July 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1259-1: moderate: Security update for rubygem-rack
by opensuse-security＠opensuse.org 17 Jul '15

17 Jul '15

openSUSE Security Update: Security update for rubygem-rack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1259-1 Rating: moderate References: #934797 Cross-References: CVE-2015-3225 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-rack was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Potential Denial of Service Vulnerability in Rack (bsc#934797). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-498=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-498=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-rack-1.5.2-4.3.1 rubygem-rack-doc-1.5.2-4.3.1 rubygem-rack-testsuite-1.5.2-4.3.1 - openSUSE 13.1 (i586 x86_64): rubygem-rack-1.5.2-2.3.1 rubygem-rack-doc-1.5.2-2.3.1 rubygem-rack-testsuite-1.5.2-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-3225.html https://bugzilla.suse.com/934797

1 0

openSUSE-SU-2015:1250-2: moderate: Security update for bind
by opensuse-security＠opensuse.org 16 Jul '15

16 Jul '15

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1250-2 Rating: moderate References: #908994 #918330 #936476 #937028 Cross-References: CVE-2014-8500 CVE-2015-1349 CVE-2015-4620 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: bind was updated to fix three security issues. These security issues were fixed: - CVE-2015-1349: named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allowed remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use (bsc#918330). - CVE-2014-8500: ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 did not limit delegation chaining, which allowed remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals (bsc#908994). - CVE-2015-4620: Resolver crash when validating (bsc#936476). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-494=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.11.1 bind-chrootenv-9.9.4P2-2.11.1 bind-debuginfo-9.9.4P2-2.11.1 bind-debugsource-9.9.4P2-2.11.1 bind-devel-9.9.4P2-2.11.1 bind-libs-9.9.4P2-2.11.1 bind-libs-debuginfo-9.9.4P2-2.11.1 bind-lwresd-9.9.4P2-2.11.1 bind-lwresd-debuginfo-9.9.4P2-2.11.1 bind-utils-9.9.4P2-2.11.1 bind-utils-debuginfo-9.9.4P2-2.11.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.11.1 bind-libs-debuginfo-32bit-9.9.4P2-2.11.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.11.1 References: https://www.suse.com/security/cve/CVE-2014-8500.html https://www.suse.com/security/cve/CVE-2015-1349.html https://www.suse.com/security/cve/CVE-2015-4620.html https://bugzilla.suse.com/908994 https://bugzilla.suse.com/918330 https://bugzilla.suse.com/936476 https://bugzilla.suse.com/937028

1 0

openSUSE-SU-2015:1250-1: moderate: Security update for bind
by opensuse-security＠opensuse.org 16 Jul '15

16 Jul '15

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1250-1 Rating: moderate References: #908994 #918330 #936476 #937028 Cross-References: CVE-2014-8500 CVE-2015-1349 CVE-2015-4620 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: bind was updated to fix three security issues. These security issues were fixed: - CVE-2015-1349: named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allowed remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use (bsc#918330). - CVE-2014-8500: ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 did not limit delegation chaining, which allowed remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals (bsc#908994). - CVE-2015-4620: Resolver crash when validating (bsc#936476). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-494=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.4.1 bind-chrootenv-9.9.6P1-2.4.1 bind-debuginfo-9.9.6P1-2.4.1 bind-debugsource-9.9.6P1-2.4.1 bind-devel-9.9.6P1-2.4.1 bind-libs-9.9.6P1-2.4.1 bind-libs-debuginfo-9.9.6P1-2.4.1 bind-lwresd-9.9.6P1-2.4.1 bind-lwresd-debuginfo-9.9.6P1-2.4.1 bind-utils-9.9.6P1-2.4.1 bind-utils-debuginfo-9.9.6P1-2.4.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.4.1 bind-libs-debuginfo-32bit-9.9.6P1-2.4.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.4.1 References: https://www.suse.com/security/cve/CVE-2014-8500.html https://www.suse.com/security/cve/CVE-2015-1349.html https://www.suse.com/security/cve/CVE-2015-4620.html https://bugzilla.suse.com/908994 https://bugzilla.suse.com/918330 https://bugzilla.suse.com/936476 https://bugzilla.suse.com/937028

