March 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0623-1: moderate: Recommended update for lvm2
by maintenance＠opensuse.org 30 Mar '15

30 Mar '15

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0623-1 Rating: moderate References: #923021 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for lvm2 fixes the following issue: - Fix raid metadata miscaculation (bsc#923021) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-272=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): lvm2-2.02.98-0.28.34.1 lvm2-clvm-2.02.98-28.34.1 lvm2-clvm-debuginfo-2.02.98-28.34.1 lvm2-cmirrord-2.02.98-28.34.1 lvm2-cmirrord-debuginfo-2.02.98-28.34.1 lvm2-debuginfo-2.02.98-0.28.34.1 lvm2-debugsource-2.02.98-0.28.34.1 References: https://bugzilla.suse.com/923021

1 0

openSUSE-SU-2015:0622-1: moderate: Security update for gnutls
by opensuse-security＠opensuse.org 30 Mar '15

30 Mar '15

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0622-1 Rating: moderate References: #919938 Cross-References: CVE-2015-0294 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnutls was updated to fix a security issue: A certificate algorithm consistency checking issue was fixed (CVE-2015-0294). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-269=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gnutls-3.2.18-8.1 gnutls-debuginfo-3.2.18-8.1 gnutls-debugsource-3.2.18-8.1 libgnutls-devel-3.2.18-8.1 libgnutls-openssl-devel-3.2.18-8.1 libgnutls-openssl27-3.2.18-8.1 libgnutls-openssl27-debuginfo-3.2.18-8.1 libgnutls28-3.2.18-8.1 libgnutls28-debuginfo-3.2.18-8.1 libgnutlsxx-devel-3.2.18-8.1 libgnutlsxx28-3.2.18-8.1 libgnutlsxx28-debuginfo-3.2.18-8.1 - openSUSE 13.2 (x86_64): libgnutls-devel-32bit-3.2.18-8.1 libgnutls28-32bit-3.2.18-8.1 libgnutls28-debuginfo-32bit-3.2.18-8.1 - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.32.1 gnutls-debuginfo-3.2.4-2.32.1 gnutls-debugsource-3.2.4-2.32.1 libgnutls-devel-3.2.4-2.32.1 libgnutls-openssl-devel-3.2.4-2.32.1 libgnutls-openssl27-3.2.4-2.32.1 libgnutls-openssl27-debuginfo-3.2.4-2.32.1 libgnutls28-3.2.4-2.32.1 libgnutls28-debuginfo-3.2.4-2.32.1 libgnutlsxx-devel-3.2.4-2.32.1 libgnutlsxx28-3.2.4-2.32.1 libgnutlsxx28-debuginfo-3.2.4-2.32.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.32.1 libgnutls28-32bit-3.2.4-2.32.1 libgnutls28-debuginfo-32bit-3.2.4-2.32.1 References: https://www.suse.com/security/cve/CVE-2015-0294.html https://bugzilla.suse.com/919938

1 0

openSUSE-SU-2015:0617-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 27 Mar '15

27 Mar '15

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0617-1 Rating: moderate References: #923070 Cross-References: CVE-2014-9462 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mercurial was updated to fix a command Injection via sshpeer._validaterepo() (CVE-2014-9462, bnc#923070). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-268=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): mercurial-3.1.2-4.1 mercurial-debuginfo-3.1.2-4.1 mercurial-debugsource-3.1.2-4.1 - openSUSE 13.2 (noarch): mercurial-lang-3.1.2-4.1 - openSUSE 13.1 (i586 x86_64): mercurial-2.7.1-2.4.1 mercurial-debuginfo-2.7.1-2.4.1 mercurial-debugsource-2.7.1-2.4.1 - openSUSE 13.1 (noarch): mercurial-lang-2.7.1-2.4.1 References: https://www.suse.com/security/cve/CVE-2014-9462.html https://bugzilla.suse.com/923070

1 0

openSUSE-SU-2015:0616-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 27 Mar '15

