April 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0677-1: important: Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr
by opensuse-security＠opensuse.org 08 Apr '15

08 Apr '15

openSUSE Security Update: Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0677-1 Rating: important References: #925368 #925392 #925393 #925394 #925395 #925396 #925397 #925398 #925399 #925400 #925401 #925402 #926166 Cross-References: CVE-2015-0799 CVE-2015-0801 CVE-2015-0802 CVE-2015-0803 CVE-2015-0804 CVE-2015-0805 CVE-2015-0806 CVE-2015-0807 CVE-2015-0808 CVE-2015-0811 CVE-2015-0812 CVE-2015-0813 CVE-2015-0814 CVE-2015-0815 CVE-2015-0816 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: Mozilla Firefox and Thunderbird were updated to fix several important vulnerabilities. Mozilla Firefox was updated to 37.0.1. Mozilla Thunderbird was updated to 31.6.0. mozilla-nspr was updated to 4.10.8 as a dependency. The following vulnerabilities were fixed in Mozilla Firefox: * Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392) * Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813 bmo#1106596 boo#925393) * Add-on lightweight theme installation approval bypassed through MITM attack (MFSA 2015-32/CVE-2015-0812 bmo#1128126 boo#925394) * resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816 bmo#1144991 boo#925395) * Out of bounds read in QCMS library (MFSA-2015-34/CVE-2015-0811 bmo#1132468 boo#925396) * Incorrect memory management for simple-type arrays in WebRTC (MFSA-2015-36/CVE-2015-0808 bmo#1109552 boo#925397) * CORS requests should not follow 30x redirections after preflight (MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398) * Memory corruption crashes in Off Main Thread Compositing (MFSA-2015-38/CVE-2015-0805/CVE-2015-0806 bmo#1135511 bmo#1099437 boo#925399) * Use-after-free due to type confusion flaws (MFSA-2015-39/CVE-2015-0803/CVE-2015-0804 (mo#1134560 boo#925400) * Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801 bmo#1146339 boo#925401) * Windows can retain access to privileged content on navigation to unprivileged pages (MFSA-2015-42/CVE-2015-0802 bmo#1124898 boo#925402) The following vulnerability was fixed in functionality that was not released as an update to openSUSE: * Certificate verification could be bypassed through the HTTP/2 Alt-Svc header (MFSA 2015-44/CVE-2015-0799 bmo#1148328 bnc#926166) The functionality added in 37.0 and thus removed in 37.0.1 was: * Opportunistically encrypt HTTP traffic where the server supports HTTP/2 AltSvc The following functionality was added or updated in Mozilla Firefox: * Heartbeat user rating system * Yandex set as default search provider for the Turkish locale * Bing search now uses HTTPS for secure searching * Improved protection against site impersonation via OneCRL centralized certificate revocation * some more behaviour changes for TLS The following vulnerabilities were fixed in Mozilla Thunderbird: * Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392) * Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813 bmo#1106596 boo#925393) * resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816 bmo#1144991 boo#925395) * CORS requests should not follow 30x redirections after preflight (MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398) * Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801 bmo#1146339 boo#925401) mozilla-nspr was updated to 4.10.8 as a dependency and received the following changes: * bmo#573192: remove the stack-based PRFileDesc cache. * bmo#756047: check for _POSIX_THREAD_PRIORITY_SCHEDULING > 0 instead of only checking if the identifier is defined. * bmo#1089908: Fix variable shadowing in _PR_MD_LOCKFILE. Use PR_ARRAY_SIZE to get the array size of _PR_RUNQ(t->cpu). * bmo#1106600: Replace PR_ASSERT(!"foo") with PR_NOT_REACHED("foo") to fix clang -Wstring-conversion warnings. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-290=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-290=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-37.0.1-23.1 MozillaFirefox-branding-upstream-37.0.1-23.1 MozillaFirefox-buildsymbols-37.0.1-23.1 MozillaFirefox-debuginfo-37.0.1-23.1 MozillaFirefox-debugsource-37.0.1-23.1 MozillaFirefox-devel-37.0.1-23.1 MozillaFirefox-translations-common-37.0.1-23.1 MozillaFirefox-translations-other-37.0.1-23.1 MozillaThunderbird-31.6.0-15.3 MozillaThunderbird-buildsymbols-31.6.0-15.3 MozillaThunderbird-debuginfo-31.6.0-15.3 MozillaThunderbird-debugsource-31.6.0-15.3 MozillaThunderbird-devel-31.6.0-15.3 MozillaThunderbird-translations-common-31.6.0-15.3 MozillaThunderbird-translations-other-31.6.0-15.3 mozilla-nspr-4.10.8-6.1 mozilla-nspr-debuginfo-4.10.8-6.1 mozilla-nspr-debugsource-4.10.8-6.1 mozilla-nspr-devel-4.10.8-6.1 - openSUSE 13.2 (x86_64): mozilla-nspr-32bit-4.10.8-6.1 mozilla-nspr-debuginfo-32bit-4.10.8-6.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-37.0.1-68.1 MozillaFirefox-branding-upstream-37.0.1-68.1 MozillaFirefox-buildsymbols-37.0.1-68.1 MozillaFirefox-debuginfo-37.0.1-68.1 MozillaFirefox-debugsource-37.0.1-68.1 MozillaFirefox-devel-37.0.1-68.1 MozillaFirefox-translations-common-37.0.1-68.1 MozillaFirefox-translations-other-37.0.1-68.1 MozillaThunderbird-31.6.0-70.50.2 MozillaThunderbird-buildsymbols-31.6.0-70.50.2 MozillaThunderbird-debuginfo-31.6.0-70.50.2 MozillaThunderbird-debugsource-31.6.0-70.50.2 MozillaThunderbird-devel-31.6.0-70.50.2 MozillaThunderbird-translations-common-31.6.0-70.50.2 MozillaThunderbird-translations-other-31.6.0-70.50.2 mozilla-nspr-4.10.8-22.1 mozilla-nspr-debuginfo-4.10.8-22.1 mozilla-nspr-debugsource-4.10.8-22.1 mozilla-nspr-devel-4.10.8-22.1 - openSUSE 13.1 (x86_64): mozilla-nspr-32bit-4.10.8-22.1 mozilla-nspr-debuginfo-32bit-4.10.8-22.1 References: https://www.suse.com/security/cve/CVE-2015-0799.html https://www.suse.com/security/cve/CVE-2015-0801.html https://www.suse.com/security/cve/CVE-2015-0802.html https://www.suse.com/security/cve/CVE-2015-0803.html https://www.suse.com/security/cve/CVE-2015-0804.html https://www.suse.com/security/cve/CVE-2015-0805.html https://www.suse.com/security/cve/CVE-2015-0806.html https://www.suse.com/security/cve/CVE-2015-0807.html https://www.suse.com/security/cve/CVE-2015-0808.html https://www.suse.com/security/cve/CVE-2015-0811.html https://www.suse.com/security/cve/CVE-2015-0812.html https://www.suse.com/security/cve/CVE-2015-0813.html https://www.suse.com/security/cve/CVE-2015-0814.html https://www.suse.com/security/cve/CVE-2015-0815.html https://www.suse.com/security/cve/CVE-2015-0816.html https://bugzilla.suse.com/925368 https://bugzilla.suse.com/925392 https://bugzilla.suse.com/925393 https://bugzilla.suse.com/925394 https://bugzilla.suse.com/925395 https://bugzilla.suse.com/925396 https://bugzilla.suse.com/925397 https://bugzilla.suse.com/925398 https://bugzilla.suse.com/925399 https://bugzilla.suse.com/925400 https://bugzilla.suse.com/925401 https://bugzilla.suse.com/925402 https://bugzilla.suse.com/926166

