November 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2015:2071-1: important: openssl update (including postfix rebuild)
by maintenance＠opensuse.org 22 Nov '15

22 Nov '15

openSUSE Optional Update: openssl update (including postfix rebuild) ______________________________________________________________________________ Announcement ID: openSUSE-OU-2015:2071-1 Rating: important References: Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Update to 1.0.1p: - CVE-2015-1793: fix for CA flag certificate chain validatin logic error, also known as "OprahSSL". * CVE-2015-4000 aka Logjam: TLS MITM DH keylength downgrade * CVE-2015-1788 Malformed ECParameters causes infinite loop * CVE-2015-1789 OOB read in X509_cmp_time via ASN1_TIME string * CVE-2015-1790 PKCS7 crash with missing EnvelopedContent * CVE-2015-1792 CMS verify infinite loop with unknown hash function * CVE-2015-1791 Race condition handling NewSessionTicket (low profile vuln.) - re-diff'd: openssl-ocloexec.patch VIA_padlock_support_on_64systems.patch compression_methods_switch.patch 0005-libssl-Hide-library-private-symbols.patch - openssl-1.0.1c-default-paths.patch replaced by re-diff'd openssl-1.0.1n-default-paths.patch - obsoleted: openssl-CVE-2015-0209.patch (NULL pointer checks were upstreamed differently in upstream versions after Feb 2015) - obsoleted by identical upstream fixes: openssl-CVE-2015-0286.patch openssl-CVE-2015-0287.patch openssl-CVE-2015-0288.patch openssl-CVE-2015-0289.patch openssl-CVE-2015-0293.patch Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-791=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libopenssl-devel-1.0.1p-68.2 libopenssl1_0_0-1.0.1p-68.2 libopenssl1_0_0-debuginfo-1.0.1p-68.2 openssl-1.0.1p-68.2 openssl-debuginfo-1.0.1p-68.2 openssl-debugsource-1.0.1p-68.2 postfix-2.7.2-13.38.1 postfix-debuginfo-2.7.2-13.38.1 postfix-debugsource-2.7.2-13.38.1 postfix-devel-2.7.2-13.38.1 postfix-mysql-2.7.2-13.38.1 postfix-mysql-debuginfo-2.7.2-13.38.1 postfix-postgresql-2.7.2-13.38.1 postfix-postgresql-debuginfo-2.7.2-13.38.1 - openSUSE Evergreen 11.4 (x86_64): libopenssl-devel-32bit-1.0.1p-68.2 libopenssl1_0_0-32bit-1.0.1p-68.2 libopenssl1_0_0-debuginfo-32bit-1.0.1p-68.2 - openSUSE Evergreen 11.4 (noarch): openssl-doc-1.0.1p-68.2 postfix-doc-2.7.2-13.38.1 - openSUSE Evergreen 11.4 (ia64): libopenssl1_0_0-debuginfo-x86-1.0.1p-68.2 libopenssl1_0_0-x86-1.0.1p-68.2 References: https://www.suse.com/security/cve/CVE-2015-0209.html https://www.suse.com/security/cve/CVE-2015-0286.html https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-0288.html https://www.suse.com/security/cve/CVE-2015-0289.html https://www.suse.com/security/cve/CVE-2015-0293.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-1793.html https://www.suse.com/security/cve/CVE-2015-4000.html

1 0

openSUSE-SU-2015:2070-1: moderate: Security update for miniupnpc
by opensuse-security＠opensuse.org 21 Nov '15

21 Nov '15

openSUSE Security Update: Security update for miniupnpc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2070-1 Rating: moderate References: #950759 Cross-References: CVE-2015-6031 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: MiniUPnP was updated to fix one security issue. The following vulnerability was fixed: * CVE-2015-6031: XML parser buffer overflow (boo#950759) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-789=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-789=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-789=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libminiupnpc-devel-1.9-6.1 libminiupnpc10-1.9-6.1 libminiupnpc10-debuginfo-1.9-6.1 miniupnpc-1.9-6.1 miniupnpc-debuginfo-1.9-6.1 python-miniupnpc-1.9-6.1 python-miniupnpc-debuginfo-1.9-6.1 - openSUSE Leap 42.1 (x86_64): libminiupnpc10-32bit-1.9-6.1 libminiupnpc10-debuginfo-32bit-1.9-6.1 - openSUSE 13.2 (i586 x86_64): libminiupnpc-devel-1.9-2.3.1 libminiupnpc10-1.9-2.3.1 libminiupnpc10-debuginfo-1.9-2.3.1 miniupnpc-1.9-2.3.1 miniupnpc-debuginfo-1.9-2.3.1 python-miniupnpc-1.9-2.3.1 python-miniupnpc-debuginfo-1.9-2.3.1 - openSUSE 13.1 (i586 x86_64): libminiupnpc-devel-1.9-2.7.1 libminiupnpc10-1.9-2.7.1 libminiupnpc10-debuginfo-1.9-2.7.1 miniupnpc-1.9-2.7.1 miniupnpc-debuginfo-1.9-2.7.1 python-miniupnpc-1.9-2.7.1 python-miniupnpc-debuginfo-1.9-2.7.1 References: https://www.suse.com/security/cve/CVE-2015-6031.html https://bugzilla.suse.com/950759

