August 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:1428-1: Security update for wireshark
by opensuse-security＠opensuse.org 24 Aug '15

24 Aug '15

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1428-1 Rating: low References: #941500 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Wireshark was updated to fix several security vulnerabilities and bugs. - Wireshark 1.12.7 [boo#941500] The following vulnerabilities have been fixed: * Wireshark could crash when adding an item to the protocol tree. wnpa-sec-2015-21 * Wireshark could attempt to free invalid memory. wnpa-sec-2015-22 * Wireshark could crash when searching for a protocol dissector. wnpa-sec-2015-23 * The ZigBee dissector could crash. wnpa-sec-2015-24 * The GSM RLC/MAC dissector could go into an infinite loop. wnpa-sec-2015-25 * The WaveAgent dissector could crash. wnpa-sec-2015-26 * The OpenFlow dissector could go into an infinite loop. wnpa-sec-2015-27 * Wireshark could crash due to invalid ptvcursor length checking. wnpa-sec-2015-28 * The WCCP dissector could crash. wnpa-sec-2015-29 * Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-554=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wireshark-1.12.7-21.1 wireshark-debuginfo-1.12.7-21.1 wireshark-debugsource-1.12.7-21.1 wireshark-devel-1.12.7-21.1 wireshark-ui-gtk-1.12.7-21.1 wireshark-ui-gtk-debuginfo-1.12.7-21.1 wireshark-ui-qt-1.12.7-21.1 wireshark-ui-qt-debuginfo-1.12.7-21.1 References: https://bugzilla.suse.com/941500

1 0

openSUSE-RU-2015:1422-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 21 Aug '15

21 Aug '15

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1422-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update is a rebuild of the virtualbox kmps to match the recently released kernel update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-553=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-virtualbox-4.3.30-20.1 python-virtualbox-debuginfo-4.3.30-20.1 virtualbox-4.3.30-20.1 virtualbox-debuginfo-4.3.30-20.1 virtualbox-debugsource-4.3.30-20.1 virtualbox-devel-4.3.30-20.1 virtualbox-guest-kmp-default-4.3.30_k3.16.7_24-20.1 virtualbox-guest-kmp-default-debuginfo-4.3.30_k3.16.7_24-20.1 virtualbox-guest-kmp-desktop-4.3.30_k3.16.7_24-20.1 virtualbox-guest-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-20.1 virtualbox-guest-tools-4.3.30-20.1 virtualbox-guest-tools-debuginfo-4.3.30-20.1 virtualbox-guest-x11-4.3.30-20.1 virtualbox-guest-x11-debuginfo-4.3.30-20.1 virtualbox-host-kmp-default-4.3.30_k3.16.7_24-20.1 virtualbox-host-kmp-default-debuginfo-4.3.30_k3.16.7_24-20.1 virtualbox-host-kmp-desktop-4.3.30_k3.16.7_24-20.1 virtualbox-host-kmp-desktop-debuginfo-4.3.30_k3.16.7_24-20.1 virtualbox-qt-4.3.30-20.1 virtualbox-qt-debuginfo-4.3.30-20.1 virtualbox-websrv-4.3.30-20.1 virtualbox-websrv-debuginfo-4.3.30-20.1 - openSUSE 13.2 (noarch): virtualbox-guest-desktop-icons-4.3.30-20.1 virtualbox-host-source-4.3.30-20.1 - openSUSE 13.2 (i586): virtualbox-guest-kmp-pae-4.3.30_k3.16.7_24-20.1 virtualbox-guest-kmp-pae-debuginfo-4.3.30_k3.16.7_24-20.1 virtualbox-host-kmp-pae-4.3.30_k3.16.7_24-20.1 virtualbox-host-kmp-pae-debuginfo-4.3.30_k3.16.7_24-20.1 References:

1 0

openSUSE-RU-2015:1403-1: moderate: Recommended update for freeradius-server
by maintenance＠opensuse.org 18 Aug '15

