February 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0264-1: Recommended update for yast2
by maintenance＠opensuse.org 12 Feb '15

12 Feb '15

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0264-1 Rating: low References: #912169 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for yast2 fixes the following issues: - Update to version 3.1.109.1 * Better handling of line breaks in system log viewer (bnc#912169) * fixed \r, \f, \v and \b characters lost during conversion to Ruby * enable automatic rubocop style checker and adjust code to YaST style guide * Treat PowerNV platform as CHRP Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-134=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): yast2-3.1.109.1-8.1 yast2-devel-doc-3.1.109.1-8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912169

1 0

openSUSE-RU-2015:0263-1: Recommended update for lvm2
by maintenance＠opensuse.org 12 Feb '15

12 Feb '15

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0263-1 Rating: low References: #894202 #914415 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for lvm2 fixes the following issues: - fixes not to support dasd device(bsc#894202) and not start lvm2-lvmetad.socket(bsc#914415) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-132=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): lvm2-2.02.98-43.17.1 lvm2-clvm-2.02.98-43.17.1 lvm2-clvm-debuginfo-2.02.98-43.17.1 lvm2-cmirrord-2.02.98-43.17.1 lvm2-cmirrord-debuginfo-2.02.98-43.17.1 lvm2-debuginfo-2.02.98-43.17.1 lvm2-debugsource-2.02.98-43.17.1 lvm2-devel-2.02.98-43.17.1 References: https://bugzilla.suse.com/show_bug.cgi?id=894202 https://bugzilla.suse.com/show_bug.cgi?id=914415

1 0

openSUSE-RU-2015:0262-1: Recommended update for squid
by maintenance＠opensuse.org 12 Feb '15

12 Feb '15

openSUSE Recommended Update: Recommended update for squid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0262-1 Rating: low References: #915397 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for squid fixes the following issues: - Avoid building with unsupported instructions (boo#915397) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-137=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-137=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): squid-3.4.4-3.4.2 squid-debuginfo-3.4.4-3.4.2 squid-debugsource-3.4.4-3.4.2 - openSUSE 13.1 (i586 x86_64): squid-3.3.13-2.14.1 squid-debuginfo-3.3.13-2.14.1 squid-debugsource-3.3.13-2.14.1 References: https://bugzilla.suse.com/show_bug.cgi?id=915397

1 0

openSUSE-RU-2015:0261-1: Recommended update for cloud-init
by maintenance＠opensuse.org 12 Feb '15

12 Feb '15

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0261-1 Rating: low References: #914920 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for cloud-init fixes the following issues: - Remove Requires for python-yaml . There's already the right requirement for python-PyYAML - fixed syntax error in dmidecode on ppc64 patch (bnc#914920) - users-groups module checks if the account is locked by calling 'passwd -l' which is ok but it should not raise if the account is already locked. This patch will cause lock_passwd to raise only if the account locking failed cloud-init-no-user-lock-if-already-locked.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-131=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cloud-init-0.7.5-5.4.1 cloud-init-doc-0.7.5-5.4.1 cloud-init-test-0.7.5-5.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=914920

1 0

openSUSE-RU-2015:0260-1: Recommended update for tigervnc
by maintenance＠opensuse.org 12 Feb '15

12 Feb '15

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0260-1 Rating: low References: #908738 #915782 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for tigervnc fixes the following issues: - Added patch to revert bugged upstream commit. (bnc#915782) - Rebuild against fltk backported patches for cursor and clipboard handling. (bnc#908738) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-133=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.22.2 tigervnc-debuginfo-1.4.1-6.22.2 tigervnc-debugsource-1.4.1-6.22.2 xorg-x11-Xvnc-1.4.1-6.22.2 xorg-x11-Xvnc-debuginfo-1.4.1-6.22.2 References: https://bugzilla.suse.com/show_bug.cgi?id=908738 https://bugzilla.suse.com/show_bug.cgi?id=915782

1 0

openSUSE-SU-2015:0256-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 Feb '15

