March 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0419-1: moderate: Recommended update for cloud-init
by maintenance＠opensuse.org 04 Mar '15

04 Mar '15

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0419-1 Rating: moderate References: #918952 #919305 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: cloud-init was updated to: - Properly handle persistent network device names for OpenNebula - Properly set up network mode if interface config file - Require e2fsprogs for filesystem resizing Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-192=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cloud-init-0.7.5-5.8.1 cloud-init-doc-0.7.5-5.8.1 cloud-init-test-0.7.5-5.8.1 References: https://bugzilla.suse.com/918952 https://bugzilla.suse.com/919305

1 0

openSUSE-SU-2015:0418-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 04 Mar '15

04 Mar '15

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0418-1 Rating: moderate References: #918352 Cross-References: CVE-2015-0228 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: apache2 was updated to fix one security issue. This security issue was fixed: - CVE-2015-0228: Mod_lua websocket DoS (bnc#918352). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-191=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-2.4.10-16.1 apache2-debuginfo-2.4.10-16.1 apache2-debugsource-2.4.10-16.1 apache2-devel-2.4.10-16.1 apache2-event-2.4.10-16.1 apache2-event-debuginfo-2.4.10-16.1 apache2-example-pages-2.4.10-16.1 apache2-prefork-2.4.10-16.1 apache2-prefork-debuginfo-2.4.10-16.1 apache2-utils-2.4.10-16.1 apache2-utils-debuginfo-2.4.10-16.1 apache2-worker-2.4.10-16.1 apache2-worker-debuginfo-2.4.10-16.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-16.1 References: http://support.novell.com/security/cve/CVE-2015-0228.html https://bugzilla.suse.com/918352

1 0

openSUSE-SU-2015:0414-1: moderate: Security update for postgresql93
by opensuse-security＠opensuse.org 03 Mar '15

03 Mar '15

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0414-1 Rating: moderate References: #916953 Cross-References: CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: postgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed: - CVE-2015-0241: Fix buffer overruns in to_char() (bnc#916953). - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto (bnc#916953). - CVE-2015-0244: Fix possible loss of frontend/backend protocol synchronization after an error (bnc#916953). - CVE-2014-8161: Fix information leak via constraint-violation error messages (bnc#916953). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.6-2.4.1 libecpg6-debuginfo-9.3.6-2.4.1 libpq5-9.3.6-2.4.1 libpq5-debuginfo-9.3.6-2.4.1 postgresql93-9.3.6-2.4.1 postgresql93-contrib-9.3.6-2.4.1 postgresql93-contrib-debuginfo-9.3.6-2.4.1 postgresql93-debuginfo-9.3.6-2.4.1 postgresql93-debugsource-9.3.6-2.4.1 postgresql93-devel-9.3.6-2.4.1 postgresql93-devel-debuginfo-9.3.6-2.4.1 postgresql93-libs-debugsource-9.3.6-2.4.1 postgresql93-plperl-9.3.6-2.4.1 postgresql93-plperl-debuginfo-9.3.6-2.4.1 postgresql93-plpython-9.3.6-2.4.1 postgresql93-plpython-debuginfo-9.3.6-2.4.1 postgresql93-pltcl-9.3.6-2.4.1 postgresql93-pltcl-debuginfo-9.3.6-2.4.1 postgresql93-server-9.3.6-2.4.1 postgresql93-server-debuginfo-9.3.6-2.4.1 postgresql93-test-9.3.6-2.4.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.6-2.4.1 libecpg6-debuginfo-32bit-9.3.6-2.4.1 libpq5-32bit-9.3.6-2.4.1 libpq5-debuginfo-32bit-9.3.6-2.4.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.6-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-8161.html http://support.novell.com/security/cve/CVE-2015-0241.html http://support.novell.com/security/cve/CVE-2015-0243.html http://support.novell.com/security/cve/CVE-2015-0244.html https://bugzilla.suse.com/916953

1 0

openSUSE-SU-2015:0413-1: Security update for python-rope
by opensuse-security＠opensuse.org 03 Mar '15

03 Mar '15

openSUSE Security Update: Security update for python-rope ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0413-1 Rating: low References: #916890 Cross-References: CVE-2014-3539 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: python-rope was updated to fix one security issue. This security issue was fixed: - CVE-2014-3539: Disable dynamic object analysis by default (bnc#916890). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-190=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-190=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-rope-0.9.4-8.4.1 - openSUSE 13.1 (noarch): python-rope-0.9.4-6.4.1 References: http://support.novell.com/security/cve/CVE-2014-3539.html https://bugzilla.suse.com/916890

1 0

openSUSE-RU-2015:0407-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 01 Mar '15