1 0

openSUSE-SU-2015:0673-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 07 Apr '15

07 Apr '15

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0673-1 Rating: moderate References: #925040 Cross-References: CVE-2014-9390 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libgit2 was updated to fix an arbitrary command execution vulnerability on case-insentitive file systems. The following vulnerability was fixed: * When using programs using libgit2 on case-insensitive filesystems, .git/config could be overwritten, which allowed execution of arbitrary commands (boo#925040, CVE-2014-9390). The configuration is uncommon as all default file systems on openSUSE are case sensitive. Additionally, on openSUSE 13.2 libgit2 was updated to version 0.21.5 to backport further critical fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-288=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-288=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgit2-21-0.21.5-2.3.1 libgit2-21-debuginfo-0.21.5-2.3.1 libgit2-debugsource-0.21.5-2.3.1 libgit2-devel-0.21.5-2.3.1 - openSUSE 13.1 (i586 x86_64): libgit2-0-0.19.0-2.3.1 libgit2-0-debuginfo-0.19.0-2.3.1 libgit2-debugsource-0.19.0-2.3.1 libgit2-devel-0.19.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-9390.html https://bugzilla.suse.com/925040

1 0

openSUSE-SU-2015:0672-1: moderate: Security update for subversion
by opensuse-security＠opensuse.org 07 Apr '15