11 Feb '15

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0256-1 Rating: important References: #826717 #866902 #882089 #889526 #896023 #897906 #898772 #900292 #901317 #903357 #903359 #903850 #903967 #903970 #904255 #905465 #905467 #906439 #906996 #910681 Cross-References: CVE-2013-3495 CVE-2014-5146 CVE-2014-5149 CVE-2014-8594 CVE-2014-8595 CVE-2014-8866 CVE-2014-8867 CVE-2014-9030 CVE-2014-9065 CVE-2014-9066 CVE-2015-0361 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 9 fixes is now available. Description: The XEN virtualization was updated to fix bugs and security issues: Security issues fixed: CVE-2015-0361: XSA-116: xen: xen crash due to use after free on hvm guest teardown CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation CVE-2014-9030: XSA-113: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling CVE-2014-8867: XSA-112: xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor CVE-2014-8866: XSA-111: xen: Excessive checking in compatibility mode hypercall argument translation CVE-2014-8595: XSA-110: xen: Missing privilege level checks in x86 emulation of far branches CVE-2014-8594: XSA-109: xen: Insufficient restrictions on certain MMU update hypercalls CVE-2013-3495: XSA-59: xen: Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts CVE-2014-5146, CVE-2014-5149: xen: XSA-97 Long latency virtual-mmu operations are not preemptible Bugs fixed: - Restore missing fixes from block-dmmd script - bnc#904255 - XEN boot hangs in early boot on UEFI system - Fix missing banner by restoring figlet program - bnc#903357 - Corrupted save/restore test leaves orphaned data in xenstore - bnc#903359 - Temporary migration name is not cleaned up after migration - bnc#903850 - Xen: guest user mode triggerable VM exits not handled by hypervisor - bnc#866902 - Xen save/restore of HVM guests cuts off disk and networking - bnc#901317 - increase limit domUloader to 32MB - bnc#898772 - SLES 12 RC3 - XEN Host crashes when assigning non-VF device (SR-IOV) to guest - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bsc#900292 - xl: change default dump directory - Update xen2libvirt.py to better detect and handle file formats - bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus - bnc#897906 - libxc: check return values on mmap() and madvise() on xc_alloc_hypercall_buffer() - bnc#896023 - Adjust xentop column layout Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-129=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.1_08-9.1 xen-devel-4.4.1_08-9.1 xen-libs-4.4.1_08-9.1 xen-libs-debuginfo-4.4.1_08-9.1 xen-tools-domU-4.4.1_08-9.1 xen-tools-domU-debuginfo-4.4.1_08-9.1 - openSUSE 13.2 (x86_64): xen-4.4.1_08-9.1 xen-doc-html-4.4.1_08-9.1 xen-kmp-default-4.4.1_08_k3.16.7_7-9.1 xen-kmp-default-debuginfo-4.4.1_08_k3.16.7_7-9.1 xen-kmp-desktop-4.4.1_08_k3.16.7_7-9.1 xen-kmp-desktop-debuginfo-4.4.1_08_k3.16.7_7-9.1 xen-libs-32bit-4.4.1_08-9.1 xen-libs-debuginfo-32bit-4.4.1_08-9.1 xen-tools-4.4.1_08-9.1 xen-tools-debuginfo-4.4.1_08-9.1 References: http://support.novell.com/security/cve/CVE-2013-3495.html http://support.novell.com/security/cve/CVE-2014-5146.html http://support.novell.com/security/cve/CVE-2014-5149.html http://support.novell.com/security/cve/CVE-2014-8594.html http://support.novell.com/security/cve/CVE-2014-8595.html http://support.novell.com/security/cve/CVE-2014-8866.html http://support.novell.com/security/cve/CVE-2014-8867.html http://support.novell.com/security/cve/CVE-2014-9030.html http://support.novell.com/security/cve/CVE-2014-9065.html http://support.novell.com/security/cve/CVE-2014-9066.html http://support.novell.com/security/cve/CVE-2015-0361.html https://bugzilla.suse.com/show_bug.cgi?id=826717 https://bugzilla.suse.com/show_bug.cgi?id=866902 https://bugzilla.suse.com/show_bug.cgi?id=882089 https://bugzilla.suse.com/show_bug.cgi?id=889526 https://bugzilla.suse.com/show_bug.cgi?id=896023 https://bugzilla.suse.com/show_bug.cgi?id=897906 https://bugzilla.suse.com/show_bug.cgi?id=898772 https://bugzilla.suse.com/show_bug.cgi?id=900292 https://bugzilla.suse.com/show_bug.cgi?id=901317 https://bugzilla.suse.com/show_bug.cgi?id=903357 https://bugzilla.suse.com/show_bug.cgi?id=903359 https://bugzilla.suse.com/show_bug.cgi?id=903850 https://bugzilla.suse.com/show_bug.cgi?id=903967 https://bugzilla.suse.com/show_bug.cgi?id=903970 https://bugzilla.suse.com/show_bug.cgi?id=904255 https://bugzilla.suse.com/show_bug.cgi?id=905465 https://bugzilla.suse.com/show_bug.cgi?id=905467 https://bugzilla.suse.com/show_bug.cgi?id=906439 https://bugzilla.suse.com/show_bug.cgi?id=906996 https://bugzilla.suse.com/show_bug.cgi?id=910681

1 0

openSUSE-SU-2015:0255-1: moderate: Security update for krb5
by opensuse-security＠opensuse.org 11 Feb '15