01 Mar '15

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0407-1 Rating: moderate References: #904323 #905421 #909307 #911299 #911562 #914792 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: wicked was updated to version 0.6.17 fixing various bugs. - nanny: fixed a memory-leak on policy load failure - wickedd: fixed broken dummy0 autocreation workaround - ifreload: segfault fix to require argument for --timeout option - client/nanny: initial handing of link-detection/require-link and timeout control flags (LINK_REQUIRED, LINK_READY_WAIT variables in suse ifcfg) to continue setup without ready link when requested in the config or based on device requirements (bsc#911562,bsc#914792). - client/nanny: wait for event ACKs from wickedd instead to continue on successful request results where possible, to minimize the risk of an event backlog (bsc#905421). - client/nanny: fsm timer and cleanup related fixes and improvements, fix to use "device-setup" (MAC, bond/bridge options, ...) as state name instead of "device-up" and use "device-up" as state when the device/link is administratively set UP. Separated waitLinkUp method to wait for link/carrier from linkUp setting it administratively UP. - wickedd: fix to handle automatically created dummy0 interface - wireless: consider auth-proto parameter (wpa1|wpa2) (bsc#911299) - ipv6: add accept-dad sysctl support, fix accept-ra constants - dhcp4: do not set/query mtu if set in the config (bsc#904323) - dhcp4: limit MTU to be lower-equal 576 as before - dhcp4: completed user-class option support permitting an rfc3004 formatted option or as non-rfc, but widely used string (bsc#909307) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-188=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libwicked-0-6-0.6.17-12.1 libwicked-0-6-debuginfo-0.6.17-12.1 wicked-0.6.17-12.1 wicked-debuginfo-0.6.17-12.1 wicked-debugsource-0.6.17-12.1 wicked-service-0.6.17-12.1 References: https://bugzilla.suse.com/904323 https://bugzilla.suse.com/905421 https://bugzilla.suse.com/909307 https://bugzilla.suse.com/911299 https://bugzilla.suse.com/911562 https://bugzilla.suse.com/914792

1 0

openSUSE-RU-2015:0406-1: moderate: Recommended update for shared-mime-info
by maintenance＠opensuse.org 01 Mar '15

01 Mar '15

openSUSE Recommended Update: Recommended update for shared-mime-info ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0406-1 Rating: moderate References: #904100 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: shared-mime-info was updated to adjust the priority for ISO images. (fdo#80877, kde#337035, boo#904100) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-187=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): shared-mime-info-1.4-2.4.1 shared-mime-info-debuginfo-1.4-2.4.1 shared-mime-info-debugsource-1.4-2.4.1 - openSUSE 13.2 (noarch): shared-mime-info-lang-1.4-2.4.1 References: https://bugzilla.suse.com/904100

1 0

openSUSE-RU-2015:0405-1: moderate: Recommended update for star
by maintenance＠opensuse.org 01 Mar '15

01 Mar '15

openSUSE Recommended Update: Recommended update for star ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0405-1 Rating: moderate References: #918021 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: star was updated to fix a situation when star outputs contents of an archive to stderr instead of stdout (bnc#918021). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-186=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-186=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): star-1.5final-65.4.1 star-debuginfo-1.5final-65.4.1 star-debugsource-1.5final-65.4.1 - openSUSE 13.1 (i586 x86_64): star-1.5final-61.8.1 star-debuginfo-1.5final-61.8.1 star-debugsource-1.5final-61.8.1 References: https://bugzilla.suse.com/918021

1 0

openSUSE-SU-2015:0404-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 01 Mar '15