07 Apr '15

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0672-1 Rating: moderate References: #916286 #923793 #923794 #923795 Cross-References: CVE-2015-0202 CVE-2015-0248 CVE-2015-0251 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Apache Subversion was updated to 1.8.13 to fix three vulnerabilities and a number of non-security bugs. This release fixes three vulnerabilities: * Subversion HTTP servers with FSFS repositories were vulnerable to a remotely triggerable excessive memory use with certain REPORT requests. (bsc#923793 CVE-2015-0202) * Subversion mod_dav_svn and svnserve were vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers. (bsc#923794 CVE-2015-0248) * Subversion HTTP servers allow spoofing svn:author property values for new revisions (bsc#923795 CVE-2015-0251) Non-security fixes: * fixes number of client and server side non-security bugs * improved working copy performance * reduction of resource use * stability improvements * usability improvements * fix sample configuration comments in subversion.conf [boo#916286] * fix bashisms in mailer-init.sh script Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-289=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-289=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.13-2.14.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.13-2.14.1 libsvn_auth_kwallet-1-0-1.8.13-2.14.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.13-2.14.1 subversion-1.8.13-2.14.1 subversion-debuginfo-1.8.13-2.14.1 subversion-debugsource-1.8.13-2.14.1 subversion-devel-1.8.13-2.14.1 subversion-perl-1.8.13-2.14.1 subversion-perl-debuginfo-1.8.13-2.14.1 subversion-python-1.8.13-2.14.1 subversion-python-ctypes-1.8.13-2.14.1 subversion-python-debuginfo-1.8.13-2.14.1 subversion-ruby-1.8.13-2.14.1 subversion-ruby-debuginfo-1.8.13-2.14.1 subversion-server-1.8.13-2.14.1 subversion-server-debuginfo-1.8.13-2.14.1 subversion-tools-1.8.13-2.14.1 subversion-tools-debuginfo-1.8.13-2.14.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.13-2.14.1 - openSUSE 13.1 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.13-2.36.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.13-2.36.1 libsvn_auth_kwallet-1-0-1.8.13-2.36.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.13-2.36.1 subversion-1.8.13-2.36.1 subversion-debuginfo-1.8.13-2.36.1 subversion-debugsource-1.8.13-2.36.1 subversion-devel-1.8.13-2.36.1 subversion-perl-1.8.13-2.36.1 subversion-perl-debuginfo-1.8.13-2.36.1 subversion-python-1.8.13-2.36.1 subversion-python-debuginfo-1.8.13-2.36.1 subversion-ruby-1.8.13-2.36.1 subversion-ruby-debuginfo-1.8.13-2.36.1 subversion-server-1.8.13-2.36.1 subversion-server-debuginfo-1.8.13-2.36.1 subversion-tools-1.8.13-2.36.1 subversion-tools-debuginfo-1.8.13-2.36.1 - openSUSE 13.1 (noarch): subversion-bash-completion-1.8.13-2.36.1 References: https://www.suse.com/security/cve/CVE-2015-0202.html https://www.suse.com/security/cve/CVE-2015-0248.html https://www.suse.com/security/cve/CVE-2015-0251.html https://bugzilla.suse.com/916286 https://bugzilla.suse.com/923793 https://bugzilla.suse.com/923794 https://bugzilla.suse.com/923795

1 0

openSUSE-RU-2015:0664-1: moderate: Recommended update for apper
by maintenance＠opensuse.org 07 Apr '15

07 Apr '15

openSUSE Recommended Update: Recommended update for apper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0664-1 Rating: moderate References: #901067 #908194 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: The KDE update applet Apper was updated to fix: * Prevent erroneous "Your current backend does not support..." errors and fixes the installation of local rpm packages (boo#901067) * Fixed the plasmoid's status display (boo#908194) * The string "The following package(s) is/were found" was incorrectly translated with "The following package(s) is/were _not_ found" in the german translation (bko#344935) * Fixed layout of the "Review Changes" dialog * Fixed a typo that causes the plasmoid's layout to break with big fonts Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-287=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apper-0.9.1-4.1 apper-debuginfo-0.9.1-4.1 apper-debugsource-0.9.1-4.1 - openSUSE 13.2 (noarch): apper-lang-0.9.1-4.1 References: https://bugzilla.suse.com/901067 https://bugzilla.suse.com/908194

1 0

openSUSE-RU-2015:0663-1: moderate: Recommended update for krusader
by maintenance＠opensuse.org 07 Apr '15

07 Apr '15

openSUSE Recommended Update: Recommended update for krusader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0663-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for krusader fixes the following issue: - Require libktexteditor instead of kate to solve conflicts when using KF5. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-286=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): kio_iso-2.4.0~beta3-6.3.1 kio_iso-debuginfo-2.4.0~beta3-6.3.1 krusader-2.4.0~beta3-6.3.1 krusader-debuginfo-2.4.0~beta3-6.3.1 krusader-debugsource-2.4.0~beta3-6.3.1 krusader-doc-2.4.0~beta3-6.3.1 References:

1 0

openSUSE-RU-2015:0647-1: moderate: Recommended udpate for gst-fluendo-mp3
by maintenance＠opensuse.org 01 Apr '15

01 Apr '15

openSUSE Recommended Update: Recommended udpate for gst-fluendo-mp3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0647-1 Rating: moderate References: #923607 Affected Products: openSUSE 13.2:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for gst-fluendo-mp3 provides version 21 with various fixes and improvements, including a segfault on a specific file (boo#923607). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-285=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): gstreamer-0_10-fluendo-mp3-21-5.3.1 gstreamer-fluendo-mp3-21-5.3.1 References: https://bugzilla.suse.com/923607

1 0

openSUSE-RU-2015:0646-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 01 Apr '15

01 Apr '15

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0646-1 Rating: moderate References: #919095 #921920 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for systemd fixes the following issues: - Fix systemd --test option (bsc#921920) - Correct systemd-sleep-grub return code (bsc#919095) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-284=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgudev-1_0-0-210-25.16.1 libgudev-1_0-0-debuginfo-210-25.16.1 libgudev-1_0-devel-210-25.16.1 libudev-devel-210-25.16.1 libudev-mini-devel-210-25.16.1 libudev-mini1-210-25.16.1 libudev-mini1-debuginfo-210-25.16.1 libudev1-210-25.16.1 libudev1-debuginfo-210-25.16.1 nss-myhostname-210-25.16.1 nss-myhostname-debuginfo-210-25.16.1 systemd-210-25.16.1 systemd-debuginfo-210-25.16.1 systemd-debugsource-210-25.16.1 systemd-devel-210-25.16.1 systemd-journal-gateway-210-25.16.1 systemd-journal-gateway-debuginfo-210-25.16.1 systemd-logger-210-25.16.1 systemd-mini-210-25.16.1 systemd-mini-debuginfo-210-25.16.1 systemd-mini-debugsource-210-25.16.1 systemd-mini-devel-210-25.16.1 systemd-mini-sysvinit-210-25.16.1 systemd-sysvinit-210-25.16.1 typelib-1_0-GUdev-1_0-210-25.16.1 udev-210-25.16.1 udev-debuginfo-210-25.16.1 udev-mini-210-25.16.1 udev-mini-debuginfo-210-25.16.1 - openSUSE 13.2 (x86_64): libgudev-1_0-0-32bit-210-25.16.1 libgudev-1_0-0-debuginfo-32bit-210-25.16.1 libudev1-32bit-210-25.16.1 libudev1-debuginfo-32bit-210-25.16.1 nss-myhostname-32bit-210-25.16.1 nss-myhostname-debuginfo-32bit-210-25.16.1 systemd-32bit-210-25.16.1 systemd-debuginfo-32bit-210-25.16.1 - openSUSE 13.2 (noarch): systemd-bash-completion-210-25.16.1 References: https://bugzilla.suse.com/919095 https://bugzilla.suse.com/921920

1 0

openSUSE-RU-2015:0645-1: moderate: Recommended update for calligra and calligra-l10n
by maintenance＠opensuse.org 01 Apr '15