11 Feb '15

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0255-1 Rating: moderate References: #897874 #898439 #912002 Cross-References: CVE-2014-5351 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: krb5 was updated to fix five security issues. These security issues were fixed: - CVE-2014-5351: current keys returned when randomizing the keys for a service principal (bnc#897874) - CVE-2014-5352: An authenticated attacker could cause a vulnerable application (including kadmind) to crash or to execute arbitrary code (bnc#912002). - CVE-2014-9421: An authenticated attacker could cause kadmind or other vulnerable server application to crash or to execute arbitrary code (bnc#912002). - CVE-2014-9422: An attacker who possess the key of a particularly named principal (such as "kad/root") could impersonate any user to kadmind and perform administrative actions as that user (bnc#912002). - CVE-2014-9423: An attacker could attempt to glean sensitive information from the four or eight bytes of uninitialized data output by kadmind or other libgssrpc server application. Because MIT krb5 generally sanitizes memory containing krb5 keys before freeing it, it is unlikely that kadmind would leak Kerberos key information, but it is not impossible (bnc#912002). This non-security issue was fixed: - Work around replay cache creation race (bnc#898439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-128=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): krb5-1.12.2-6.1 krb5-client-1.12.2-6.1 krb5-client-debuginfo-1.12.2-6.1 krb5-debuginfo-1.12.2-6.1 krb5-debugsource-1.12.2-6.1 krb5-devel-1.12.2-6.1 krb5-doc-1.12.2-6.1 krb5-mini-1.12.2-6.1 krb5-mini-debuginfo-1.12.2-6.1 krb5-mini-debugsource-1.12.2-6.1 krb5-mini-devel-1.12.2-6.1 krb5-plugin-kdb-ldap-1.12.2-6.1 krb5-plugin-kdb-ldap-debuginfo-1.12.2-6.1 krb5-plugin-preauth-otp-1.12.2-6.1 krb5-plugin-preauth-otp-debuginfo-1.12.2-6.1 krb5-plugin-preauth-pkinit-1.12.2-6.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.2-6.1 krb5-server-1.12.2-6.1 krb5-server-debuginfo-1.12.2-6.1 - openSUSE 13.2 (x86_64): krb5-32bit-1.12.2-6.1 krb5-debuginfo-32bit-1.12.2-6.1 krb5-devel-32bit-1.12.2-6.1 References: http://support.novell.com/security/cve/CVE-2014-5351.html http://support.novell.com/security/cve/CVE-2014-5352.html http://support.novell.com/security/cve/CVE-2014-9421.html http://support.novell.com/security/cve/CVE-2014-9422.html http://support.novell.com/security/cve/CVE-2014-9423.html https://bugzilla.suse.com/show_bug.cgi?id=897874 https://bugzilla.suse.com/show_bug.cgi?id=898439 https://bugzilla.suse.com/show_bug.cgi?id=912002

1 0

openSUSE-RU-2015:0252-1: Recommended update for xlockmore
by maintenance＠opensuse.org 10 Feb '15

10 Feb '15

openSUSE Recommended Update: Recommended update for xlockmore ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0252-1 Rating: low References: #911133 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xlockmore fixes the following issues: - [bnc#911133]: fixes Xinerama support. If you have more than one display, you want it. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-126=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-126=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xlockmore-5.43-6.4.1 xlockmore-debuginfo-5.43-6.4.1 xlockmore-debugsource-5.43-6.4.1 - openSUSE 13.1 (i586 x86_64): xlockmore-5.43-2.4.1 xlockmore-debuginfo-5.43-2.4.1 xlockmore-debugsource-5.43-2.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911133

1 0

openSUSE-RU-2015:0250-1: Recommended update for zsh
by maintenance＠opensuse.org 10 Feb '15

10 Feb '15

openSUSE Recommended Update: Recommended update for zsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0250-1 Rating: low References: #900424 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for zsh fixes the following issues: - Add back rpm completion file (bnc#900424) - Harden CFLAGS/LDFLAGS Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-127=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): zsh-5.0.7-4.1 zsh-debuginfo-5.0.7-4.1 zsh-debugsource-5.0.7-4.1 zsh-htmldoc-5.0.7-4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900424

1 0

openSUSE-SU-2015:0249-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 10 Feb '15

10 Feb '15

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0249-1 Rating: moderate References: #915410 Cross-References: CVE-2014-9512 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rsync was updated to fix one security issue. This security issue was fixed: - Path spoofing attack vulnerability (CVE-2014-9512). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-124=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-124=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rsync-3.1.1-2.4.1 rsync-debuginfo-3.1.1-2.4.1 rsync-debugsource-3.1.1-2.4.1 - openSUSE 13.1 (i586 x86_64): rsync-3.1.0-21.12.1 rsync-debuginfo-3.1.0-21.12.1 rsync-debugsource-3.1.0-21.12.1 References: http://support.novell.com/security/cve/CVE-2014-9512.html https://bugzilla.suse.com/show_bug.cgi?id=915410

1 0