27 Mar '15

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0616-1 Rating: moderate References: #922220 #922221 #922222 #922223 #923142 Cross-References: CVE-2014-9140 CVE-2015-0261 CVE-2015-2153 CVE-2015-2154 CVE-2015-2155 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: tcpdump was updated to fix five vulnerabilities in protocol printers When running tcpdump, a remote unauthenticated user could have crashed the application or, potentially, execute arbitrary code by injecting crafted packages into the network. The following vulnerabilities were fixed: * IPv6 mobility printer remote DoS (CVE-2015-0261, bnc#922220) * PPP printer remote DoS (CVE-2014-9140, bnc#923142) * force printer remote DoS (CVE-2015-2155, bnc#922223) * ethernet printer remote DoS (CVE-2015-2154, bnc#922222) * tcp printer remote DoS (CVE-2015-2153, bnc#922221) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-267=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-267=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tcpdump-4.6.2-8.1 tcpdump-debuginfo-4.6.2-8.1 tcpdump-debugsource-4.6.2-8.1 - openSUSE 13.1 (i586 x86_64): tcpdump-4.4.0-2.8.1 tcpdump-debuginfo-4.4.0-2.8.1 tcpdump-debugsource-4.4.0-2.8.1 References: https://www.suse.com/security/cve/CVE-2014-9140.html https://www.suse.com/security/cve/CVE-2015-0261.html https://www.suse.com/security/cve/CVE-2015-2153.html https://www.suse.com/security/cve/CVE-2015-2154.html https://www.suse.com/security/cve/CVE-2015-2155.html https://bugzilla.suse.com/922220 https://bugzilla.suse.com/922221 https://bugzilla.suse.com/922222 https://bugzilla.suse.com/922223 https://bugzilla.suse.com/923142

1 0

openSUSE-SU-2015:0615-1: moderate: Security update for libzip
by opensuse-security＠opensuse.org 27 Mar '15

27 Mar '15

openSUSE Security Update: Security update for libzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0615-1 Rating: moderate References: #923240 Cross-References: CVE-2015-2331 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Libzip was updated to fix one security issue. A zip file with an unusually large number of entries could have caused an integer overflow leading to a write past the heap boundary, crashing the application. (CVE-2015-2331 bnc#923240) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-265=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-265=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libzip-0.11.2-3.4.1 libzip-debuginfo-0.11.2-3.4.1 libzip-debugsource-0.11.2-3.4.1 libzip-devel-0.11.2-3.4.1 libzip2-0.11.2-3.4.1 libzip2-debuginfo-0.11.2-3.4.1 - openSUSE 13.2 (x86_64): libzip2-32bit-0.11.2-3.4.1 libzip2-debuginfo-32bit-0.11.2-3.4.1 - openSUSE 13.1 (i586 x86_64): libzip-0.11.2-3.8.1 libzip-debuginfo-0.11.2-3.8.1 libzip-debugsource-0.11.2-3.8.1 libzip-devel-0.11.2-3.8.1 libzip2-0.11.2-3.8.1 libzip2-debuginfo-0.11.2-3.8.1 References: http://support.novell.com/security/cve/CVE-2015-2331.html https://bugzilla.suse.com/923240

1 0

openSUSE-SU-2015:0614-1: important: Security update for libXfont
by opensuse-security＠opensuse.org 27 Mar '15

27 Mar '15

openSUSE Security Update: Security update for libXfont ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0614-1 Rating: important References: #921978 Cross-References: CVE-2015-1802 CVE-2015-1803 CVE-2015-1804 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: libXFont was updated to fix three vulnerabilities when parsing BDF files (bnc#921978) As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server. The following vulnerabilities were fixed: * The BDF parser could allocate the a wrong buffer size, leading to out of bound writes (CVE-2015-1802) * The BDF parser could crash when trying to read an invalid pointer (CVE-2015-1803) * The BDF parser could read 32 bit metrics values into 16 bit integers, causing an out-of-bound memory access though integer overflow (CVE-2015-1804) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-266=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libXfont-debugsource-1.5.0-2.4.1 libXfont-devel-1.5.0-2.4.1 libXfont1-1.5.0-2.4.1 libXfont1-debuginfo-1.5.0-2.4.1 - openSUSE 13.2 (x86_64): libXfont-devel-32bit-1.5.0-2.4.1 libXfont1-32bit-1.5.0-2.4.1 libXfont1-debuginfo-32bit-1.5.0-2.4.1 - openSUSE 13.1 (i586 x86_64): libXfont-debugsource-1.4.6-2.12.1 libXfont-devel-1.4.6-2.12.1 libXfont1-1.4.6-2.12.1 libXfont1-debuginfo-1.4.6-2.12.1 - openSUSE 13.1 (x86_64): libXfont-devel-32bit-1.4.6-2.12.1 libXfont1-32bit-1.4.6-2.12.1 libXfont1-debuginfo-32bit-1.4.6-2.12.1 References: http://support.novell.com/security/cve/CVE-2015-1802.html http://support.novell.com/security/cve/CVE-2015-1803.html http://support.novell.com/security/cve/CVE-2015-1804.html https://bugzilla.suse.com/921978