18 Aug '15

openSUSE Recommended Update: Recommended update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1403-1 Rating: moderate References: #912714 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for freeradius-server fixes the following issue: - Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-552=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-552=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): freeradius-server-3.0.3-3.11.1 freeradius-server-debuginfo-3.0.3-3.11.1 freeradius-server-debugsource-3.0.3-3.11.1 freeradius-server-devel-3.0.3-3.11.1 freeradius-server-doc-3.0.3-3.11.1 freeradius-server-krb5-3.0.3-3.11.1 freeradius-server-krb5-debuginfo-3.0.3-3.11.1 freeradius-server-ldap-3.0.3-3.11.1 freeradius-server-ldap-debuginfo-3.0.3-3.11.1 freeradius-server-libs-3.0.3-3.11.1 freeradius-server-libs-debuginfo-3.0.3-3.11.1 freeradius-server-mysql-3.0.3-3.11.1 freeradius-server-mysql-debuginfo-3.0.3-3.11.1 freeradius-server-perl-3.0.3-3.11.1 freeradius-server-perl-debuginfo-3.0.3-3.11.1 freeradius-server-postgresql-3.0.3-3.11.1 freeradius-server-postgresql-debuginfo-3.0.3-3.11.1 freeradius-server-python-3.0.3-3.11.1 freeradius-server-python-debuginfo-3.0.3-3.11.1 freeradius-server-sqlite-3.0.3-3.11.1 freeradius-server-sqlite-debuginfo-3.0.3-3.11.1 freeradius-server-utils-3.0.3-3.11.1 freeradius-server-utils-debuginfo-3.0.3-3.11.1 - openSUSE 13.1 (i586 x86_64): freeradius-server-2.2.0-7.11.1 freeradius-server-debuginfo-2.2.0-7.11.1 freeradius-server-debugsource-2.2.0-7.11.1 freeradius-server-devel-2.2.0-7.11.1 freeradius-server-dialupadmin-2.2.0-7.11.1 freeradius-server-doc-2.2.0-7.11.1 freeradius-server-libs-2.2.0-7.11.1 freeradius-server-libs-debuginfo-2.2.0-7.11.1 freeradius-server-utils-2.2.0-7.11.1 freeradius-server-utils-debuginfo-2.2.0-7.11.1 References: https://bugzilla.suse.com/912714

1 0

openSUSE-RU-2015:1402-1: moderate: Recommended update for alsa-utils
by maintenance＠opensuse.org 18 Aug '15

18 Aug '15

openSUSE Recommended Update: Recommended update for alsa-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1402-1 Rating: moderate References: #940950 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for alsa-utils fixes the following issue: - Suppress alsactl invocation on systems without sound cards (bsc#940950) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-551=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): alsa-utils-1.0.28-5.6.1 alsa-utils-debuginfo-1.0.28-5.6.1 alsa-utils-debugsource-1.0.28-5.6.1 References: https://bugzilla.suse.com/940950

1 0

openSUSE-SU-2015:1401-1: moderate: Security update for subversion
by opensuse-security＠opensuse.org 18 Aug '15

18 Aug '15

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1401-1 Rating: moderate References: #939514 #939517 Cross-References: CVE-2015-3184 CVE-2015-3187 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: subversion was updated to version 1.8.14 to fix two security issues. These security issues were fixed: - CVE-2015-3187: Information leak (only paths) that were hidden by path-based authz (bsc#939517). - CVE-2015-3184: Information leak in mixed anonymous/authenticated httpd (dav) configurations (bsc#939514). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-549=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-549=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.14-2.17.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.14-2.17.1 libsvn_auth_kwallet-1-0-1.8.14-2.17.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.14-2.17.1 subversion-1.8.14-2.17.1 subversion-debuginfo-1.8.14-2.17.1 subversion-debugsource-1.8.14-2.17.1 subversion-devel-1.8.14-2.17.1 subversion-perl-1.8.14-2.17.1 subversion-perl-debuginfo-1.8.14-2.17.1 subversion-python-1.8.14-2.17.1 subversion-python-ctypes-1.8.14-2.17.1 subversion-python-debuginfo-1.8.14-2.17.1 subversion-ruby-1.8.14-2.17.1 subversion-ruby-debuginfo-1.8.14-2.17.1 subversion-server-1.8.14-2.17.1 subversion-server-debuginfo-1.8.14-2.17.1 subversion-tools-1.8.14-2.17.1 subversion-tools-debuginfo-1.8.14-2.17.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.14-2.17.1 - openSUSE 13.1 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.14-2.39.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.14-2.39.1 libsvn_auth_kwallet-1-0-1.8.14-2.39.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.14-2.39.1 subversion-1.8.14-2.39.1 subversion-debuginfo-1.8.14-2.39.1 subversion-debugsource-1.8.14-2.39.1 subversion-devel-1.8.14-2.39.1 subversion-perl-1.8.14-2.39.1 subversion-perl-debuginfo-1.8.14-2.39.1 subversion-python-1.8.14-2.39.1 subversion-python-debuginfo-1.8.14-2.39.1 subversion-ruby-1.8.14-2.39.1 subversion-ruby-debuginfo-1.8.14-2.39.1 subversion-server-1.8.14-2.39.1 subversion-server-debuginfo-1.8.14-2.39.1 subversion-tools-1.8.14-2.39.1 subversion-tools-debuginfo-1.8.14-2.39.1 - openSUSE 13.1 (noarch): subversion-bash-completion-1.8.14-2.39.1 References: https://www.suse.com/security/cve/CVE-2015-3184.html https://www.suse.com/security/cve/CVE-2015-3187.html https://bugzilla.suse.com/939514 https://bugzilla.suse.com/939517

