May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:1295-1: Recommended update for clamav-database
by maintenance＠opensuse.org 13 May '16

13 May '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1295-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - database refresh on May 9th This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-582=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201605090001-89.1 References:

1 0

openSUSE-RU-2016:1294-1: Recommended update for the Softwarestack
by maintenance＠opensuse.org 13 May '16

13 May '16

openSUSE Recommended Update: Recommended update for the Softwarestack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1294-1 Rating: low References: #949945 #956480 #967006 #969186 #970575 #971018 #971637 #974275 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for the Softwarestack fixes the following issues: zypper: - Fix testing for '-- download*' options (boo#956480) - versioncmp: Don't check for zypp lock (boo#970575) - man: Rephrase unclear explanation of --non-interactive (boo#969186) - man: add missing --non-interactive-include-reboot-patches option libzypp: - Provide 'libzypp(plugin:services) = 1' after fixing boo#933760 - Fix credential file parser losing entries with known URL but different user name (boo#933760) - RepoManager: allow extraction of multiple baseurls for service repos (boo#964932) - addRepository: fix to use the correct history file for logging - DiskUsageCounter: Limit estimated waste per file (boo#974275) - Filter unwanted btrfs subvolumes (boo#949945) - Use PluginExecutor for commit- and system-hooks (boo#971637) - BuildRequires: libsolv-devel >= 0.6.19 (boo#971018) libsolv: - Better support of complex deps in pool_match_dep and selection_make_matchdeps - Make SOLVER_REASON_CLEANDEPS_ERASE introspection reason work again - Make dep2str use rpm-like output if disttype is rpm - Implement filtering of Requires(pre,post) for installed packages - Simplify handling of pseudo package updates (boo#967006) - Improve speed of rpmmd metadata parsing Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-579=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsolv-debugsource-0.6.20-23.1 libsolv-demo-0.6.20-23.1 libsolv-demo-debuginfo-0.6.20-23.1 libsolv-devel-0.6.20-23.1 libsolv-devel-debuginfo-0.6.20-23.1 libsolv-tools-0.6.20-23.1 libsolv-tools-debuginfo-0.6.20-23.1 libzypp-14.43.0-41.1 libzypp-debuginfo-14.43.0-41.1 libzypp-debugsource-14.43.0-41.1 libzypp-devel-14.43.0-41.1 libzypp-devel-doc-14.43.0-41.1 perl-solv-0.6.20-23.1 perl-solv-debuginfo-0.6.20-23.1 python-solv-0.6.20-23.1 python-solv-debuginfo-0.6.20-23.1 ruby-solv-0.6.20-23.1 ruby-solv-debuginfo-0.6.20-23.1 zypper-1.11.54-40.2 zypper-debuginfo-1.11.54-40.2 zypper-debugsource-1.11.54-40.2 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.54-40.2 zypper-log-1.11.54-40.2 References: https://bugzilla.suse.com/949945 https://bugzilla.suse.com/956480 https://bugzilla.suse.com/967006 https://bugzilla.suse.com/969186 https://bugzilla.suse.com/970575 https://bugzilla.suse.com/971018 https://bugzilla.suse.com/971637 https://bugzilla.suse.com/974275

1 0

openSUSE-SU-2016:1292-1: important: Security update for ntp
by opensuse-security＠opensuse.org 12 May '16