01 Mar '15

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0404-1 Rating: important References: #910647 #917597 Cross-References: CVE-2014-1569 CVE-2015-0819 CVE-2015-0820 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0828 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nss were updated to fix 18 security issues. MozillaFirefox was updated to version 36.0. These security issues were fixed: - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory safety hazards - CVE-2015-0832: Appended period to hostnames can bypass HPKP and HSTS protections - CVE-2015-0830: Malicious WebGL content crash when writing strings - CVE-2015-0834: TLS TURN and STUN connections silently fail to simple TCP connections - CVE-2015-0831: Use-after-free in IndexedDB - CVE-2015-0829: Buffer overflow in libstagefright during MP4 video playback - CVE-2015-0828: Double-free when using non-default memory allocators with a zero-length XHR - CVE-2015-0827: Out-of-bounds read and write while rendering SVG content - CVE-2015-0826: Buffer overflow during CSS restyling - CVE-2015-0825: Buffer underflow during MP3 playback - CVE-2015-0824: Crash using DrawTarget in Cairo graphics library - CVE-2015-0823: Use-after-free in Developer Console date with OpenType Sanitiser - CVE-2015-0822: Reading of local files through manipulation of form autocomplete - CVE-2015-0821: Local files or privileged URLs in pages can be opened into new tabs - CVE-2015-0819: UI Tour whitelisted sites in background tab can spoof foreground tabs - CVE-2015-0820: Caja Compiler JavaScript sandbox bypass mozilla-nss was updated to version 3.17.4 to fix the following issues: - CVE-2014-1569: QuickDER decoder length issue (bnc#910647). - bmo#1084986: If an SSL/TLS connection fails, because client and server don't have any common protocol version enabled, NSS has been changed to report error code SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting SSL_ERROR_NO_CYPHER_OVERLAP). - bmo#1112461: libpkix was fixed to prefer the newest certificate, if multiple certificates match. - bmo#1094492: fixed a memory corruption issue during failure of keypair generation. - bmo#1113632: fixed a failure to reload a PKCS#11 module in FIPS mode. - bmo#1119983: fixed interoperability of NSS server code with a LibreSSL client. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-185=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-185=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-36.0-14.2 MozillaFirefox-branding-upstream-36.0-14.2 MozillaFirefox-buildsymbols-36.0-14.2 MozillaFirefox-debuginfo-36.0-14.2 MozillaFirefox-debugsource-36.0-14.2 MozillaFirefox-devel-36.0-14.2 MozillaFirefox-translations-common-36.0-14.2 MozillaFirefox-translations-other-36.0-14.2 libfreebl3-3.17.4-9.1 libfreebl3-debuginfo-3.17.4-9.1 libsoftokn3-3.17.4-9.1 libsoftokn3-debuginfo-3.17.4-9.1 mozilla-nss-3.17.4-9.1 mozilla-nss-certs-3.17.4-9.1 mozilla-nss-certs-debuginfo-3.17.4-9.1 mozilla-nss-debuginfo-3.17.4-9.1 mozilla-nss-debugsource-3.17.4-9.1 mozilla-nss-devel-3.17.4-9.1 mozilla-nss-sysinit-3.17.4-9.1 mozilla-nss-sysinit-debuginfo-3.17.4-9.1 mozilla-nss-tools-3.17.4-9.1 mozilla-nss-tools-debuginfo-3.17.4-9.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.17.4-9.1 libfreebl3-debuginfo-32bit-3.17.4-9.1 libsoftokn3-32bit-3.17.4-9.1 libsoftokn3-debuginfo-32bit-3.17.4-9.1 mozilla-nss-32bit-3.17.4-9.1 mozilla-nss-certs-32bit-3.17.4-9.1 mozilla-nss-certs-debuginfo-32bit-3.17.4-9.1 mozilla-nss-debuginfo-32bit-3.17.4-9.1 mozilla-nss-sysinit-32bit-3.17.4-9.1 mozilla-nss-sysinit-debuginfo-32bit-3.17.4-9.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-36.0-59.2 MozillaFirefox-branding-upstream-36.0-59.2 MozillaFirefox-buildsymbols-36.0-59.2 MozillaFirefox-debuginfo-36.0-59.2 MozillaFirefox-debugsource-36.0-59.2 MozillaFirefox-devel-36.0-59.2 MozillaFirefox-translations-common-36.0-59.2 MozillaFirefox-translations-other-36.0-59.2 libfreebl3-3.17.4-52.1 libfreebl3-debuginfo-3.17.4-52.1 libsoftokn3-3.17.4-52.1 libsoftokn3-debuginfo-3.17.4-52.1 mozilla-nss-3.17.4-52.1 mozilla-nss-certs-3.17.4-52.1 mozilla-nss-certs-debuginfo-3.17.4-52.1 mozilla-nss-debuginfo-3.17.4-52.1 mozilla-nss-debugsource-3.17.4-52.1 mozilla-nss-devel-3.17.4-52.1 mozilla-nss-sysinit-3.17.4-52.1 mozilla-nss-sysinit-debuginfo-3.17.4-52.1 mozilla-nss-tools-3.17.4-52.1 mozilla-nss-tools-debuginfo-3.17.4-52.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.17.4-52.1 libfreebl3-debuginfo-32bit-3.17.4-52.1 libsoftokn3-32bit-3.17.4-52.1 libsoftokn3-debuginfo-32bit-3.17.4-52.1 mozilla-nss-32bit-3.17.4-52.1 mozilla-nss-certs-32bit-3.17.4-52.1 mozilla-nss-certs-debuginfo-32bit-3.17.4-52.1 mozilla-nss-debuginfo-32bit-3.17.4-52.1 mozilla-nss-sysinit-32bit-3.17.4-52.1 mozilla-nss-sysinit-debuginfo-32bit-3.17.4-52.1 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2015-0819.html http://support.novell.com/security/cve/CVE-2015-0820.html http://support.novell.com/security/cve/CVE-2015-0821.html http://support.novell.com/security/cve/CVE-2015-0822.html http://support.novell.com/security/cve/CVE-2015-0823.html http://support.novell.com/security/cve/CVE-2015-0824.html http://support.novell.com/security/cve/CVE-2015-0825.html http://support.novell.com/security/cve/CVE-2015-0826.html http://support.novell.com/security/cve/CVE-2015-0827.html http://support.novell.com/security/cve/CVE-2015-0828.html http://support.novell.com/security/cve/CVE-2015-0829.html http://support.novell.com/security/cve/CVE-2015-0830.html http://support.novell.com/security/cve/CVE-2015-0831.html http://support.novell.com/security/cve/CVE-2015-0832.html http://support.novell.com/security/cve/CVE-2015-0834.html http://support.novell.com/security/cve/CVE-2015-0835.html http://support.novell.com/security/cve/CVE-2015-0836.html https://bugzilla.suse.com/910647 https://bugzilla.suse.com/917597

1 0