1 0

openSUSE-SU-2015:1400-1: moderate: Security update for virtualbox
by opensuse-security＠opensuse.org 18 Aug '15

18 Aug '15

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1400-1 Rating: moderate References: #925663 #935900 #938408 Cross-References: CVE-2015-2594 CVE-2015-3456 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: - Version bump to 4.2.32 bnc#938408 CVE-2015-2594 * Storage: fixed a crash when taking snapshots (4.2.30 regression) * ExtPack: don't fail if the TMP directory contains non-latin1 characters (bug #14159) * Main: implemented dedicated event processing queue * Linux hosts: fixed a bug which made the netfilter driver ignore certain events (bug #12264) Also included from Version bump to 4.2.30 bnc#935900 CVE-2015-3456: * Various small fixes here and there - Fix the multiinstall on kernel modules to avoid conflicts bnc#925663 - Drop smap.diff fails to apply to the latest release Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-550=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-550=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-virtualbox-4.3.30-17.1 python-virtualbox-debuginfo-4.3.30-17.1 virtualbox-4.3.30-17.1 virtualbox-debuginfo-4.3.30-17.1 virtualbox-debugsource-4.3.30-17.1 virtualbox-devel-4.3.30-17.1 virtualbox-guest-kmp-default-4.3.30_k3.16.7_21-17.1 virtualbox-guest-kmp-default-debuginfo-4.3.30_k3.16.7_21-17.1 virtualbox-guest-kmp-desktop-4.3.30_k3.16.7_21-17.1 virtualbox-guest-kmp-desktop-debuginfo-4.3.30_k3.16.7_21-17.1 virtualbox-guest-tools-4.3.30-17.1 virtualbox-guest-tools-debuginfo-4.3.30-17.1 virtualbox-guest-x11-4.3.30-17.1 virtualbox-guest-x11-debuginfo-4.3.30-17.1 virtualbox-host-kmp-default-4.3.30_k3.16.7_21-17.1 virtualbox-host-kmp-default-debuginfo-4.3.30_k3.16.7_21-17.1 virtualbox-host-kmp-desktop-4.3.30_k3.16.7_21-17.1 virtualbox-host-kmp-desktop-debuginfo-4.3.30_k3.16.7_21-17.1 virtualbox-qt-4.3.30-17.1 virtualbox-qt-debuginfo-4.3.30-17.1 virtualbox-websrv-4.3.30-17.1 virtualbox-websrv-debuginfo-4.3.30-17.1 - openSUSE 13.2 (noarch): virtualbox-guest-desktop-icons-4.3.30-17.1 virtualbox-host-source-4.3.30-17.1 - openSUSE 13.2 (i586): virtualbox-guest-kmp-pae-4.3.30_k3.16.7_21-17.1 virtualbox-guest-kmp-pae-debuginfo-4.3.30_k3.16.7_21-17.1 virtualbox-host-kmp-pae-4.3.30_k3.16.7_21-17.1 virtualbox-host-kmp-pae-debuginfo-4.3.30_k3.16.7_21-17.1 - openSUSE 13.1 (i586 x86_64): python-virtualbox-4.2.32-2.35.1 python-virtualbox-debuginfo-4.2.32-2.35.1 virtualbox-4.2.32-2.35.1 virtualbox-debuginfo-4.2.32-2.35.1 virtualbox-debugsource-4.2.32-2.35.1 virtualbox-devel-4.2.32-2.35.1 virtualbox-guest-kmp-default-4.2.32_k3.11.10_29-2.35.1 virtualbox-guest-kmp-default-debuginfo-4.2.32_k3.11.10_29-2.35.1 virtualbox-guest-kmp-desktop-4.2.32_k3.11.10_29-2.35.1 virtualbox-guest-kmp-desktop-debuginfo-4.2.32_k3.11.10_29-2.35.1 virtualbox-guest-tools-4.2.32-2.35.1 virtualbox-guest-tools-debuginfo-4.2.32-2.35.1 virtualbox-guest-x11-4.2.32-2.35.1 virtualbox-guest-x11-debuginfo-4.2.32-2.35.1 virtualbox-host-kmp-default-4.2.32_k3.11.10_29-2.35.1 virtualbox-host-kmp-default-debuginfo-4.2.32_k3.11.10_29-2.35.1 virtualbox-host-kmp-desktop-4.2.32_k3.11.10_29-2.35.1 virtualbox-host-kmp-desktop-debuginfo-4.2.32_k3.11.10_29-2.35.1 virtualbox-qt-4.2.32-2.35.1 virtualbox-qt-debuginfo-4.2.32-2.35.1 virtualbox-websrv-4.2.32-2.35.1 virtualbox-websrv-debuginfo-4.2.32-2.35.1 - openSUSE 13.1 (noarch): virtualbox-host-source-4.2.32-2.35.1 - openSUSE 13.1 (i586): virtualbox-guest-kmp-pae-4.2.32_k3.11.10_29-2.35.1 virtualbox-guest-kmp-pae-debuginfo-4.2.32_k3.11.10_29-2.35.1 virtualbox-host-kmp-pae-4.2.32_k3.11.10_29-2.35.1 virtualbox-host-kmp-pae-debuginfo-4.2.32_k3.11.10_29-2.35.1 References: https://www.suse.com/security/cve/CVE-2015-2594.html https://www.suse.com/security/cve/CVE-2015-3456.html https://bugzilla.suse.com/925663 https://bugzilla.suse.com/935900 https://bugzilla.suse.com/938408