1 0

openSUSE-SU-2015:2069-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 21 Nov '15

21 Nov '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2069-1 Rating: moderate References: #950957 #954579 Cross-References: CVE-2015-1302 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Chromium was updated to 46.0.2490.86 to fix one security issue and bugs. The following vulnerability was fixed: * CVE-2015-1302: Information leak in PDF viewer (boo#954579) The following bug fix udpates are included: * boo#950957: Change the default homepage based on the new landing page for the openSUSE Project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-788=1 - openSUSE 13.2: zypper in -t patch openSUSE-2015-788=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-788=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-46.0.2490.86-3.1 chromedriver-debuginfo-46.0.2490.86-3.1 chromium-46.0.2490.86-3.1 chromium-debuginfo-46.0.2490.86-3.1 chromium-debugsource-46.0.2490.86-3.1 chromium-desktop-gnome-46.0.2490.86-3.1 chromium-desktop-kde-46.0.2490.86-3.1 chromium-ffmpegsumo-46.0.2490.86-3.1 chromium-ffmpegsumo-debuginfo-46.0.2490.86-3.1 - openSUSE 13.2 (i586 x86_64): chromedriver-46.0.2490.86-57.1 chromedriver-debuginfo-46.0.2490.86-57.1 chromium-46.0.2490.86-57.1 chromium-debuginfo-46.0.2490.86-57.1 chromium-debugsource-46.0.2490.86-57.1 chromium-desktop-gnome-46.0.2490.86-57.1 chromium-desktop-kde-46.0.2490.86-57.1 chromium-ffmpegsumo-46.0.2490.86-57.1 chromium-ffmpegsumo-debuginfo-46.0.2490.86-57.1 - openSUSE 13.1 (i586 x86_64): chromedriver-46.0.2490.86-112.1 chromedriver-debuginfo-46.0.2490.86-112.1 chromium-46.0.2490.86-112.1 chromium-debuginfo-46.0.2490.86-112.1 chromium-debugsource-46.0.2490.86-112.1 chromium-desktop-gnome-46.0.2490.86-112.1 chromium-desktop-kde-46.0.2490.86-112.1 chromium-ffmpegsumo-46.0.2490.86-112.1 chromium-ffmpegsumo-debuginfo-46.0.2490.86-112.1 References: https://www.suse.com/security/cve/CVE-2015-1302.html https://bugzilla.suse.com/950957 https://bugzilla.suse.com/954579

1 0

openSUSE-SU-2015:2068-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 21 Nov '15

21 Nov '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2068-1 Rating: moderate References: #950957 #954579 Cross-References: CVE-2015-1302 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Chromium was updated to 46.0.2490.86 to fix one security issue and bugs. The following vulnerability was fixed: * CVE-2015-1302: Information leak in PDF viewer (boo#954579) The following bug fix udpates are included: * boo#950957: Change the default homepage based on the new landing page for the openSUSE Project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2015-788=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-46.0.2490.86-31.1 chromedriver-debuginfo-46.0.2490.86-31.1 chromium-46.0.2490.86-31.1 chromium-debuginfo-46.0.2490.86-31.1 chromium-debugsource-46.0.2490.86-31.1 chromium-desktop-gnome-46.0.2490.86-31.1 chromium-desktop-kde-46.0.2490.86-31.1 chromium-ffmpegsumo-46.0.2490.86-31.1 chromium-ffmpegsumo-debuginfo-46.0.2490.86-31.1 References: https://www.suse.com/security/cve/CVE-2015-1302.html https://bugzilla.suse.com/950957 https://bugzilla.suse.com/954579

1 0

openSUSE-RU-2015:2060-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 20 Nov '15

20 Nov '15

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:2060-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This is the weekly internal clamav database refresh on November 16th. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-787=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201511160000-9.1 References:

1 0

openSUSE-RU-2015:2059-1: moderate: Recommended update for compat-openssl098
by maintenance＠opensuse.org 20 Nov '15

20 Nov '15

openSUSE Recommended Update: Recommended update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:2059-1 Rating: moderate References: #947833 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: OpenSSL was updated to fix a bug in TLS session renegotiation. This renegotiation is for instance used with Apache2 client certificate handling, which would fail if ECDHE key exchange is used, which is happening more often after the last openssl update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-786=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-3.1 libopenssl0_9_8-0.9.8j-3.1 libopenssl0_9_8-debuginfo-0.9.8j-3.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-3.1 References: https://bugzilla.suse.com/947833