1 0

openSUSE-RU-2015:1247-2: important: Recommended update for MariaDB
by maintenance＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Recommended Update: Recommended update for MariaDB ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1247-2 Rating: important References: #937630 #937754 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: MariaDB was updated to fix two bugs. * boo#937630: A regression from a previous security update caused the resolvable mysql-devel to be no longer provided even though used by some packages. * boo#937754: Correct symbolic links of libmysqlclient_r18 package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-493=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysqlclient-devel-10.0.20-2.12.1 libmysqlclient18-10.0.20-2.12.1 libmysqlclient18-debuginfo-10.0.20-2.12.1 libmysqlclient_r18-10.0.20-2.12.1 libmysqld-devel-10.0.20-2.12.1 libmysqld18-10.0.20-2.12.1 libmysqld18-debuginfo-10.0.20-2.12.1 mariadb-10.0.20-2.12.1 mariadb-bench-10.0.20-2.12.1 mariadb-bench-debuginfo-10.0.20-2.12.1 mariadb-client-10.0.20-2.12.1 mariadb-client-debuginfo-10.0.20-2.12.1 mariadb-debuginfo-10.0.20-2.12.1 mariadb-debugsource-10.0.20-2.12.1 mariadb-errormessages-10.0.20-2.12.1 mariadb-test-10.0.20-2.12.1 mariadb-test-debuginfo-10.0.20-2.12.1 mariadb-tools-10.0.20-2.12.1 mariadb-tools-debuginfo-10.0.20-2.12.1 - openSUSE 13.2 (x86_64): libmysqlclient18-32bit-10.0.20-2.12.1 libmysqlclient18-debuginfo-32bit-10.0.20-2.12.1 libmysqlclient_r18-32bit-10.0.20-2.12.1 References: https://bugzilla.suse.com/937630 https://bugzilla.suse.com/937754

1 0

openSUSE-RU-2015:1247-1: important: Recommended update for MariaDB
by maintenance＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Recommended Update: Recommended update for MariaDB ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1247-1 Rating: important References: #937630 #937754 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: MariaDB was updated to fix two bugs. * boo#937630: A regression from a previous security update caused the resolvable mysql-devel to be no longer provided even though used by some packages. * boo#937754: Correct symbolic links of libmysqlclient_r18 package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-493=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libmysqlclient-devel-5.5.44-7.2 libmysqlclient18-5.5.44-7.2 libmysqlclient18-debuginfo-5.5.44-7.2 libmysqlclient_r18-5.5.44-7.2 libmysqld-devel-5.5.44-7.2 libmysqld18-5.5.44-7.2 libmysqld18-debuginfo-5.5.44-7.2 mariadb-5.5.44-7.2 mariadb-bench-5.5.44-7.2 mariadb-bench-debuginfo-5.5.44-7.2 mariadb-client-5.5.44-7.2 mariadb-client-debuginfo-5.5.44-7.2 mariadb-debuginfo-5.5.44-7.2 mariadb-debugsource-5.5.44-7.2 mariadb-errormessages-5.5.44-7.2 mariadb-test-5.5.44-7.2 mariadb-test-debuginfo-5.5.44-7.2 mariadb-tools-5.5.44-7.2 mariadb-tools-debuginfo-5.5.44-7.2 - openSUSE 13.1 (x86_64): libmysqlclient18-32bit-5.5.44-7.2 libmysqlclient18-debuginfo-32bit-5.5.44-7.2 libmysqlclient_r18-32bit-5.5.44-7.2 References: https://bugzilla.suse.com/937630 https://bugzilla.suse.com/937754

1 0

openSUSE-SU-2015:1245-2: Security update for libunwind
by opensuse-security＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Security Update: Security update for libunwind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1245-2 Rating: low References: #936786 Cross-References: CVE-2015-3239 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libunwind was updated to fix one security issue. This security issue was fixed: - CVE-2015-3239: Off-by-one in dwarf_to_unw_regnum() (bsc#936786). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-491=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libunwind-1.1-6.3.1 libunwind-debuginfo-1.1-6.3.1 libunwind-debugsource-1.1-6.3.1 libunwind-devel-1.1-6.3.1 - openSUSE 13.1 (x86_64): libunwind-32bit-1.1-6.3.1 libunwind-debuginfo-32bit-1.1-6.3.1 References: https://www.suse.com/security/cve/CVE-2015-3239.html https://bugzilla.suse.com/936786