1 0

openSUSE-SU-2015:1391-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 14 Aug '15

14 Aug '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1391-1 Rating: critical References: #941239 Cross-References: CVE-2015-3107 CVE-2015-5124 CVE-2015-5125 CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 Affected Products: openSUSE 13.2:NonFree ______________________________________________________________________________ An update that fixes 34 vulnerabilities is now available. Description: - Security update to 11.2.202.508 (bsc#941239): * APSB15-19: CVE-2015-3107, CVE-2015-5124, CVE-2015-5125, CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-546=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.508-2.67.1 flash-player-gnome-11.2.202.508-2.67.1 flash-player-kde4-11.2.202.508-2.67.1 References: https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-5124.html https://www.suse.com/security/cve/CVE-2015-5125.html https://www.suse.com/security/cve/CVE-2015-5127.html https://www.suse.com/security/cve/CVE-2015-5128.html https://www.suse.com/security/cve/CVE-2015-5129.html https://www.suse.com/security/cve/CVE-2015-5130.html https://www.suse.com/security/cve/CVE-2015-5131.html https://www.suse.com/security/cve/CVE-2015-5132.html https://www.suse.com/security/cve/CVE-2015-5133.html https://www.suse.com/security/cve/CVE-2015-5134.html https://www.suse.com/security/cve/CVE-2015-5539.html https://www.suse.com/security/cve/CVE-2015-5540.html https://www.suse.com/security/cve/CVE-2015-5541.html https://www.suse.com/security/cve/CVE-2015-5544.html https://www.suse.com/security/cve/CVE-2015-5545.html https://www.suse.com/security/cve/CVE-2015-5546.html https://www.suse.com/security/cve/CVE-2015-5547.html https://www.suse.com/security/cve/CVE-2015-5548.html https://www.suse.com/security/cve/CVE-2015-5549.html https://www.suse.com/security/cve/CVE-2015-5550.html https://www.suse.com/security/cve/CVE-2015-5551.html https://www.suse.com/security/cve/CVE-2015-5552.html https://www.suse.com/security/cve/CVE-2015-5553.html https://www.suse.com/security/cve/CVE-2015-5554.html https://www.suse.com/security/cve/CVE-2015-5555.html https://www.suse.com/security/cve/CVE-2015-5556.html https://www.suse.com/security/cve/CVE-2015-5557.html https://www.suse.com/security/cve/CVE-2015-5558.html https://www.suse.com/security/cve/CVE-2015-5559.html https://www.suse.com/security/cve/CVE-2015-5560.html https://www.suse.com/security/cve/CVE-2015-5561.html https://www.suse.com/security/cve/CVE-2015-5562.html https://www.suse.com/security/cve/CVE-2015-5563.html https://bugzilla.suse.com/941239