1 0

openSUSE-SU-2015:2057-1: moderate: Security update for libksba
by opensuse-security＠opensuse.org 20 Nov '15

20 Nov '15

openSUSE Security Update: Security update for libksba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2057-1 Rating: moderate References: #926826 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The libksba package was updated to fix the follow security issues: - Fixed an integer overflow, out of bounds read and stack overflow (bsc#926826). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-785=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-785=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libksba-debugsource-1.3.1-7.1 libksba-devel-1.3.1-7.1 libksba8-1.3.1-7.1 libksba8-debuginfo-1.3.1-7.1 - openSUSE 13.1 (i586 x86_64): libksba-debugsource-1.3.0-5.7.1 libksba-devel-1.3.0-5.7.1 libksba8-1.3.0-5.7.1 libksba8-debuginfo-1.3.0-5.7.1 References: https://bugzilla.suse.com/926826

1 0

openSUSE-SU-2015:2055-1: moderate: Security update for krb5
by opensuse-security＠opensuse.org 20 Nov '15

20 Nov '15

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:2055-1 Rating: moderate References: #954204 Cross-References: CVE-2015-2698 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The krb5 package was update to fix the following security issue: - CVE-2015-2698: Fixed a memory corruption regression introduced by resolution of CVE-2015-2698 (bsc#954204). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-784=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-784=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): krb5-1.12.2-18.1 krb5-client-1.12.2-18.1 krb5-client-debuginfo-1.12.2-18.1 krb5-debuginfo-1.12.2-18.1 krb5-debugsource-1.12.2-18.1 krb5-devel-1.12.2-18.1 krb5-doc-1.12.2-18.1 krb5-mini-1.12.2-18.1 krb5-mini-debuginfo-1.12.2-18.1 krb5-mini-debugsource-1.12.2-18.1 krb5-mini-devel-1.12.2-18.1 krb5-plugin-kdb-ldap-1.12.2-18.1 krb5-plugin-kdb-ldap-debuginfo-1.12.2-18.1 krb5-plugin-preauth-otp-1.12.2-18.1 krb5-plugin-preauth-otp-debuginfo-1.12.2-18.1 krb5-plugin-preauth-pkinit-1.12.2-18.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.2-18.1 krb5-server-1.12.2-18.1 krb5-server-debuginfo-1.12.2-18.1 - openSUSE 13.2 (x86_64): krb5-32bit-1.12.2-18.1 krb5-debuginfo-32bit-1.12.2-18.1 krb5-devel-32bit-1.12.2-18.1 - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.24.1 krb5-client-1.11.3-3.24.1 krb5-client-debuginfo-1.11.3-3.24.1 krb5-debuginfo-1.11.3-3.24.1 krb5-debugsource-1.11.3-3.24.1 krb5-devel-1.11.3-3.24.1 krb5-doc-1.11.3-3.24.1 krb5-mini-1.11.3-3.24.1 krb5-mini-debuginfo-1.11.3-3.24.1 krb5-mini-debugsource-1.11.3-3.24.1 krb5-mini-devel-1.11.3-3.24.1 krb5-plugin-kdb-ldap-1.11.3-3.24.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.24.1 krb5-plugin-preauth-pkinit-1.11.3-3.24.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.24.1 krb5-server-1.11.3-3.24.1 krb5-server-debuginfo-1.11.3-3.24.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.24.1 krb5-debuginfo-32bit-1.11.3-3.24.1 krb5-devel-32bit-1.11.3-3.24.1 References: https://www.suse.com/security/cve/CVE-2015-2698.html https://bugzilla.suse.com/954204

1 0

openSUSE-RU-2015:2045-1: moderate: Recommended update for star
by maintenance＠opensuse.org 19 Nov '15

19 Nov '15

openSUSE Recommended Update: Recommended update for star ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:2045-1 Rating: moderate References: #952299 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with star: - Fix buffer overflow in longnames.c in a case of files with name 100 characters long (boo#952299) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-777=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-777=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): star-1.5final-65.7.1 star-debuginfo-1.5final-65.7.1 star-debugsource-1.5final-65.7.1 - openSUSE 13.1 (i586 x86_64): star-1.5final-61.11.1 star-debuginfo-1.5final-61.11.1 star-debugsource-1.5final-61.11.1 References: https://bugzilla.suse.com/952299

1 0

openSUSE-RU-2015:2044-1: moderate: Recommended update for fcoe-utils
by maintenance＠opensuse.org 19 Nov '15

19 Nov '15

openSUSE Recommended Update: Recommended update for fcoe-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:2044-1 Rating: moderate References: #951859 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fcoe-utils fixes the following issue: - Fix display of NPIV ports (boo#951859) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2015-779=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fcoe-utils-1.0.30-8.1 fcoe-utils-debuginfo-1.0.30-8.1 fcoe-utils-debugsource-1.0.30-8.1 References: https://bugzilla.suse.com/951859

1 0