1 0

openSUSE-SU-2015:1245-1: Security update for libunwind
by opensuse-security＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Security Update: Security update for libunwind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1245-1 Rating: low References: #936786 Cross-References: CVE-2015-3239 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libunwind was updated to fix one security issue. This security issue was fixed: - CVE-2015-3239: Off-by-one in dwarf_to_unw_regnum() (bsc#936786). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-491=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libunwind-1.1-10.3.1 libunwind-debuginfo-1.1-10.3.1 libunwind-debugsource-1.1-10.3.1 libunwind-devel-1.1-10.3.1 - openSUSE 13.2 (x86_64): libunwind-32bit-1.1-10.3.1 libunwind-debuginfo-32bit-1.1-10.3.1 References: https://www.suse.com/security/cve/CVE-2015-3239.html https://bugzilla.suse.com/936786

1 0

openSUSE-SU-2015:1244-1: moderate: Security update for cups-filters
by opensuse-security＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Security Update: Security update for cups-filters ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1244-1 Rating: moderate References: #921753 #936281 #937018 Cross-References: CVE-2015-2265 CVE-2015-3258 CVE-2015-3279 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: cups-filters was updated to fix three security issues. These security issues were fixed: - CVE-2015-2265: The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allowed remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707 (bsc#921753). - CVE-2015-3279: Texttopdf integer overflow (incomplete fix for CVE-2015-3258) (bsc#937018). - CVE-2015-3258: Texttopdf heap-based buffer overflow (bsc#936281). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-492=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cups-filters-1.0.58-2.7.1 cups-filters-cups-browsed-1.0.58-2.7.1 cups-filters-cups-browsed-debuginfo-1.0.58-2.7.1 cups-filters-debuginfo-1.0.58-2.7.1 cups-filters-debugsource-1.0.58-2.7.1 cups-filters-devel-1.0.58-2.7.1 cups-filters-foomatic-rip-1.0.58-2.7.1 cups-filters-foomatic-rip-debuginfo-1.0.58-2.7.1 cups-filters-ghostscript-1.0.58-2.7.1 cups-filters-ghostscript-debuginfo-1.0.58-2.7.1 References: https://www.suse.com/security/cve/CVE-2015-2265.html https://www.suse.com/security/cve/CVE-2015-3258.html https://www.suse.com/security/cve/CVE-2015-3279.html https://bugzilla.suse.com/921753 https://bugzilla.suse.com/936281 https://bugzilla.suse.com/937018

1 0

openSUSE-SU-2015:1240-1: Security update for roundcubemail
by opensuse-security＠opensuse.org 14 Jul '15

14 Jul '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1240-1 Rating: low References: Cross-References: CVE-2015-2180 CVE-2015-2181 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: roundcubemail was updated to version 1.0.6 to fix many minor bugs and three security issues. The following vulnerabilities were fixed: * CVE-2015-2180: security improvement in DBMail driver of password plugin (shell execution) * CVE-2015-2181: security improvement in DBMail driver of password plugin (multiple buffer overflows) * security improvement in contact photo handling Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-490=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): roundcubemail-1.0.6-2.21.1 References: https://www.suse.com/security/cve/CVE-2015-2180.html https://www.suse.com/security/cve/CVE-2015-2181.html

1 0

openSUSE-RU-2015:1238-1: moderate: Recommended update for akonadi-runtime
by maintenance＠opensuse.org 13 Jul '15

13 Jul '15

openSUSE Recommended Update: Recommended update for akonadi-runtime ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1238-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for akonadi-runtime fixes the following issues: - do not leak external payload files, fixes disk usage of akonadi file_db_data (kde#341884) - Package sqldrivers depending on its availibility instead of a given suse_version number Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-482=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): akonadi-runtime-1.13.0-2.4.1 akonadi-runtime-debuginfo-1.13.0-2.4.1 akonadi-runtime-debugsource-1.13.0-2.4.1 libakonadiprotocolinternals-devel-1.13.0-2.4.1 libakonadiprotocolinternals1-1.13.0-2.4.1 libakonadiprotocolinternals1-debuginfo-1.13.0-2.4.1 - openSUSE 13.2 (x86_64): libakonadiprotocolinternals1-32bit-1.13.0-2.4.1 libakonadiprotocolinternals1-debuginfo-32bit-1.13.0-2.4.1 References:

1 0