01 Apr '15

openSUSE Recommended Update: Recommended update for calligra and calligra-l10n ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0645-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for calligra and calligra-l10n provides the latest bugfix-release 2.9.1 with various fixes and enhancements. For a detailed description, please refer to https://www.calligra.org/news/announcements/stable/calligra-2-9-1-released/ Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): calligra-2.9.1-3.8.8 calligra-active-2.9.1-3.8.8 calligra-active-debuginfo-2.9.1-3.8.8 calligra-author-2.9.1-3.8.8 calligra-author-debuginfo-2.9.1-3.8.8 calligra-braindump-2.9.1-3.8.8 calligra-braindump-debuginfo-2.9.1-3.8.8 calligra-debuginfo-2.9.1-3.8.8 calligra-debugsource-2.9.1-3.8.8 calligra-devel-2.9.1-3.8.8 calligra-extras-converter-2.9.1-3.8.8 calligra-extras-converter-debuginfo-2.9.1-3.8.8 calligra-extras-dolphin-2.9.1-3.8.8 calligra-extras-dolphin-debuginfo-2.9.1-3.8.8 calligra-extras-okular-2.9.1-3.8.8 calligra-extras-okular-debuginfo-2.9.1-3.8.8 calligra-flow-2.9.1-3.8.8 calligra-flow-debuginfo-2.9.1-3.8.8 calligra-gemini-2.9.1-3.8.8 calligra-gemini-debuginfo-2.9.1-3.8.8 calligra-karbon-2.9.1-3.8.8 calligra-karbon-debuginfo-2.9.1-3.8.8 calligra-kexi-2.9.1-3.8.8 calligra-kexi-debuginfo-2.9.1-3.8.8 calligra-kexi-mssql-driver-2.9.1-3.8.8 calligra-kexi-mssql-driver-debuginfo-2.9.1-3.8.8 calligra-kexi-mysql-driver-2.9.1-3.8.8 calligra-kexi-mysql-driver-debuginfo-2.9.1-3.8.8 calligra-kexi-postgresql-driver-2.9.1-3.8.8 calligra-kexi-postgresql-driver-debuginfo-2.9.1-3.8.8 calligra-kexi-spreadsheet-import-2.9.1-3.8.8 calligra-kexi-spreadsheet-import-debuginfo-2.9.1-3.8.8 calligra-kexi-sqlite3-driver-2.9.1-3.8.8 calligra-kexi-sqlite3-driver-debuginfo-2.9.1-3.8.8 calligra-kexi-xbase-driver-2.9.1-3.8.8 calligra-kexi-xbase-driver-debuginfo-2.9.1-3.8.8 calligra-krita-2.9.1-3.8.8 calligra-krita-debuginfo-2.9.1-3.8.8 calligra-plan-2.9.1-3.8.8 calligra-plan-debuginfo-2.9.1-3.8.8 calligra-sheets-2.9.1-3.8.8 calligra-sheets-debuginfo-2.9.1-3.8.8 calligra-stage-2.9.1-3.8.8 calligra-stage-debuginfo-2.9.1-3.8.8 calligra-tools-2.9.1-3.8.8 calligra-tools-debuginfo-2.9.1-3.8.8 calligra-words-2.9.1-3.8.8 calligra-words-common-2.9.1-3.8.8 calligra-words-common-debuginfo-2.9.1-3.8.8 calligra-words-debuginfo-2.9.1-3.8.8 - openSUSE 13.2 (noarch): calligra-doc-2.9.1-3.8.8 calligra-l10n-bs-2.9.1-2.8.8 calligra-l10n-ca-2.9.1-2.8.8 calligra-l10n-ca-doc-2.9.1-2.8.8 calligra-l10n-caValencia-2.9.1-2.8.8 calligra-l10n-cs-2.9.1-2.8.8 calligra-l10n-da-2.9.1-2.8.8 calligra-l10n-de-2.9.1-2.8.8 calligra-l10n-de-doc-2.9.1-2.8.8 calligra-l10n-el-2.9.1-2.8.8 calligra-l10n-en_GB-2.9.1-2.8.8 calligra-l10n-es-2.9.1-2.8.8 calligra-l10n-es-doc-2.9.1-2.8.8 calligra-l10n-et-2.9.1-2.8.8 calligra-l10n-et-doc-2.9.1-2.8.8 calligra-l10n-fi-2.9.1-2.8.8 calligra-l10n-fr-2.9.1-2.8.8 calligra-l10n-fr-doc-2.9.1-2.8.8 calligra-l10n-gl-2.9.1-2.8.8 calligra-l10n-hu-2.9.1-2.8.8 calligra-l10n-it-2.9.1-2.8.8 calligra-l10n-it-doc-2.9.1-2.8.8 calligra-l10n-ja-2.9.1-2.8.8 calligra-l10n-kk-2.9.1-2.8.8 calligra-l10n-nb-2.9.1-2.8.8 calligra-l10n-nl-2.9.1-2.8.8 calligra-l10n-nl-doc-2.9.1-2.8.8 calligra-l10n-pl-2.9.1-2.8.8 calligra-l10n-pt-2.9.1-2.8.8 calligra-l10n-pt-doc-2.9.1-2.8.8 calligra-l10n-pt_BR-2.9.1-2.8.8 calligra-l10n-pt_BR-doc-2.9.1-2.8.8 calligra-l10n-ru-2.9.1-2.8.8 calligra-l10n-ru-doc-2.9.1-2.8.8 calligra-l10n-sk-2.9.1-2.8.8 calligra-l10n-sv-2.9.1-2.8.8 calligra-l10n-sv-doc-2.9.1-2.8.8 calligra-l10n-tr-2.9.1-2.8.8 calligra-l10n-uk-2.9.1-2.8.8 calligra-l10n-uk-doc-2.9.1-2.8.8 calligra-l10n-zh_CN-2.9.1-2.8.8 calligra-l10n-zh_TW-2.9.1-2.8.8 References:

1 0

openSUSE-SU-2015:0644-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 01 Apr '15

