February 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0309-1: moderate: Recommended update for libvirt
by maintenance＠opensuse.org 18 Feb '15

18 Feb '15

openSUSE Recommended Update: Recommended update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0309-1 Rating: moderate References: #915103 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: libvirt was updated to adjust the apparmor profile to allow ipc_lock capabilities and match upstream configuration, which up to now made some XEN based work not possible. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-159=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libvirt-1.2.9-16.1 libvirt-client-1.2.9-16.1 libvirt-client-debuginfo-1.2.9-16.1 libvirt-daemon-1.2.9-16.1 libvirt-daemon-config-network-1.2.9-16.1 libvirt-daemon-config-nwfilter-1.2.9-16.1 libvirt-daemon-debuginfo-1.2.9-16.1 libvirt-daemon-driver-interface-1.2.9-16.1 libvirt-daemon-driver-interface-debuginfo-1.2.9-16.1 libvirt-daemon-driver-lxc-1.2.9-16.1 libvirt-daemon-driver-lxc-debuginfo-1.2.9-16.1 libvirt-daemon-driver-network-1.2.9-16.1 libvirt-daemon-driver-network-debuginfo-1.2.9-16.1 libvirt-daemon-driver-nodedev-1.2.9-16.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.9-16.1 libvirt-daemon-driver-nwfilter-1.2.9-16.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.9-16.1 libvirt-daemon-driver-qemu-1.2.9-16.1 libvirt-daemon-driver-qemu-debuginfo-1.2.9-16.1 libvirt-daemon-driver-secret-1.2.9-16.1 libvirt-daemon-driver-secret-debuginfo-1.2.9-16.1 libvirt-daemon-driver-storage-1.2.9-16.1 libvirt-daemon-driver-storage-debuginfo-1.2.9-16.1 libvirt-daemon-driver-uml-1.2.9-16.1 libvirt-daemon-driver-uml-debuginfo-1.2.9-16.1 libvirt-daemon-driver-vbox-1.2.9-16.1 libvirt-daemon-driver-vbox-debuginfo-1.2.9-16.1 libvirt-daemon-lxc-1.2.9-16.1 libvirt-daemon-qemu-1.2.9-16.1 libvirt-daemon-uml-1.2.9-16.1 libvirt-daemon-vbox-1.2.9-16.1 libvirt-debugsource-1.2.9-16.1 libvirt-devel-1.2.9-16.1 libvirt-doc-1.2.9-16.1 libvirt-lock-sanlock-1.2.9-16.1 libvirt-lock-sanlock-debuginfo-1.2.9-16.1 libvirt-login-shell-1.2.9-16.1 libvirt-login-shell-debuginfo-1.2.9-16.1 - openSUSE 13.2 (x86_64): libvirt-client-32bit-1.2.9-16.1 libvirt-client-debuginfo-32bit-1.2.9-16.1 libvirt-daemon-driver-libxl-1.2.9-16.1 libvirt-daemon-driver-libxl-debuginfo-1.2.9-16.1 libvirt-daemon-driver-xen-1.2.9-16.1 libvirt-daemon-driver-xen-debuginfo-1.2.9-16.1 libvirt-daemon-xen-1.2.9-16.1 libvirt-devel-32bit-1.2.9-16.1 References: https://bugzilla.suse.com/915103

1 0

openSUSE-SU-2015:0308-1: Security update for mdadm
by opensuse-security＠opensuse.org 18 Feb '15

18 Feb '15

openSUSE Security Update: Security update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0308-1 Rating: low References: #910500 Cross-References: CVE-2014-5220 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mdadm was updated to fix one security issue. This security issue was fixed: - CVE-2014-5220: mdcheck doesn't validate the input of mdadm --detail --export, possible command injection (bnc#910500). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-153=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): mdadm-3.3.1-5.14.1 mdadm-debuginfo-3.3.1-5.14.1 mdadm-debugsource-3.3.1-5.14.1 References: http://support.novell.com/security/cve/CVE-2014-5220.html https://bugzilla.suse.com/910500

1 0

openSUSE-RU-2015:0302-1: Recommended update for tar
by maintenance＠opensuse.org 17 Feb '15

17 Feb '15

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0302-1 Rating: low References: #913058 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for tar fixes the following issues: - extract files recursively with --files-from (bnc#913058) - call autoreconf in %prep Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-151=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-151=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tar-1.28-2.13.1 tar-backup-scripts-1.28-2.13.1 tar-debuginfo-1.28-2.13.1 tar-debugsource-1.28-2.13.1 tar-tests-1.28-2.13.1 tar-tests-debuginfo-1.28-2.13.1 - openSUSE 13.2 (noarch): tar-lang-1.28-2.13.1 - openSUSE 13.1 (i586 x86_64): tar-1.26-19.16.1 tar-backup-scripts-1.26-19.16.1 tar-debuginfo-1.26-19.16.1 tar-debugsource-1.26-19.16.1 - openSUSE 13.1 (noarch): tar-lang-1.26-19.16.1 References: https://bugzilla.suse.com/913058

