March 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0486-1: important: Security update for osc
by opensuse-security＠opensuse.org 12 Mar '15

12 Mar '15

openSUSE Security Update: Security update for osc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0486-1 Rating: important References: #901643 Cross-References: CVE-2015-0778 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: osc was updated to fix a security issue and some non-security bugs. osc was updated to 0.151.0, fixing the following vulnerability: * fixed shell command injection via crafted _service files CVE-2015-0778 boo#901643 The following non-security bugs were fixed: * fix times when data comes from OBS backend * support updateing the link in target package for submit requests * various minor bugfixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-224=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-224=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): osc-0.151.0-8.1 - openSUSE 13.1 (noarch): osc-0.151.0-2.24.1 References: http://support.novell.com/security/cve/CVE-2015-0778.html https://bugzilla.suse.com/901643

1 0

openSUSE-RU-2015:0483-1: moderate: Recommended udpate for radvd
by maintenance＠opensuse.org 12 Mar '15

12 Mar '15

openSUSE Recommended Update: Recommended udpate for radvd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0483-1 Rating: moderate References: #920156 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for radvd fixes the following issue: - Fix calculation of the RDNSS option size (bsc#920156) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-222=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): radvd-2.2-2.4.1 radvd-debuginfo-2.2-2.4.1 radvd-debugsource-2.2-2.4.1 References: https://bugzilla.suse.com/920156

1 0

openSUSE-RU-2015:0482-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 12 Mar '15

12 Mar '15

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0482-1 Rating: moderate References: #918628 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xorg-x11-server fixes the following issue: - Export GetMaster to allow VNC to work as a module. (bnc#918628) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-223=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xorg-x11-server-7.6_1.16.1-13.1 xorg-x11-server-debuginfo-7.6_1.16.1-13.1 xorg-x11-server-debugsource-7.6_1.16.1-13.1 xorg-x11-server-extra-7.6_1.16.1-13.1 xorg-x11-server-extra-debuginfo-7.6_1.16.1-13.1 xorg-x11-server-sdk-7.6_1.16.1-13.1 References: https://bugzilla.suse.com/918628

1 0

openSUSE-SU-2015:0479-1: moderate: Security update for cacti
by opensuse-security＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Security Update: Security update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0479-1 Rating: moderate References: #920399 Cross-References: CVE-2014-2327 CVE-2014-4002 CVE-2014-5025 CVE-2014-5026 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: cacti was updated to version 0.8.8c [boo#920399] This update fixes four vulnerabilities and adds some compatible features. - Security fixes not previously patched: - CVE-2014-2326 - XSS issue via CDEF editing - CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability - CVE-2014-2328 - Remote Command Execution Vulnerability in graph export - CVE-2014-4002 - XSS issues in multiple files - CVE-2014-5025 - XSS issue via data source editing - CVE-2014-5026 - XSS issues in multiple files - Security fixes now upstream: - CVE-2013-5588 - XSS issue via installer or device editing - CVE-2013-5589 - SQL injection vulnerability in device editing New features: - New graph tree view - Updated graph list and graph preview - Refactor graph tree view to remove GPL incompatible code - Updated command line database upgrade utility - Graph zooming now from everywhere Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-221=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-221=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): cacti-0.8.8c-4.4.1 - openSUSE 13.1 (noarch): cacti-0.8.8c-8.1 References: http://support.novell.com/security/cve/CVE-2014-2327.html http://support.novell.com/security/cve/CVE-2014-4002.html http://support.novell.com/security/cve/CVE-2014-5025.html http://support.novell.com/security/cve/CVE-2014-5026.html https://bugzilla.suse.com/920399

1 0

openSUSE-SU-2015:0475-1: moderate: Security update for autofs
by opensuse-security＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Security Update: Security update for autofs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0475-1 Rating: moderate References: #917977 Cross-References: CVE-2014-8169 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The automount service autofs was updated to prevent a potential privilege escalation via interpreter load path for program-based automount maps. (bsc#917977 CVE-2014-8169) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-220=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-220=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): autofs-5.1.0-2.8.1 autofs-debuginfo-5.1.0-2.8.1 autofs-debugsource-5.1.0-2.8.1 - openSUSE 13.1 (i586 x86_64): autofs-5.0.9-19.16.1 autofs-debuginfo-5.0.9-19.16.1 autofs-debugsource-5.0.9-19.16.1 References: http://support.novell.com/security/cve/CVE-2014-8169.html https://bugzilla.suse.com/917977

1 0

openSUSE-SU-2015:0474-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0474-1 Rating: moderate References: #920167 Cross-References: CVE-2015-2157 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The SSH Terminal emulator putty was updated to the new upstream release 0.64, fixing security issues and bugs: Security fix: PuTTY no longer retains the private half of users' keys in memory by mistake after authenticating with them. [bsc#920167] (CVE-2015-2157) New feature: Support for SSH connection sharing, so that multiple instances of PuTTY to the same host can share a single SSH connection instead of all having to log in independently. Bug fix: IPv6 literals are handled sensibly throughout the suite, if you enclose them in square brackets to prevent the colons being mistaken for a :port suffix. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-218=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-218=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): putty-0.64-4.4.1 putty-debuginfo-0.64-4.4.1 putty-debugsource-0.64-4.4.1 - openSUSE 13.1 (i586 x86_64): putty-0.64-2.4.1 putty-debuginfo-0.64-2.4.1 putty-debugsource-0.64-2.4.1 References: http://support.novell.com/security/cve/CVE-2015-2157.html https://bugzilla.suse.com/920167