1 0

openSUSE-RU-2015:0608-1: important: Softwarestack update for openSUSE 13.2
by maintenance＠opensuse.org 26 Mar '15

26 Mar '15

openSUSE Recommended Update: Softwarestack update for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0608-1 Rating: important References: #915461 #916254 #919709 #921332 #922352 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This recommended update for the Softwarestack of openSUSE 13.2 fixes the following issues: - libsolv: + fix bug in dislike_old_versions that could lead to a segfault (bnc#922352) + rework splitprovides handling (bnc#921332) + improve package choosing code + new testcase dependency format + add alternatives introspection + make reorder_dq_for_jobrules also look at recommends/suggests + rework branch handling + add parser for rpm rich deps - zypper: + patch: A date limit must ignore newer patch candidates (bnc#919709) + Show locked packages in zypper summary (FATE#318326,FATE#318299) + modify repo: Notify about volatile changes to service repos (bnc#916254) + ps: Change column header from 'Login' to 'User' (bnc#915461) + man: add missing patch --date option + man: mention $releasever_major/minor repo variables + man: Update repo variable substitution (default and alternate values) + Updated translations -libzypp: + add support for SHA224/384/512 + New RepoVarExpand: Functor expanding repo variables in a string . Supports bash style default ${v:-w}' and alternate ${v:+w} values (FATE#318354) + Easy.h: Use __typeof__ rather than typeof in header + Support repo variable replacement in service url + Support repo variable replacement in gpg url + Gettext.h: Fallback to ::gettext if accidentally included outside libzypp Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (aarch64 armv7hl ppc ppc64 ppc64le): libsolv-debugsource-0.6.10-10.1 libsolv-demo-0.6.10-10.1 libsolv-demo-debuginfo-0.6.10-10.1 libsolv-devel-0.6.10-10.1 libsolv-devel-debuginfo-0.6.10-10.1 libsolv-tools-0.6.10-10.1 libsolv-tools-debuginfo-0.6.10-10.1 perl-solv-0.6.10-10.1 perl-solv-debuginfo-0.6.10-10.1 python-solv-0.6.10-10.1 python-solv-debuginfo-0.6.10-10.1 ruby-solv-0.6.10-10.1 ruby-solv-debuginfo-0.6.10-10.1 zypper-1.11.23-19.1 zypper-debuginfo-1.11.23-19.1 zypper-debugsource-1.11.23-19.1 - openSUSE 13.2 (armv7hl ppc ppc64 ppc64le): libzypp-14.37.1-22.2 libzypp-debuginfo-14.37.1-22.2 libzypp-debugsource-14.37.1-22.2 libzypp-devel-14.37.1-22.2 libzypp-devel-doc-14.37.1-22.2 - openSUSE 13.2 (aarch64): libzypp-14.37.1-22.1 libzypp-debuginfo-14.37.1-22.1 libzypp-debugsource-14.37.1-22.1 libzypp-devel-14.37.1-22.1 libzypp-devel-doc-14.37.1-22.1 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.23-19.1 zypper-log-1.11.23-19.1 References: https://bugzilla.suse.com/915461 https://bugzilla.suse.com/916254 https://bugzilla.suse.com/919709 https://bugzilla.suse.com/921332 https://bugzilla.suse.com/922352

1 0

openSUSE-SU-2015:0607-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Mar '15