12 May '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1292-1 Rating: important References: #782060 #916617 #937837 #951559 #951629 #956773 #962318 #962784 #962802 #962960 #962966 #962970 #962988 #962994 #962995 #962997 #963000 #963002 #975496 #975981 Cross-References: CVE-2015-5300 CVE-2015-7973 CVE-2015-7974 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8138 CVE-2015-8139 CVE-2015-8140 CVE-2015-8158 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 8 fixes is now available. Description: ntp was updated to version 4.2.8p6 to fix 12 security issues. Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837) These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966). - CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002). - CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784). - CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000). - CVE-2015-7977: reslist NULL pointer dereference (bsc#962970). - CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802). - CVE-2015-7975: nextvar() missing length check (bsc#962988). - CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960). - CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995). - CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994). - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997). - CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629). These non-security issues were fixed: - fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive. - bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail. - bsc#782060: Speedup ntpq. - bsc#916617: Add /var/db/ntp-kod. - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems. - bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST. - Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-578=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p6-15.1 ntp-debuginfo-4.2.8p6-15.1 ntp-debugsource-4.2.8p6-15.1 ntp-doc-4.2.8p6-15.1 - openSUSE Leap 42.1 (noarch): yast2-ntp-client-3.1.22-6.1 yast2-ntp-client-devel-doc-3.1.22-6.1 References: https://www.suse.com/security/cve/CVE-2015-5300.html https://www.suse.com/security/cve/CVE-2015-7973.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2015-7975.html https://www.suse.com/security/cve/CVE-2015-7976.html https://www.suse.com/security/cve/CVE-2015-7977.html https://www.suse.com/security/cve/CVE-2015-7978.html https://www.suse.com/security/cve/CVE-2015-7979.html https://www.suse.com/security/cve/CVE-2015-8138.html https://www.suse.com/security/cve/CVE-2015-8139.html https://www.suse.com/security/cve/CVE-2015-8140.html https://www.suse.com/security/cve/CVE-2015-8158.html https://bugzilla.suse.com/782060 https://bugzilla.suse.com/916617 https://bugzilla.suse.com/937837 https://bugzilla.suse.com/951559 https://bugzilla.suse.com/951629 https://bugzilla.suse.com/956773 https://bugzilla.suse.com/962318 https://bugzilla.suse.com/962784 https://bugzilla.suse.com/962802 https://bugzilla.suse.com/962960 https://bugzilla.suse.com/962966 https://bugzilla.suse.com/962970 https://bugzilla.suse.com/962988 https://bugzilla.suse.com/962994 https://bugzilla.suse.com/962995 https://bugzilla.suse.com/962997 https://bugzilla.suse.com/963000 https://bugzilla.suse.com/963002 https://bugzilla.suse.com/975496 https://bugzilla.suse.com/975981

1 0

openSUSE-RU-2016:1282-1: Recommended update for mosh
by maintenance＠opensuse.org 11 May '16

11 May '16

openSUSE Recommended Update: Recommended update for mosh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1282-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for mosh provides version 1.2.5 and fixes the following issues: - Bind to a specific IP address with --bind-server. - MOSH_ESCAPE_KEY configures escape character. - Support non-roaming IPv6. - Implement XTerm mouse mode. - Report Git revision along with version if available. - Add pselect() emulation. - ARM Neon: fix gcc4.8 compiling problem. - NaCl: Conditionally rename main to mosh_main. - Debian: Improve bash-completion install and functionality. - Automake/autoconf workarounds. - mosh-server: Allow startup without PTY. - network.cc: Properly close old fd on Socket assignment operator. - mosh-server: Allow startup with zero-window-size PTY. - AddrInfo: Fix error message generation when node == NULL. - Timestamp: Prevent integer overflow on Darwin PPC 32-bit. - scripts/mosh: Fix hang when remote closes the connection. - Fix issues with parsing of 256-color SGR sequences. - Numerous code hygiene, Coverity, and Clang static analyzer fixes. - Remove mosh-1.2.4-ipv6.patch: merged upstream. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-577=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): mosh-1.2.5-5.1 References:

1 0

openSUSE-SU-2016:1274-1: important: Security update for php5
by opensuse-security＠opensuse.org 11 May '16