1 0

openSUSE-RU-2015:0301-1: Recommended update for nfs-utils
by maintenance＠opensuse.org 17 Feb '15

17 Feb '15

openSUSE Recommended Update: Recommended update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0301-1 Rating: low References: #887379 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for nfs-utils fixes the following issues: - Handle external rootflags and internal rootfsopts properly to preserve mount options from fstab (bnc#887379) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-152=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nfs-client-1.2.8-4.17.1 nfs-client-debuginfo-1.2.8-4.17.1 nfs-doc-1.2.8-4.17.1 nfs-kernel-server-1.2.8-4.17.1 nfs-kernel-server-debuginfo-1.2.8-4.17.1 nfs-utils-debugsource-1.2.8-4.17.1 References: https://bugzilla.suse.com/887379

1 0

openSUSE-SU-2015:0300-1: moderate: Security update for dbus-1, dbus-1-x11
by opensuse-security＠opensuse.org 17 Feb '15

17 Feb '15

openSUSE Security Update: Security update for dbus-1, dbus-1-x11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0300-1 Rating: moderate References: #916343 Cross-References: CVE-2015-0245 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dbus-1, dbus-1-x11 were updated to version 1.8.16 to fix one security issue. This update fixes the following security issue: - CVE-2015-0245: Do not allow non-uid-0 processes to send forged ActivationFailure messages. On Linux systems with systemd activation, this would allow a local denial of service (bnc#916343). These additional security hardenings are included: - Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment. - Do not allow calls to UpdateActivationEnvironment or the Stats interface on object paths other than /org/freedesktop/DBus. Some system services install unsafe security policy rules that allow arbitrary method calls to any destination, method and interface with a specified object path. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-150=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-150=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dbus-1-1.8.16-16.1 dbus-1-debuginfo-1.8.16-16.1 dbus-1-debugsource-1.8.16-16.1 dbus-1-devel-1.8.16-16.1 dbus-1-x11-1.8.16-16.1 dbus-1-x11-debuginfo-1.8.16-16.1 dbus-1-x11-debugsource-1.8.16-16.1 libdbus-1-3-1.8.16-16.1 libdbus-1-3-debuginfo-1.8.16-16.1 - openSUSE 13.2 (x86_64): dbus-1-debuginfo-32bit-1.8.16-16.1 dbus-1-devel-32bit-1.8.16-16.1 libdbus-1-3-32bit-1.8.16-16.1 libdbus-1-3-debuginfo-32bit-1.8.16-16.1 - openSUSE 13.2 (noarch): dbus-1-devel-doc-1.8.16-16.1 - openSUSE 13.1 (i586 x86_64): dbus-1-1.8.16-4.36.2 dbus-1-debuginfo-1.8.16-4.36.2 dbus-1-debugsource-1.8.16-4.36.1 dbus-1-devel-1.8.16-4.36.1 dbus-1-x11-1.8.16-4.36.2 dbus-1-x11-debuginfo-1.8.16-4.36.2 dbus-1-x11-debugsource-1.8.16-4.36.2 libdbus-1-3-1.8.16-4.36.1 libdbus-1-3-debuginfo-1.8.16-4.36.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.8.16-4.36.2 dbus-1-devel-32bit-1.8.16-4.36.1 libdbus-1-3-32bit-1.8.16-4.36.1 libdbus-1-3-debuginfo-32bit-1.8.16-4.36.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.8.16-4.36.2 References: http://support.novell.com/security/cve/CVE-2015-0245.html https://bugzilla.suse.com/916343

1 0

openSUSE-RU-2015:0289-1: Recommended update for systemd
by maintenance＠opensuse.org 16 Feb '15

16 Feb '15

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0289-1 Rating: low References: #878853 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for systemd fixes the following issues: - close ssh sessions at shutdown (bsc878853) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-149=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libgudev-1_0-0-208-28.1 libgudev-1_0-0-debuginfo-208-28.1 libgudev-1_0-devel-208-28.1 libudev-devel-208-28.1 libudev-mini-devel-208-28.1 libudev-mini1-208-28.1 libudev-mini1-debuginfo-208-28.1 libudev1-208-28.1 libudev1-debuginfo-208-28.1 nss-myhostname-208-28.1 nss-myhostname-debuginfo-208-28.1 systemd-208-28.1 systemd-debuginfo-208-28.1 systemd-debugsource-208-28.1 systemd-devel-208-28.1 systemd-journal-gateway-208-28.1 systemd-journal-gateway-debuginfo-208-28.1 systemd-logger-208-28.1 systemd-mini-208-28.1 systemd-mini-debuginfo-208-28.1 systemd-mini-debugsource-208-28.1 systemd-mini-devel-208-28.1 systemd-mini-sysvinit-208-28.1 systemd-sysvinit-208-28.1 typelib-1_0-GUdev-1_0-208-28.1 udev-208-28.1 udev-debuginfo-208-28.1 udev-mini-208-28.1 udev-mini-debuginfo-208-28.1 - openSUSE 13.1 (x86_64): libgudev-1_0-0-32bit-208-28.1 libgudev-1_0-0-debuginfo-32bit-208-28.1 libudev1-32bit-208-28.1 libudev1-debuginfo-32bit-208-28.1 nss-myhostname-32bit-208-28.1 nss-myhostname-debuginfo-32bit-208-28.1 systemd-32bit-208-28.1 systemd-debuginfo-32bit-208-28.1 - openSUSE 13.1 (noarch): systemd-rpm-macros-2-28.1 References: https://bugzilla.suse.com/878853