1 0

openSUSE-SU-2015:1390-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 14 Aug '15

14 Aug '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1390-1 Rating: important References: #940806 #940918 Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 CVE-2015-4495 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: - update to Firefox 40.0 (bnc#940806) * Added protection against unwanted software downloads * Suggested Tiles show sites of interest, based on categories from your recent browsing history * Hello allows adding a link to conversations to provide context on what the conversation will be about * New style for add-on manager based on the in-content preferences style * Improved scrolling, graphics, and video playback performance with off main thread compositing (GNU/Linux only) * Graphic blocklist mechanism improved: Firefox version ranges can be specified, limiting the number of devices blocked security fixes: * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety hazards * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues in libstagefright * MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting through Mozilla Maintenance Service with hard links (only affected Windows) * MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with Updater and malicious MAR file (does not affect openSUSE RPM packages which do not ship the updater) * MFSA 2015-86/CVE-2015-4483 (bmo#1148732) Feed protocol with POST bypasses mixed content protections * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection * MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers - added mozilla-no-stdcxx-check.patch - removed obsolete patches * mozilla-add-glibcxx_use_cxx11_abi.patch * firefox-multilocale-chrome.patch - rebased patches - requires version 40 of the branding package - removed browser/searchplugins/ location as it's not valid anymore - includes security update to Firefox 39.0.3 (bnc#940918) * MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058) Same origin violation and local file stealing via PDF reader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-547=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-40.0-82.1 MozillaFirefox-branding-openSUSE-40-2.3.1 MozillaFirefox-branding-upstream-40.0-82.1 MozillaFirefox-buildsymbols-40.0-82.1 MozillaFirefox-debuginfo-40.0-82.1 MozillaFirefox-debugsource-40.0-82.1 MozillaFirefox-devel-40.0-82.1 MozillaFirefox-translations-common-40.0-82.1 MozillaFirefox-translations-other-40.0-82.1 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4474.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4480.html https://www.suse.com/security/cve/CVE-2015-4481.html https://www.suse.com/security/cve/CVE-2015-4482.html https://www.suse.com/security/cve/CVE-2015-4483.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4490.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4493.html https://www.suse.com/security/cve/CVE-2015-4495.html https://bugzilla.suse.com/940806 https://bugzilla.suse.com/940918

1 0

openSUSE-SU-2015:1389-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 14 Aug '15

14 Aug '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1389-1 Rating: important References: #940806 #940918 Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 CVE-2015-4495 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: - update to Firefox 40.0 (bnc#940806) * Added protection against unwanted software downloads * Suggested Tiles show sites of interest, based on categories from your recent browsing history * Hello allows adding a link to conversations to provide context on what the conversation will be about * New style for add-on manager based on the in-content preferences style * Improved scrolling, graphics, and video playback performance with off main thread compositing (GNU/Linux only) * Graphic blocklist mechanism improved: Firefox version ranges can be specified, limiting the number of devices blocked security fixes: * MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 Miscellaneous memory safety hazards * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues in libstagefright * MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting through Mozilla Maintenance Service with hard links (only affected Windows) * MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with Updater and malicious MAR file (does not affect openSUSE RPM packages which do not ship the updater) * MFSA 2015-86/CVE-2015-4483 (bmo#1148732) Feed protocol with POST bypasses mixed content protections * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection * MFSA 2015-91/CVE-2015-4490 (bmo#1086999) Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers - added mozilla-no-stdcxx-check.patch - removed obsolete patches * mozilla-add-glibcxx_use_cxx11_abi.patch * firefox-multilocale-chrome.patch - rebased patches - requires version 40 of the branding package - removed browser/searchplugins/ location as it's not valid anymore - includes security update to Firefox 39.0.3 (bnc#940918) * MFSA 2015-78/CVE-2015-4495 (bmo#1179262, bmo#1178058) Same origin violation and local file stealing via PDF reader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-548=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-40.0-38.1 MozillaFirefox-branding-openSUSE-40-4.3.1 MozillaFirefox-branding-upstream-40.0-38.1 MozillaFirefox-buildsymbols-40.0-38.1 MozillaFirefox-debuginfo-40.0-38.1 MozillaFirefox-debugsource-40.0-38.1 MozillaFirefox-devel-40.0-38.1 MozillaFirefox-translations-common-40.0-38.1 MozillaFirefox-translations-other-40.0-38.1 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4474.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4480.html https://www.suse.com/security/cve/CVE-2015-4481.html https://www.suse.com/security/cve/CVE-2015-4482.html https://www.suse.com/security/cve/CVE-2015-4483.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4490.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4493.html https://www.suse.com/security/cve/CVE-2015-4495.html https://bugzilla.suse.com/940806 https://bugzilla.suse.com/940918

