July 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:1293-1: moderate: Recommended update for apache2-mod_auth_ntlm_winbind
by maintenance＠opensuse.org 27 Jul '15

27 Jul '15

openSUSE Recommended Update: Recommended update for apache2-mod_auth_ntlm_winbind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1293-1 Rating: moderate References: #866921 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for apache2-mod_auth_ntlml_winbind fixes the following issues: - Only send "Proxy-Authenticate" replies when we are in a forward proxy. - Clean up compile warnings on 64-bit architectures (boo#866921). - Ensure that the authenticated user context is set to NULL when freed. - Add a workaround for proxy authorization in IE. - Fix a typo in strcmp usage in process_msg(). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-518=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_auth_ntlm_winbind-0.0.0.lorikeet_svn_785-191.3.1 apache2-mod_auth_ntlm_winbind-debuginfo-0.0.0.lorikeet_svn_785-191.3.1 apache2-mod_auth_ntlm_winbind-debugsource-0.0.0.lorikeet_svn_785-191.3.1 References: https://bugzilla.suse.com/866921

1 0

openSUSE-RU-2015:1292-1: Recommended update for Amarok
by maintenance＠opensuse.org 27 Jul '15

27 Jul '15

openSUSE Recommended Update: Recommended update for Amarok ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1292-1 Rating: low References: #934730 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for Amarok provides the following fixes and improvements: - Fixes the wikipedia applet in Amarok - remove unneeded Strigi reference in the Ampache plugin build system - unbreak Ampache plugin connection due to wrong hashing algorithm being used - Require correct libtag.so to avoid undefined symbols at runtime Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-520=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): amarok-2.8.0-9.3.2 amarok-debuginfo-2.8.0-9.3.2 amarok-debugsource-2.8.0-9.3.2 - openSUSE 13.2 (noarch): amarok-lang-2.8.0-9.3.2 References: https://bugzilla.suse.com/934730

1 0

openSUSE-RU-2015:1291-1: moderate: Recommended udpate for pm-utils
by maintenance＠opensuse.org 27 Jul '15

27 Jul '15

openSUSE Recommended Update: Recommended udpate for pm-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1291-1 Rating: moderate References: #925873 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for pm-utils provides the following fix: - use kernel method for suspend/hibernate by default instead of the problematic uswsusp (boo#925873) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-515=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): pm-utils-1.4.1-38.7.1 pm-utils-debuginfo-1.4.1-38.7.1 pm-utils-debugsource-1.4.1-38.7.1 pm-utils-ndiswrapper-1.4.1-38.7.1 References: https://bugzilla.suse.com/925873

1 0

openSUSE-RU-2015:1290-1: moderate: Recommended update for NetworkManager
by maintenance＠opensuse.org 27 Jul '15

27 Jul '15

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1290-1 Rating: moderate References: #937762 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for NetworkManager fixes the following issue: - ignore hop limits of zero (boo#937762, bgo#737252) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-519=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): NetworkManager-0.9.10.0-3.11.1 NetworkManager-debuginfo-0.9.10.0-3.11.1 NetworkManager-debugsource-0.9.10.0-3.11.1 NetworkManager-devel-0.9.10.0-3.11.1 libnm-glib-vpn1-0.9.10.0-3.11.1 libnm-glib-vpn1-debuginfo-0.9.10.0-3.11.1 libnm-glib4-0.9.10.0-3.11.1 libnm-glib4-debuginfo-0.9.10.0-3.11.1 libnm-util2-0.9.10.0-3.11.1 libnm-util2-debuginfo-0.9.10.0-3.11.1 typelib-1_0-NMClient-1_0-0.9.10.0-3.11.1 typelib-1_0-NetworkManager-1_0-0.9.10.0-3.11.1 - openSUSE 13.2 (x86_64): NetworkManager-devel-32bit-0.9.10.0-3.11.1 libnm-glib-vpn1-32bit-0.9.10.0-3.11.1 libnm-glib-vpn1-debuginfo-32bit-0.9.10.0-3.11.1 libnm-glib4-32bit-0.9.10.0-3.11.1 libnm-glib4-debuginfo-32bit-0.9.10.0-3.11.1 libnm-util2-32bit-0.9.10.0-3.11.1 libnm-util2-debuginfo-32bit-0.9.10.0-3.11.1 - openSUSE 13.2 (noarch): NetworkManager-lang-0.9.10.0-3.11.1 References: https://bugzilla.suse.com/937762