11 May '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1274-1 Rating: important References: #976775 #976996 #976997 #977000 #977003 #977005 Cross-References: CVE-2015-8866 CVE-2015-8867 CVE-2016-3074 CVE-2016-4070 CVE-2016-4071 CVE-2016-4073 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mb_strcut() (bsc#977003) - CVE-2016-3074: Signedness vulnerability in bundled libgd may have resulted in a heap overflow when processing compressed gd2 data. (boo#976775) - CVE-2015-8867: The PHP function openssl_random_pseudo_bytes() did not return cryptographically secure random bytes (bsc#977005) - CVE-2016-4070: The libxml_disable_entity_loader() setting was shared between threads, which could have resulted in XML external entity injection and entity expansion issues (bsc#976997) - CVE-2015-8866: A remote attacker could have caused denial of service due to incorrect handling of large strings in php_raw_url_encode() (bsc#976996) - CVE-2016-4071: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string formatting in php_snmp_error() (bsc#977000) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-576=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-57.1 apache2-mod_php5-debuginfo-5.6.1-57.1 php5-5.6.1-57.1 php5-bcmath-5.6.1-57.1 php5-bcmath-debuginfo-5.6.1-57.1 php5-bz2-5.6.1-57.1 php5-bz2-debuginfo-5.6.1-57.1 php5-calendar-5.6.1-57.1 php5-calendar-debuginfo-5.6.1-57.1 php5-ctype-5.6.1-57.1 php5-ctype-debuginfo-5.6.1-57.1 php5-curl-5.6.1-57.1 php5-curl-debuginfo-5.6.1-57.1 php5-dba-5.6.1-57.1 php5-dba-debuginfo-5.6.1-57.1 php5-debuginfo-5.6.1-57.1 php5-debugsource-5.6.1-57.1 php5-devel-5.6.1-57.1 php5-dom-5.6.1-57.1 php5-dom-debuginfo-5.6.1-57.1 php5-enchant-5.6.1-57.1 php5-enchant-debuginfo-5.6.1-57.1 php5-exif-5.6.1-57.1 php5-exif-debuginfo-5.6.1-57.1 php5-fastcgi-5.6.1-57.1 php5-fastcgi-debuginfo-5.6.1-57.1 php5-fileinfo-5.6.1-57.1 php5-fileinfo-debuginfo-5.6.1-57.1 php5-firebird-5.6.1-57.1 php5-firebird-debuginfo-5.6.1-57.1 php5-fpm-5.6.1-57.1 php5-fpm-debuginfo-5.6.1-57.1 php5-ftp-5.6.1-57.1 php5-ftp-debuginfo-5.6.1-57.1 php5-gd-5.6.1-57.1 php5-gd-debuginfo-5.6.1-57.1 php5-gettext-5.6.1-57.1 php5-gettext-debuginfo-5.6.1-57.1 php5-gmp-5.6.1-57.1 php5-gmp-debuginfo-5.6.1-57.1 php5-iconv-5.6.1-57.1 php5-iconv-debuginfo-5.6.1-57.1 php5-imap-5.6.1-57.1 php5-imap-debuginfo-5.6.1-57.1 php5-intl-5.6.1-57.1 php5-intl-debuginfo-5.6.1-57.1 php5-json-5.6.1-57.1 php5-json-debuginfo-5.6.1-57.1 php5-ldap-5.6.1-57.1 php5-ldap-debuginfo-5.6.1-57.1 php5-mbstring-5.6.1-57.1 php5-mbstring-debuginfo-5.6.1-57.1 php5-mcrypt-5.6.1-57.1 php5-mcrypt-debuginfo-5.6.1-57.1 php5-mssql-5.6.1-57.1 php5-mssql-debuginfo-5.6.1-57.1 php5-mysql-5.6.1-57.1 php5-mysql-debuginfo-5.6.1-57.1 php5-odbc-5.6.1-57.1 php5-odbc-debuginfo-5.6.1-57.1 php5-opcache-5.6.1-57.1 php5-opcache-debuginfo-5.6.1-57.1 php5-openssl-5.6.1-57.1 php5-openssl-debuginfo-5.6.1-57.1 php5-pcntl-5.6.1-57.1 php5-pcntl-debuginfo-5.6.1-57.1 php5-pdo-5.6.1-57.1 php5-pdo-debuginfo-5.6.1-57.1 php5-pgsql-5.6.1-57.1 php5-pgsql-debuginfo-5.6.1-57.1 php5-phar-5.6.1-57.1 php5-phar-debuginfo-5.6.1-57.1 php5-posix-5.6.1-57.1 php5-posix-debuginfo-5.6.1-57.1 php5-pspell-5.6.1-57.1 php5-pspell-debuginfo-5.6.1-57.1 php5-readline-5.6.1-57.1 php5-readline-debuginfo-5.6.1-57.1 php5-shmop-5.6.1-57.1 php5-shmop-debuginfo-5.6.1-57.1 php5-snmp-5.6.1-57.1 php5-snmp-debuginfo-5.6.1-57.1 php5-soap-5.6.1-57.1 php5-soap-debuginfo-5.6.1-57.1 php5-sockets-5.6.1-57.1 php5-sockets-debuginfo-5.6.1-57.1 php5-sqlite-5.6.1-57.1 php5-sqlite-debuginfo-5.6.1-57.1 php5-suhosin-5.6.1-57.1 php5-suhosin-debuginfo-5.6.1-57.1 php5-sysvmsg-5.6.1-57.1 php5-sysvmsg-debuginfo-5.6.1-57.1 php5-sysvsem-5.6.1-57.1 php5-sysvsem-debuginfo-5.6.1-57.1 php5-sysvshm-5.6.1-57.1 php5-sysvshm-debuginfo-5.6.1-57.1 php5-tidy-5.6.1-57.1 php5-tidy-debuginfo-5.6.1-57.1 php5-tokenizer-5.6.1-57.1 php5-tokenizer-debuginfo-5.6.1-57.1 php5-wddx-5.6.1-57.1 php5-wddx-debuginfo-5.6.1-57.1 php5-xmlreader-5.6.1-57.1 php5-xmlreader-debuginfo-5.6.1-57.1 php5-xmlrpc-5.6.1-57.1 php5-xmlrpc-debuginfo-5.6.1-57.1 php5-xmlwriter-5.6.1-57.1 php5-xmlwriter-debuginfo-5.6.1-57.1 php5-xsl-5.6.1-57.1 php5-xsl-debuginfo-5.6.1-57.1 php5-zip-5.6.1-57.1 php5-zip-debuginfo-5.6.1-57.1 php5-zlib-5.6.1-57.1 php5-zlib-debuginfo-5.6.1-57.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-57.1 References: https://www.suse.com/security/cve/CVE-2015-8866.html https://www.suse.com/security/cve/CVE-2015-8867.html https://www.suse.com/security/cve/CVE-2016-3074.html https://www.suse.com/security/cve/CVE-2016-4070.html https://www.suse.com/security/cve/CVE-2016-4071.html https://www.suse.com/security/cve/CVE-2016-4073.html https://bugzilla.suse.com/976775 https://bugzilla.suse.com/976996 https://bugzilla.suse.com/976997 https://bugzilla.suse.com/977000 https://bugzilla.suse.com/977003 https://bugzilla.suse.com/977005

