suse.com/900558 https://bugzilla.suse.com/904214 https://bugzilla.suse.com/906900 https://bugzilla.suse.com/909358 https://bugzilla.suse.com/912334 https://bugzilla.suse.com/913517 https://bugzilla.suse.com/916420 https://bugzilla.suse.com/918118 https://bugzilla.suse.com/920195 https://bugzilla.suse.com/921831 https://bugzilla.suse.com/921898 https://bugzilla.suse.com/926169 https://bugzilla.suse.com/927457 https://bugzilla.suse.com/928265 https://bugzilla.suse.com/931388 https://bugzilla.suse.com/932284 https://bugzilla.suse.com/933365 https://bugzilla.suse.com/933512 https://bugzilla.suse.com/933521 https://bugzilla.suse.com/933533 https://bugzilla.suse.com/934077 https://bugzilla.suse.com/937512 https://bugzilla.suse.com/937900 https://bugzilla.suse.com/938908 https://bugzilla.suse.com/939571 https://bugzilla.suse.com/940264 https://bugzilla.suse.com/941576 https://bugzilla.suse.com/944132

1 0

openSUSE-RU-2015:1668-1: moderate: Recommended update for cronie
by maintenance＠opensuse.org 02 Oct '15

02 Oct '15

openSUSE Recommended Update: Recommended update for cronie ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1668-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for cronie fixes the following issue: - remove 'After=sssd.service' from the last change. It is a bug in sssd.service, not in cron.service. Fixed in sssd -> mr#333447 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-628=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cron-4.2-56.8.1 cronie-1.4.12-56.8.1 cronie-anacron-1.4.12-56.8.1 cronie-anacron-debuginfo-1.4.12-56.8.1 cronie-debuginfo-1.4.12-56.8.1 cronie-debugsource-1.4.12-56.8.1 libipa_hbac-devel-1.12.2-3.7.1 libipa_hbac0-1.12.2-3.7.1 libipa_hbac0-debuginfo-1.12.2-3.7.1 libnfsidmap-sss-1.12.2-3.7.1 libnfsidmap-sss-debuginfo-1.12.2-3.7.1 libsss_idmap-devel-1.12.2-3.7.1 libsss_idmap0-1.12.2-3.7.1 libsss_idmap0-debuginfo-1.12.2-3.7.1 libsss_nss_idmap-devel-1.12.2-3.7.1 libsss_nss_idmap0-1.12.2-3.7.1 libsss_nss_idmap0-debuginfo-1.12.2-3.7.1 libsss_simpleifp-devel-1.12.2-3.7.1 libsss_simpleifp0-1.12.2-3.7.1 libsss_simpleifp0-debuginfo-1.12.2-3.7.1 libsss_sudo-1.12.2-3.7.1 libsss_sudo-debuginfo-1.12.2-3.7.1 python-ipa_hbac-1.12.2-3.7.1 python-ipa_hbac-debuginfo-1.12.2-3.7.1 python-sss_nss_idmap-1.12.2-3.7.1 python-sss_nss_idmap-debuginfo-1.12.2-3.7.1 python-sssd-config-1.12.2-3.7.1 python-sssd-config-debuginfo-1.12.2-3.7.1 sssd-1.12.2-3.7.1 sssd-ad-1.12.2-3.7.1 sssd-ad-debuginfo-1.12.2-3.7.1 sssd-dbus-1.12.2-3.7.1 sssd-dbus-debuginfo-1.12.2-3.7.1 sssd-debuginfo-1.12.2-3.7.1 sssd-debugsource-1.12.2-3.7.1 sssd-ipa-1.12.2-3.7.1 sssd-ipa-debuginfo-1.12.2-3.7.1 sssd-krb5-1.12.2-3.7.1 sssd-krb5-common-1.12.2-3.7.1 sssd-krb5-common-debuginfo-1.12.2-3.7.1 sssd-krb5-debuginfo-1.12.2-3.7.1 sssd-ldap-1.12.2-3.7.1 sssd-ldap-debuginfo-1.12.2-3.7.1 sssd-proxy-1.12.2-3.7.1 sssd-proxy-debuginfo-1.12.2-3.7.1 sssd-tools-1.12.2-3.7.1 sssd-tools-debuginfo-1.12.2-3.7.1 sssd-wbclient-1.12.2-3.7.1 sssd-wbclient-debuginfo-1.12.2-3.7.1 sssd-wbclient-devel-1.12.2-3.7.1 - openSUSE 13.2 (x86_64): sssd-32bit-1.12.2-3.7.1 sssd-debuginfo-32bit-1.12.2-3.7.1 References:

1 0

openSUSE-SU-2015:1667-1: important: Security update for bind
by opensuse-security＠opensuse.org 01 Oct '15