1 0

openSUSE-SU-2015:1289-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1289-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2659 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2659: Easily exploitable vulnerability in the Security component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.51-12.1 java-1_8_0-openjdk-accessibility-1.8.0.51-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-debugsource-1.8.0.51-12.1 java-1_8_0-openjdk-demo-1.8.0.51-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-devel-1.8.0.51-12.1 java-1_8_0-openjdk-headless-1.8.0.51-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-src-1.8.0.51-12.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.51-12.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2659.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248

1 0

openSUSE-SU-2015:1288-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1288-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-511=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-511=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-10.2 java-1_7_0-openjdk-accessibility-1.7.0.85-10.2 java-1_7_0-openjdk-bootstrap-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-debugsource-1.7.0.85-10.2 java-1_7_0-openjdk-demo-1.7.0.85-10.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-devel-1.7.0.85-10.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-headless-1.7.0.85-10.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-src-1.7.0.85-10.2 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-10.2 - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-24.21.1 java-1_7_0-openjdk-accessibility-1.7.0.85-24.21.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-debugsource-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-src-1.7.0.85-24.21.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-24.21.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2596.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248

1 0

openSUSE-SU-2015:1287-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1287-1 Rating: important References: #939077 Cross-References: CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1275 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 CVE-2015-5605 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: Chromium was updated to 44.0.2403.89 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-1271: Heap-buffer-overflow in pdfium * CVE-2015-1273: Heap-buffer-overflow in pdfium * CVE-2015-1274: Settings allowed executable files to run immediately after download * CVE-2015-1275: UXSS in Chrome for Android * CVE-2015-1276: Use-after-free in IndexedDB * CVE-2015-1279: Heap-buffer-overflow in pdfium * CVE-2015-1280: Memory corruption in skia * CVE-2015-1281: CSP bypass * CVE-2015-1282: Use-after-free in pdfium * CVE-2015-1283: Heap-buffer-overflow in expat * CVE-2015-1284: Use-after-free in blink * CVE-2015-1286: UXSS in blink * CVE-2015-1287: SOP bypass with CSS * CVE-2015-1270: Uninitialized memory read in ICU * CVE-2015-1272: Use-after-free related to unexpected GPU process termination * CVE-2015-1277: Use-after-free in accessibility * CVE-2015-1278: URL spoofing using pdf files * CVE-2015-1285: Information leak in XSS auditor * CVE-2015-1288: Spell checking dictionaries fetched over HTTP * CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives * CVE-2015-5605: Rgular-expression implementation mishandles interrupts, DoS via JS The following non-security changes are included: * A number of new apps/extension APIs * Lots of under the hood changes for stability and performance * Pepper Flash plugin updated to 18.0.0.209 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-513=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-44.0.2403.89-38.1 chromedriver-debuginfo-44.0.2403.89-38.1 chromium-44.0.2403.89-38.1 chromium-debuginfo-44.0.2403.89-38.1 chromium-debugsource-44.0.2403.89-38.1 chromium-desktop-gnome-44.0.2403.89-38.1 chromium-desktop-kde-44.0.2403.89-38.1 chromium-ffmpegsumo-44.0.2403.89-38.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-38.1 - openSUSE 13.1 (i586 x86_64): chromedriver-44.0.2403.89-93.1 chromedriver-debuginfo-44.0.2403.89-93.1 chromium-44.0.2403.89-93.1 chromium-debuginfo-44.0.2403.89-93.1 chromium-debugsource-44.0.2403.89-93.1 chromium-desktop-gnome-44.0.2403.89-93.1 chromium-desktop-kde-44.0.2403.89-93.1 chromium-ffmpegsumo-44.0.2403.89-93.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-93.1 References: https://www.suse.com/security/cve/CVE-2015-1270.html https://www.suse.com/security/cve/CVE-2015-1271.html https://www.suse.com/security/cve/CVE-2015-1272.html https://www.suse.com/security/cve/CVE-2015-1273.html https://www.suse.com/security/cve/CVE-2015-1274.html https://www.suse.com/security/cve/CVE-2015-1275.html https://www.suse.com/security/cve/CVE-2015-1276.html https://www.suse.com/security/cve/CVE-2015-1277.html https://www.suse.com/security/cve/CVE-2015-1278.html https://www.suse.com/security/cve/CVE-2015-1279.html https://www.suse.com/security/cve/CVE-2015-1280.html https://www.suse.com/security/cve/CVE-2015-1281.html https://www.suse.com/security/cve/CVE-2015-1282.html https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2015-1284.html https://www.suse.com/security/cve/CVE-2015-1285.html https://www.suse.com/security/cve/CVE-2015-1286.html https://www.suse.com/security/cve/CVE-2015-1287.html https://www.suse.com/security/cve/CVE-2015-1288.html https://www.suse.com/security/cve/CVE-2015-1289.html https://www.suse.com/security/cve/CVE-2015-5605.html https://bugzilla.suse.com/939077