1 0

openSUSE-SU-2015:0286-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 13 Feb '15

13 Feb '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0286-1 Rating: moderate References: #863569 #915789 Cross-References: CVE-2015-1433 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: roundcubemail was updated to version 1.0.5 to fix one security issue. This security issue was fixed: - CVE-2015-1433: program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 did not properly quote strings, which allowed remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email (bnc#915789). Various non-security bugs were resolved in this update. Please see the changes file for details. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-148=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-148=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.5-8.1 - openSUSE 13.1 (noarch): roundcubemail-1.0.5-2.18.1 References: http://support.novell.com/security/cve/CVE-2015-1433.html https://bugzilla.suse.com/863569 https://bugzilla.suse.com/915789

1 0

openSUSE-SU-2015:0285-1: important: Security update for clamav
by opensuse-security＠opensuse.org 13 Feb '15

13 Feb '15

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0285-1 Rating: important References: #915512 #916214 #916215 #916217 Cross-References: CVE-2014-9328 CVE-2015-1461 CVE-2015-1462 CVE-2015-1463 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: clamav was updated to version 0.98.6 that fixes bugs and several security issues: * bsc#916217, CVE-2015-1461: Remote attackers can have unspecified impact via Yoda's crypter or mew packer files. * bsc#916214, CVE-2015-1462: Unspecified impact via acrafted upx packer file. * bsc#916215, CVE-2015-1463: Remote attackers can cause a denial of service via a crafted petite packer file. * bsc#915512, CVE-2014-9328: heap out of bounds condition with crafted upack packer files. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-147=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-147=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.98.6-2.13.1 clamav-debuginfo-0.98.6-2.13.1 clamav-debugsource-0.98.6-2.13.1 - openSUSE 13.1 (i586 x86_64): clamav-0.98.6-30.1 clamav-debuginfo-0.98.6-30.1 clamav-debugsource-0.98.6-30.1 References: http://support.novell.com/security/cve/CVE-2014-9328.html http://support.novell.com/security/cve/CVE-2015-1461.html http://support.novell.com/security/cve/CVE-2015-1462.html http://support.novell.com/security/cve/CVE-2015-1463.html https://bugzilla.suse.com/915512 https://bugzilla.suse.com/916214 https://bugzilla.suse.com/916215 https://bugzilla.suse.com/916217

1 0

openSUSE-SU-2015:0284-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 13 Feb '15

13 Feb '15

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0284-1 Rating: moderate References: #905870 #905871 #905872 Cross-References: CVE-2014-8767 CVE-2014-8768 CVE-2014-8769 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: tcpdump was updated to fix three security issues. These security issues were fixed: - CVE-2014-8767: Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allowed remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame (bnc#905870 905871). - CVE-2014-8769: tcpdump 3.8 through 4.6.2 might allowed remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access (bnc#905871 905872). - CVE-2014-8768: Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allowed remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame (bnc#905871). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-146=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-146=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tcpdump-4.6.2-4.1 tcpdump-debuginfo-4.6.2-4.1 tcpdump-debugsource-4.6.2-4.1 - openSUSE 13.1 (i586 x86_64): tcpdump-4.4.0-2.4.1 tcpdump-debuginfo-4.4.0-2.4.1 tcpdump-debugsource-4.4.0-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-8767.html http://support.novell.com/security/cve/CVE-2014-8768.html http://support.novell.com/security/cve/CVE-2014-8769.html https://bugzilla.suse.com/905870 https://bugzilla.suse.com/905871 https://bugzilla.suse.com/905872

1 0

openSUSE-RU-2015:0283-1: Recommended update for argyllcms
by maintenance＠opensuse.org 13 Feb '15

13 Feb '15

openSUSE Recommended Update: Recommended update for argyllcms ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0283-1 Rating: low References: #914679 #916158 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for argyllcms fixes the following issues: - Add argyllcms.changes to Source, used to compute timestamp - Use a stable timestamp for generated files (boo#916158), ensuring build is reproducible. - Move reference files to /usr/share/argyll/ref, expected path from gnome-color-manager (bsc#914679). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-145=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): argyllcms-1.6.3-2.4.1 argyllcms-debuginfo-1.6.3-2.4.1 argyllcms-debugsource-1.6.3-2.4.1 argyllcms-doc-1.6.3-2.4.1 References: https://bugzilla.suse.com/914679 https://bugzilla.suse.com/916158

1 0