1 0

openSUSE-SU-2015:1388-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 14 Aug '15

14 Aug '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1388-1 Rating: critical References: #941239 Cross-References: CVE-2015-3107 CVE-2015-5124 CVE-2015-5125 CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 Affected Products: openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 34 vulnerabilities is now available. Description: Security update to 11.2.202.508 (bsc#941239): * APSB15-19: CVE-2015-3107, CVE-2015-5124, CVE-2015-5125, CVE-2015-5127, CVE-2015-5128, CVE-2015-5129, CVE-2015-5130, CVE-2015-5131, CVE-2015-5132, CVE-2015-5133, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5541, CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5550, CVE-2015-5551, CVE-2015-5552, CVE-2015-5553, CVE-2015-5554, CVE-2015-5555, CVE-2015-5556, CVE-2015-5557, CVE-2015-5558, CVE-2015-5559, CVE-2015-5560, CVE-2015-5561, CVE-2015-5562, CVE-2015-5563 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-545=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.508-132.1 flash-player-gnome-11.2.202.508-132.1 flash-player-kde4-11.2.202.508-132.1 References: https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-5124.html https://www.suse.com/security/cve/CVE-2015-5125.html https://www.suse.com/security/cve/CVE-2015-5127.html https://www.suse.com/security/cve/CVE-2015-5128.html https://www.suse.com/security/cve/CVE-2015-5129.html https://www.suse.com/security/cve/CVE-2015-5130.html https://www.suse.com/security/cve/CVE-2015-5131.html https://www.suse.com/security/cve/CVE-2015-5132.html https://www.suse.com/security/cve/CVE-2015-5133.html https://www.suse.com/security/cve/CVE-2015-5134.html https://www.suse.com/security/cve/CVE-2015-5539.html https://www.suse.com/security/cve/CVE-2015-5540.html https://www.suse.com/security/cve/CVE-2015-5541.html https://www.suse.com/security/cve/CVE-2015-5544.html https://www.suse.com/security/cve/CVE-2015-5545.html https://www.suse.com/security/cve/CVE-2015-5546.html https://www.suse.com/security/cve/CVE-2015-5547.html https://www.suse.com/security/cve/CVE-2015-5548.html https://www.suse.com/security/cve/CVE-2015-5549.html https://www.suse.com/security/cve/CVE-2015-5550.html https://www.suse.com/security/cve/CVE-2015-5551.html https://www.suse.com/security/cve/CVE-2015-5552.html https://www.suse.com/security/cve/CVE-2015-5553.html https://www.suse.com/security/cve/CVE-2015-5554.html https://www.suse.com/security/cve/CVE-2015-5555.html https://www.suse.com/security/cve/CVE-2015-5556.html https://www.suse.com/security/cve/CVE-2015-5557.html https://www.suse.com/security/cve/CVE-2015-5558.html https://www.suse.com/security/cve/CVE-2015-5559.html https://www.suse.com/security/cve/CVE-2015-5560.html https://www.suse.com/security/cve/CVE-2015-5561.html https://www.suse.com/security/cve/CVE-2015-5562.html https://www.suse.com/security/cve/CVE-2015-5563.html https://bugzilla.suse.com/941239

1 0