26 Mar '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0607-1 Rating: important References: #923534 Cross-References: CVE-2015-0817 CVE-2015-0818 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: MozillaFirefox was updated to Firefox 36.0.4 to fix two critical security issues found during Pwn2Own: * MFSA 2015-28/CVE-2015-0818 (bmo#1144988) Privilege escalation through SVG navigation * MFSA 2015-29/CVE-2015-0817 (bmo#1145255) Code execution through incorrect JavaScript bounds checking elimination Als fixed were the following bugs: - Copy the icons to /usr/share/icons instead of symlinking them: in preparation for containerized apps (e.g. xdg-app) as well as AppStream metadata extraction, there are a couple locations that need to be real files for system integration (.desktop files, icons, mime-type info). - update to Firefox 36.0.1 Bugfixes: * Disable the usage of the ANY DNS query type (bmo#1093983) * Hello may become inactive until restart (bmo#1137469) * Print preferences may not be preserved (bmo#1136855) * Hello contact tabs may not be visible (bmo#1137141) * Accept hostnames that include an underscore character ("_") (bmo#1136616) * WebGL may use significant memory with Canvas2d (bmo#1137251) * Option -remote has been restored (bmo#1080319) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-263=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-263=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-36.0.4-18.1 MozillaFirefox-branding-upstream-36.0.4-18.1 MozillaFirefox-buildsymbols-36.0.4-18.1 MozillaFirefox-debuginfo-36.0.4-18.1 MozillaFirefox-debugsource-36.0.4-18.1 MozillaFirefox-devel-36.0.4-18.1 MozillaFirefox-translations-common-36.0.4-18.1 MozillaFirefox-translations-other-36.0.4-18.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-36.0.4-63.1 MozillaFirefox-branding-upstream-36.0.4-63.1 MozillaFirefox-buildsymbols-36.0.4-63.1 MozillaFirefox-debuginfo-36.0.4-63.1 MozillaFirefox-debugsource-36.0.4-63.1 MozillaFirefox-devel-36.0.4-63.1 MozillaFirefox-translations-common-36.0.4-63.1 MozillaFirefox-translations-other-36.0.4-63.1 References: http://support.novell.com/security/cve/CVE-2015-0817.html http://support.novell.com/security/cve/CVE-2015-0818.html https://bugzilla.suse.com/923534

1 0

openSUSE-SU-2015:0600-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 25 Mar '15

25 Mar '15

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0600-1 Rating: moderate References: #923284 Cross-References: CVE-2015-2688 CVE-2015-2689 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Tor was updated to 0.2.4.26 to fix several security issues: The release: Contains several medium-level security fixes for relays and exit nodes and also updates the list of directory authorities. * Directory authority updates * relay crashes trough assertion (CVE-2015-2688) * exit node crash through assertion under high DNS load (CVE-2015-2689) * update geoip/geoip6 to the March 3 2015 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-261=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-261=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tor-0.2.4.26-9.1 tor-debuginfo-0.2.4.26-9.1 tor-debugsource-0.2.4.26-9.1 - openSUSE 13.1 (i586 x86_64): tor-0.2.4.26-5.26.1 tor-debuginfo-0.2.4.26-5.26.1 tor-debugsource-0.2.4.26-5.26.1 References: http://support.novell.com/security/cve/CVE-2015-2688.html http://support.novell.com/security/cve/CVE-2015-2689.html https://bugzilla.suse.com/923284

1 0

openSUSE-RU-2015:0599-1: moderate: Recommended update for empathy
by maintenance＠opensuse.org 25 Mar '15

25 Mar '15

openSUSE Recommended Update: Recommended update for empathy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0599-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update provides version 3.12.8 of empathy and fixes the following issues: - User help suggests "ignore SSL certificate errors" option for Jabber accounts "if you trust the server you are connecting to". (bgo#705326) - goa-mc-plugin: Remove Facebook chat using Jabber, after Facebook dropped support for XMPP in version 2.0 of the Graph API. (bgo#746100) - Updated translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-262=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): empathy-3.12.8-4.1 empathy-debuginfo-3.12.8-4.1 empathy-debugsource-3.12.8-4.1 telepathy-mission-control-plugin-goa-3.12.8-4.1 telepathy-mission-control-plugin-goa-debuginfo-3.12.8-4.1 - openSUSE 13.2 (noarch): empathy-lang-3.12.8-4.1 References:

1 0