01 Apr '15

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0644-1 Rating: moderate References: #922022 #922451 #922452 #922894 #923946 Cross-References: CVE-2014-9705 CVE-2014-9709 CVE-2015-2301 CVE-2015-2305 CVE-2015-2331 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: PHP was updated to fix several security issues. The following vulnerabilities were fixed: * A specially crafted GIF file could cause a buffer read overflow in php-gd (CVE-2014-9709 bnc#923946) * Memory was use after it was freed in PHAR (CVE-2015-2301 bnc#922022) * heap overflow vulnerability in regcomp.c (CVE-2015-2305 bnc#922452) * heap buffer overflow in Enchant (CVE-2014-9705 bnc#922451) For openSUSE 13.2, the following additional vulnerability was fixed: * A specially crafted zip file could lead to writing past the heap boundary (CVE-2015-2331 bnc#922894) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-282=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-15.1 apache2-mod_php5-debuginfo-5.6.1-15.1 php5-5.6.1-15.1 php5-bcmath-5.6.1-15.1 php5-bcmath-debuginfo-5.6.1-15.1 php5-bz2-5.6.1-15.1 php5-bz2-debuginfo-5.6.1-15.1 php5-calendar-5.6.1-15.1 php5-calendar-debuginfo-5.6.1-15.1 php5-ctype-5.6.1-15.1 php5-ctype-debuginfo-5.6.1-15.1 php5-curl-5.6.1-15.1 php5-curl-debuginfo-5.6.1-15.1 php5-dba-5.6.1-15.1 php5-dba-debuginfo-5.6.1-15.1 php5-debuginfo-5.6.1-15.1 php5-debugsource-5.6.1-15.1 php5-devel-5.6.1-15.1 php5-dom-5.6.1-15.1 php5-dom-debuginfo-5.6.1-15.1 php5-enchant-5.6.1-15.1 php5-enchant-debuginfo-5.6.1-15.1 php5-exif-5.6.1-15.1 php5-exif-debuginfo-5.6.1-15.1 php5-fastcgi-5.6.1-15.1 php5-fastcgi-debuginfo-5.6.1-15.1 php5-fileinfo-5.6.1-15.1 php5-fileinfo-debuginfo-5.6.1-15.1 php5-firebird-5.6.1-15.1 php5-firebird-debuginfo-5.6.1-15.1 php5-fpm-5.6.1-15.1 php5-fpm-debuginfo-5.6.1-15.1 php5-ftp-5.6.1-15.1 php5-ftp-debuginfo-5.6.1-15.1 php5-gd-5.6.1-15.1 php5-gd-debuginfo-5.6.1-15.1 php5-gettext-5.6.1-15.1 php5-gettext-debuginfo-5.6.1-15.1 php5-gmp-5.6.1-15.1 php5-gmp-debuginfo-5.6.1-15.1 php5-iconv-5.6.1-15.1 php5-iconv-debuginfo-5.6.1-15.1 php5-imap-5.6.1-15.1 php5-imap-debuginfo-5.6.1-15.1 php5-intl-5.6.1-15.1 php5-intl-debuginfo-5.6.1-15.1 php5-json-5.6.1-15.1 php5-json-debuginfo-5.6.1-15.1 php5-ldap-5.6.1-15.1 php5-ldap-debuginfo-5.6.1-15.1 php5-mbstring-5.6.1-15.1 php5-mbstring-debuginfo-5.6.1-15.1 php5-mcrypt-5.6.1-15.1 php5-mcrypt-debuginfo-5.6.1-15.1 php5-mssql-5.6.1-15.1 php5-mssql-debuginfo-5.6.1-15.1 php5-mysql-5.6.1-15.1 php5-mysql-debuginfo-5.6.1-15.1 php5-odbc-5.6.1-15.1 php5-odbc-debuginfo-5.6.1-15.1 php5-opcache-5.6.1-15.1 php5-opcache-debuginfo-5.6.1-15.1 php5-openssl-5.6.1-15.1 php5-openssl-debuginfo-5.6.1-15.1 php5-pcntl-5.6.1-15.1 php5-pcntl-debuginfo-5.6.1-15.1 php5-pdo-5.6.1-15.1 php5-pdo-debuginfo-5.6.1-15.1 php5-pgsql-5.6.1-15.1 php5-pgsql-debuginfo-5.6.1-15.1 php5-phar-5.6.1-15.1 php5-phar-debuginfo-5.6.1-15.1 php5-posix-5.6.1-15.1 php5-posix-debuginfo-5.6.1-15.1 php5-pspell-5.6.1-15.1 php5-pspell-debuginfo-5.6.1-15.1 php5-readline-5.6.1-15.1 php5-readline-debuginfo-5.6.1-15.1 php5-shmop-5.6.1-15.1 php5-shmop-debuginfo-5.6.1-15.1 