1 0

openSUSE-RU-2015:1286-1: moderate: Recommended update for mysql-community-server
by maintenance＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Recommended Update: Recommended update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1286-1 Rating: moderate References: #937754 #937767 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for mysql-community-server provides the following fixes: - Update syntax of systemd helper (boo#937767) - Create correct symlinks for libmysqlclient_r18 (boo#937754) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-509=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-509=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.25-2.6.2 libmysql56client18-debuginfo-5.6.25-2.6.2 libmysql56client_r18-5.6.25-2.6.2 mysql-community-server-5.6.25-2.6.2 mysql-community-server-bench-5.6.25-2.6.2 mysql-community-server-bench-debuginfo-5.6.25-2.6.2 mysql-community-server-client-5.6.25-2.6.2 mysql-community-server-client-debuginfo-5.6.25-2.6.2 mysql-community-server-debuginfo-5.6.25-2.6.2 mysql-community-server-debugsource-5.6.25-2.6.2 mysql-community-server-errormessages-5.6.25-2.6.2 mysql-community-server-test-5.6.25-2.6.2 mysql-community-server-test-debuginfo-5.6.25-2.6.2 mysql-community-server-tools-5.6.25-2.6.2 mysql-community-server-tools-debuginfo-5.6.25-2.6.2 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.25-2.6.2 libmysql56client18-debuginfo-32bit-5.6.25-2.6.2 libmysql56client_r18-32bit-5.6.25-2.6.2 - openSUSE 13.1 (i586 x86_64): libmysql56client18-5.6.25-7.7.2 libmysql56client18-debuginfo-5.6.25-7.7.2 libmysql56client_r18-5.6.25-7.7.2 mysql-community-server-5.6.25-7.7.2 mysql-community-server-bench-5.6.25-7.7.2 mysql-community-server-bench-debuginfo-5.6.25-7.7.2 mysql-community-server-client-5.6.25-7.7.2 mysql-community-server-client-debuginfo-5.6.25-7.7.2 mysql-community-server-debuginfo-5.6.25-7.7.2 mysql-community-server-debugsource-5.6.25-7.7.2 mysql-community-server-errormessages-5.6.25-7.7.2 mysql-community-server-test-5.6.25-7.7.2 mysql-community-server-test-debuginfo-5.6.25-7.7.2 mysql-community-server-tools-5.6.25-7.7.2 mysql-community-server-tools-debuginfo-5.6.25-7.7.2 - openSUSE 13.1 (x86_64): libmysql56client18-32bit-5.6.25-7.7.2 libmysql56client18-debuginfo-32bit-5.6.25-7.7.2 libmysql56client_r18-32bit-5.6.25-7.7.2 References: https://bugzilla.suse.com/937754 https://bugzilla.suse.com/937767

1 0

openSUSE-SU-2015:1285-1: moderate: Security update for cacti
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1285-1 Rating: moderate References: #937997 Cross-References: CVE-2015-4634 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Cacti was updated to 0.8.8e to fix several security issues. The following vulnerabilities were fixed: * Multiple XSS and SQL injection vulnerabilities [boo#937997] * CVE-2015-4634: SQL injection in graphs.php [boo#937997] In addition, this update contains upstream bug fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-510=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-510=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): cacti-0.8.8e-4.10.1 - openSUSE 13.1 (noarch): cacti-0.8.8e-14.1 References: https://www.suse.com/security/cve/CVE-2015-4634.html https://bugzilla.suse.com/937997

1 0

openSUSE-SU-2015:1280-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1280-1 Rating: moderate References: #938161 Cross-References: CVE-2015-3908 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: ansible was updated to fix one security issue. This security issue was fixed: - CVE-2015-3908: Fixed improper TLS Certificate Validation (bsc#938161). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-508=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): ansible-1.7.1-2.5.1 References: https://www.suse.com/security/cve/CVE-2015-3908.html https://bugzilla.suse.com/938161

1 0