1 0

openSUSE-SU-2015:0473-1: moderate: Security update for glusterfs
by opensuse-security＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Security Update: Security update for glusterfs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0473-1 Rating: moderate References: #919879 Cross-References: CVE-2014-3619 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: glusterfs was updated to fix a fragment header infinite loop denial of service attack (CVE-2014-3619). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-219=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): glusterfs-3.4.0~qa9-2.4.1 glusterfs-debuginfo-3.4.0~qa9-2.4.1 glusterfs-debugsource-3.4.0~qa9-2.4.1 glusterfs-devel-3.4.0~qa9-2.4.1 libgfapi0-3.4.0~qa9-2.4.1 libgfapi0-debuginfo-3.4.0~qa9-2.4.1 libgfrpc0-3.4.0~qa9-2.4.1 libgfrpc0-debuginfo-3.4.0~qa9-2.4.1 libgfxdr0-3.4.0~qa9-2.4.1 libgfxdr0-debuginfo-3.4.0~qa9-2.4.1 libglusterfs0-3.4.0~qa9-2.4.1 libglusterfs0-debuginfo-3.4.0~qa9-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-3619.html https://bugzilla.suse.com/919879

1 0

openSUSE-SU-2015:0472-1: Security update for percona-toolkit, xtrabackup
by opensuse-security＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Security Update: Security update for percona-toolkit, xtrabackup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0472-1 Rating: low References: #919298 Cross-References: CVE-2015-1027 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Percona Toolkit and XtraBackup were updated to fix bugs and security issues. Percona XtraBackup was vulnerable to MITM attack which could allow exfiltration of MySQL configuration information via the --version-check option. [boo#919298] CVE-2015-1027 lp#1408375. The openSUSE package has the version check disabled by default. Percona Toolkit was updated to 2.2.13: * Feature lp#1391240: pt-kill added query fingerprint hash to output * Fixed lp#1402668: pt-mysql-summary fails on cluster in Donor/Desynced status * Fixed lp#1396870: pt-online-schema-change CTRL+C leaves terminal in inconsistent state * Fixed lp#1396868: pt-online-schema-change --ask-pass option error * Fixed lp#1266869: pt-stalk fails to start if $HOME environment variable is not set * Fixed lp#1019479: pt-table-checksum does not work with sql_mode ONLY_FULL_GROUP_BY * Fixed lp#1394934: pt-table-checksum error in debug mode * Fixed lp#1321297: pt-table-checksum reports diffs on timestamp columns in 5.5 vs 5.6 * Fixed lp#1399789: pt-table-checksum fails to find pxc nodes when wsrep_node_incoming_address is set to AUTO * Fixed lp#1388870: pt-table-checksum has some errors with different time zones * Fixed lp#1408375: vulnerable to MITM attack which would allow exfiltration of MySQL configuration information via --version-check [boo#919298] [CVE-2015-1027] * Fixed lp#1404298: missing MySQL5.7 test files for pt-table-checksum * Fixed lp#1403900: added sandbox and fixed sakila test db for 5.7 Percona XtraBackup was updated to version 2.2.9: * xtrabackup_galera_info file isn't overwritten during the Galera auto-recovery. lp#1418584. * Percona XtraBackup now sets the maximum supported session value for lock_wait_timeout variable to prevent unnecessary timeouts when the global value is changed from the default. lp#1410339. * New option --backup-locks, enabled by default, has been implemented to control if backup locks will be used even if they are supported by the server. To disable backup locks innobackupex should be run with innobackupex --no-backup-locks option. lp#1418820. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-217=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-217=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xtrabackup-2.2.9-4.1 xtrabackup-debuginfo-2.2.9-4.1 xtrabackup-debugsource-2.2.9-4.1 xtrabackup-test-2.2.9-4.1 - openSUSE 13.2 (noarch): percona-toolkit-2.2.13-4.1 - openSUSE 13.1 (i586 x86_64): xtrabackup-2.1.8-25.1 xtrabackup-debuginfo-2.1.8-25.1 xtrabackup-debugsource-2.1.8-25.1 - openSUSE 13.1 (noarch): percona-toolkit-2.2.13-2.14.1 References: http://support.novell.com/security/cve/CVE-2015-1027.html https://bugzilla.suse.com/919298

1 0

openSUSE-RU-2015:0471-1: moderate: Introduce hylafax+
by maintenance＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Recommended Update: Introduce hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0471-1 Rating: moderate References: #856906 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update introduces hylafax+ version 5.5.5 which replaces hylafax. Amongst other things, it fixes boo#856906, missing systemd configuration files for faxgetty in Hylafax. For a detailed description, please refer to the changelog. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-213=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): hylafax+-5.5.5-2.1 hylafax+-client-5.5.5-2.1 hylafax+-client-debuginfo-5.5.5-2.1 hylafax+-debuginfo-5.5.5-2.1 hylafax+-debugsource-5.5.5-2.1 References: https://bugzilla.suse.com/856906

1 0

openSUSE-RU-2015:0470-1: moderate: Recommended update for drbd
by maintenance＠opensuse.org 11 Mar '15

11 Mar '15

openSUSE Recommended Update: Recommended update for drbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0470-1 Rating: moderate References: #911871 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 8.4.3 of drbd with various fixes and improvements. For a detailed description of all changes, please refer to the changelog. (boo#911871) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): drbd-8.4.3-10.4.1 drbd-debuginfo-8.4.3-10.4.1 drbd-debugsource-8.4.3-10.4.1 References: https://bugzilla.suse.com/911871

1 0