php5-snmp-5.6.1-15.1 php5-snmp-debuginfo-5.6.1-15.1 php5-soap-5.6.1-15.1 php5-soap-debuginfo-5.6.1-15.1 php5-sockets-5.6.1-15.1 php5-sockets-debuginfo-5.6.1-15.1 php5-sqlite-5.6.1-15.1 php5-sqlite-debuginfo-5.6.1-15.1 php5-suhosin-5.6.1-15.1 php5-suhosin-debuginfo-5.6.1-15.1 php5-sysvmsg-5.6.1-15.1 php5-sysvmsg-debuginfo-5.6.1-15.1 php5-sysvsem-5.6.1-15.1 php5-sysvsem-debuginfo-5.6.1-15.1 php5-sysvshm-5.6.1-15.1 php5-sysvshm-debuginfo-5.6.1-15.1 php5-tidy-5.6.1-15.1 php5-tidy-debuginfo-5.6.1-15.1 php5-tokenizer-5.6.1-15.1 php5-tokenizer-debuginfo-5.6.1-15.1 php5-wddx-5.6.1-15.1 php5-wddx-debuginfo-5.6.1-15.1 php5-xmlreader-5.6.1-15.1 php5-xmlreader-debuginfo-5.6.1-15.1 php5-xmlrpc-5.6.1-15.1 php5-xmlrpc-debuginfo-5.6.1-15.1 php5-xmlwriter-5.6.1-15.1 php5-xmlwriter-debuginfo-5.6.1-15.1 php5-xsl-5.6.1-15.1 php5-xsl-debuginfo-5.6.1-15.1 php5-zip-5.6.1-15.1 php5-zip-debuginfo-5.6.1-15.1 php5-zlib-5.6.1-15.1 php5-zlib-debuginfo-5.6.1-15.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-15.1 - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-45.1 apache2-mod_php5-debuginfo-5.4.20-45.1 php5-5.4.20-45.1 php5-bcmath-5.4.20-45.1 php5-bcmath-debuginfo-5.4.20-45.1 php5-bz2-5.4.20-45.1 php5-bz2-debuginfo-5.4.20-45.1 php5-calendar-5.4.20-45.1 php5-calendar-debuginfo-5.4.20-45.1 php5-ctype-5.4.20-45.1 php5-ctype-debuginfo-5.4.20-45.1 php5-curl-5.4.20-45.1 php5-curl-debuginfo-5.4.20-45.1 php5-dba-5.4.20-45.1 php5-dba-debuginfo-5.4.20-45.1 php5-debuginfo-5.4.20-45.1 php5-debugsource-5.4.20-45.1 php5-devel-5.4.20-45.1 php5-dom-5.4.20-45.1 php5-dom-debuginfo-5.4.20-45.1 php5-enchant-5.4.20-45.1 php5-enchant-debuginfo-5.4.20-45.1 php5-exif-5.4.20-45.1 php5-exif-debuginfo-5.4.20-45.1 php5-fastcgi-5.4.20-45.1 php5-fastcgi-debuginfo-5.4.20-45.1 php5-fileinfo-5.4.20-45.1 php5-fileinfo-debuginfo-5.4.20-45.1 php5-firebird-5.4.20-45.1 php5-firebird-debuginfo-5.4.20-45.1 php5-fpm-5.4.20-45.1 php5-fpm-debuginfo-5.4.20-45.1 php5-ftp-5.4.20-45.1 php5-ftp-debuginfo-5.4.20-45.1 php5-gd-5.4.20-45.1 php5-gd-debuginfo-5.4.20-45.1 php5-gettext-5.4.20-45.1 php5-gettext-debuginfo-5.4.20-45.1 php5-gmp-5.4.20-45.1 php5-gmp-debuginfo-5.4.20-45.1 php5-iconv-5.4.20-45.1 php5-iconv-debuginfo-5.4.20-45.1 php5-imap-5.4.20-45.1 php5-imap-debuginfo-5.4.20-45.1 php5-intl-5.4.20-45.1 php5-intl-debuginfo-5.4.20-45.1 php5-json-5.4.20-45.1 php5-json-debuginfo-5.4.20-45.1 php5-ldap-5.4.20-45.1 php5-ldap-debuginfo-5.4.20-45.1 php5-mbstring-5.4.20-45.1 php5-mbstring-debuginfo-5.4.20-45.1 php5-mcrypt-5.4.20-45.1 php5-mcrypt-debuginfo-5.4.20-45.1 php5-mssql-5.4.20-45.1 php5-mssql-debuginfo-5.4.20-45.1 php5-mysql-5.4.20-45.1 php5-mysql-debuginfo-5.4.20-45.1 php5-odbc-5.4.20-45.1 php5-odbc-debuginfo-5.4.20-45.1 php5-openssl-5.4.20-45.1 php5-openssl-debuginfo-5.4.20-45.1 php5-pcntl-5.4.20-45.1 php5-pcntl-debuginfo-5.4.20-45.1 php5-pdo-5.4.20-45.1 php5-pdo-debuginfo-5.4.20-45.1 php5-pgsql-5.4.20-45.1 php5-pgsql-debuginfo-5.4.20-45.1 php5-phar-5.4.20-45.1 php5-phar-debuginfo-5.4.20-45.1 php5-posix-5.4.20-45.1 php5-posix-debuginfo-5.4.20-45.1 php5-pspell-5.4.20-45.1 php5-pspell-debuginfo-5.4.20-45.1 