01 Oct '15

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1667-1 Rating: important References: #944066 Cross-References: CVE-2015-5722 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: BIND was updated to fix a denial of service against servers performing validation on DNSSEC-signed records (CVE-2015-5722, bsc#944066). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-625=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bind-9.9.4P2-69.1 bind-chrootenv-9.9.4P2-69.1 bind-debuginfo-9.9.4P2-69.1 bind-debugsource-9.9.4P2-69.1 bind-devel-9.9.4P2-69.1 bind-libs-9.9.4P2-69.1 bind-libs-debuginfo-9.9.4P2-69.1 bind-lwresd-9.9.4P2-69.1 bind-lwresd-debuginfo-9.9.4P2-69.1 bind-utils-9.9.4P2-69.1 bind-utils-debuginfo-9.9.4P2-69.1 - openSUSE Evergreen 11.4 (x86_64): bind-libs-32bit-9.9.4P2-69.1 bind-libs-debuginfo-32bit-9.9.4P2-69.1 - openSUSE Evergreen 11.4 (noarch): bind-doc-9.9.4P2-69.1 - openSUSE Evergreen 11.4 (ia64): bind-libs-debuginfo-x86-9.9.4P2-69.1 bind-libs-x86-9.9.4P2-69.1 References: https://www.suse.com/security/cve/CVE-2015-5722.html https://bugzilla.suse.com/944066

1 0

openSUSE-RU-2015:1665-1: Recommended update for virtualbox
by maintenance＠opensuse.org 01 Oct '15

01 Oct '15

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1665-1 Rating: low References: #811221 #908669 #936254 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for virtualbox fixes the following issues: - Package vboxgtk has been broken for some time; however, selecting virtualbox selects it. The spec file has been modified to force virtualbox to conflict with vboxgtk, thus virtualbox-qt will be the chosen package. - Fixes boo#811221 - Install and enable the vboxadd-service init script, to make auto-mounting of shared folders and time synchronization work - Install VBoxService to /usr/sbin/ instead of /usr/bin/ so that vboxadd-service can find it, it cannot be run as user anyway - Create the /media folder with appropriate permissions on distributions higher than 13.1, it doesn't exist any more and the one that VBoxService creates automatically cannot be accessed by normal users - Fixes boo#908669 and boo#936254 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-622=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-virtualbox-4.3.30-24.1 python-virtualbox-debuginfo-4.3.30-24.1 virtualbox-4.3.30-24.1 virtualbox-debuginfo-4.3.30-24.1 virtualbox-debugsource-4.3.30-24.1 virtualbox-devel-4.3.30-24.1 virtualbox-guest-kmp-default-4.3.30_k3.16.7_24-24.1 virtualbox-guest-kmp-default-debuginfo-4.3.30_k3.16.7_24-24.1 virtualbox-guest-kmp-desktop-4.3.30_k3.16.7_24-24.1 virtualbox-guest-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-24.1 virtualbox-guest-tools-4.3.30-24.1 virtualbox-guest-tools-debuginfo-4.3.30-24.1 virtualbox-guest-x11-4.3.30-24.1 virtualbox-guest-x11-debuginfo-4.3.30-24.1 virtualbox-host-kmp-default-4.3.30_k3.16.7_24-24.1 virtualbox-host-kmp-default-debuginfo-4.3.30_k3.16.7_24-24.1 virtualbox-host-kmp-desktop-4.3.30_k3.16.7_24-24.1 virtualbox-host-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-24.1 virtualbox-qt-4.3.30-24.1 virtualbox-qt-debuginfo-4.3.30-24.1 virtualbox-websrv-4.3.30-24.1 virtualbox-websrv-debuginfo-4.3.30-24.1 - openSUSE 13.2 (noarch): virtualbox-guest-desktop-icons-4.3.30-24.1 virtualbox-host-source-4.3.30-24.1 - openSUSE 13.2 (i586): virtualbox-guest-kmp-pae-4.3.30_k3.16.7_24-24.1 virtualbox-guest-kmp-pae-debuginfo-4.3.30_k3.16.7_24-24.1 virtualbox-host-kmp-pae-4.3.30_k3.16.7_24-24.1 virtualbox-host-kmp-pae-debuginfo-4.3.30_k3.16.7_24-24.1 References: https://bugzilla.suse.com/811221 https://bugzilla.suse.com/908669 https://bugzilla.suse.com/936254

1 0

openSUSE-RU-2015:1664-1: moderate: Recommended update for docker
by maintenance＠opensuse.org 01 Oct '15

01 Oct '15

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1664-1 Rating: moderate References: #946653 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 1.8.2 of docker: - Update docker to 1.8.2 version see detailed changelog in https://github.com/docker/docker/releases/tag/v1.8.2 fix bsc#946653 update do docker 1.8.2 - devicemapper: fix zero-sized field access Fix issue #15279: does not build with Go 1.5 tip Due to golang/go@7904946 the devices field is dropped. This solution works on go1.4 and go1.5 See more in https://github.com/docker/docker/pull/15404 This fix was not included in v1.8.2. See previous link on why. fix_15279.patch: contains the patch for issue#15279 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-623=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): docker-1.8.2-40.1 docker-debuginfo-1.8.2-40.1 docker-debugsource-1.8.2-40.1 - openSUSE 13.2 (noarch): docker-bash-completion-1.8.2-40.1 docker-test-1.8.2-40.1 docker-zsh-completion-1.8.2-40.1 References: https://bugzilla.suse.com/946653

1 0

openSUSE-SU-2015:1659-1: moderate: Security update for python-PyJWT
by opensuse-security＠opensuse.org 01 Oct '15

01 Oct '15

openSUSE Security Update: Security update for python-PyJWT ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1659-1 Rating: moderate References: #935544 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: python-PyJWT was updated to fix unsafe usage of asymmetric keys in combination with HMAC algorithm (bsc#935544) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-620=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-PyJWT-0.2.1-3.1 References: https://bugzilla.suse.com/935544

1 0