php5-readline-5.4.20-45.1 php5-readline-debuginfo-5.4.20-45.1 php5-shmop-5.4.20-45.1 php5-shmop-debuginfo-5.4.20-45.1 php5-snmp-5.4.20-45.1 php5-snmp-debuginfo-5.4.20-45.1 php5-soap-5.4.20-45.1 php5-soap-debuginfo-5.4.20-45.1 php5-sockets-5.4.20-45.1 php5-sockets-debuginfo-5.4.20-45.1 php5-sqlite-5.4.20-45.1 php5-sqlite-debuginfo-5.4.20-45.1 php5-suhosin-5.4.20-45.1 php5-suhosin-debuginfo-5.4.20-45.1 php5-sysvmsg-5.4.20-45.1 php5-sysvmsg-debuginfo-5.4.20-45.1 php5-sysvsem-5.4.20-45.1 php5-sysvsem-debuginfo-5.4.20-45.1 php5-sysvshm-5.4.20-45.1 php5-sysvshm-debuginfo-5.4.20-45.1 php5-tidy-5.4.20-45.1 php5-tidy-debuginfo-5.4.20-45.1 php5-tokenizer-5.4.20-45.1 php5-tokenizer-debuginfo-5.4.20-45.1 php5-wddx-5.4.20-45.1 php5-wddx-debuginfo-5.4.20-45.1 php5-xmlreader-5.4.20-45.1 php5-xmlreader-debuginfo-5.4.20-45.1 php5-xmlrpc-5.4.20-45.1 php5-xmlrpc-debuginfo-5.4.20-45.1 php5-xmlwriter-5.4.20-45.1 php5-xmlwriter-debuginfo-5.4.20-45.1 php5-xsl-5.4.20-45.1 php5-xsl-debuginfo-5.4.20-45.1 php5-zip-5.4.20-45.1 php5-zip-debuginfo-5.4.20-45.1 php5-zlib-5.4.20-45.1 php5-zlib-debuginfo-5.4.20-45.1 - openSUSE 13.1 (noarch): php5-pear-5.4.20-45.1 References: https://www.suse.com/security/cve/CVE-2014-9705.html https://www.suse.com/security/cve/CVE-2014-9709.html https://www.suse.com/security/cve/CVE-2015-2301.html https://www.suse.com/security/cve/CVE-2015-2305.html https://www.suse.com/security/cve/CVE-2015-2331.html https://bugzilla.suse.com/922022 https://bugzilla.suse.com/922451 https://bugzilla.suse.com/922452 https://bugzilla.suse.com/922894 https://bugzilla.suse.com/923946

1 0

openSUSE-SU-2015:0643-1: moderate: Security update for python-Django
by opensuse-security＠opensuse.org 01 Apr '15

01 Apr '15

openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0643-1 Rating: moderate References: #913053 #913055 #913056 #923172 #923176 Cross-References: CVE-2015-0219 CVE-2015-0221 CVE-2015-0222 CVE-2015-2316 CVE-2015-2317 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: python-django was updated to 1.6.11 to fix security issues and non-security bugs. THe following vulnerabilities were fixed: * Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317) * Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316) * WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219) * Mitigated possible XSS attack via user-supplied redirect URLs * Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221) * Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222) The update also contains fixes for non-security bugs, functional and stability issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-Django-1.6.11-3.4.1 References: https://www.suse.com/security/cve/CVE-2015-0219.html https://www.suse.com/security/cve/CVE-2015-0221.html https://www.suse.com/security/cve/CVE-2015-0222.html https://www.suse.com/security/cve/CVE-2015-2316.html https://www.suse.com/security/cve/CVE-2015-2317.html https://bugzilla.suse.com/913053 https://bugzilla.suse.com/913055 https://bugzilla.suse.com/913056 https://bugzilla.suse.com/923172 https://bugzilla.suse.com/923176

1 0