1 0

openSUSE-SU-2016:1273-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 10 May '16

10 May '16

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1273-1 Rating: important References: #889013 #968050 #976942 #976943 #977614 #977615 #977617 Cross-References: CVE-2016-0702 CVE-2016-2105 CVE-2016-2106 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for compat-openssl098 fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - CVE-2016-0702: Side channel attack on modular exponentiation "CacheBleed" (bsc#968050) - bsc#976943: Buffer overrun in ASN1_parse The following non-security bugs were fixed: - bsc#889013: Rename README.SuSE to the new spelling (bsc#889013) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-575=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-12.2 libopenssl0_9_8-0.9.8j-12.2 libopenssl0_9_8-debuginfo-0.9.8j-12.2 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-12.2 libopenssl0_9_8-debuginfo-32bit-0.9.8j-12.2 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/889013 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977617

1 0

openSUSE-SU-2016:1266-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1266-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: - Several coders were vulnerable to remote code execution attacks, these coders have now been disabled by default but can be re-enabled by editing "/etc/ImageMagick-*/policy.xml" (bsc#978061) - CVE-2016-3714: Insufficient shell characters filtering leads to (potentially remote) code execution - CVE-2016-3715: Possible file deletion by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. - CVE-2016-3716: Possible file moving by using ImageMagick's 'msl' pseudo protocol with any extension in any folder. - CVE-2016-3717: Possible local file read by using ImageMagick's 'label' pseudo protocol to get content of the files from the server. - CVE-2016-3718: Possible Server Side Request Forgery (SSRF) to make HTTP GET or FTP request. Bugs fixed: - Use external svg loader (rsvg) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-574=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-9.1 ImageMagick-debuginfo-6.8.8.1-9.1 ImageMagick-debugsource-6.8.8.1-9.1 ImageMagick-devel-6.8.8.1-9.1 ImageMagick-extra-6.8.8.1-9.1 ImageMagick-extra-debuginfo-6.8.8.1-9.1 libMagick++-6_Q16-3-6.8.8.1-9.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-9.1 libMagick++-devel-6.8.8.1-9.1 libMagickCore-6_Q16-1-6.8.8.1-9.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-9.1 libMagickWand-6_Q16-1-6.8.8.1-9.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-9.1 perl-PerlMagick-6.8.8.1-9.1 perl-PerlMagick-debuginfo-6.8.8.1-9.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-9.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-9.1 libMagick++-6_Q16-3-32bit-6.8.8.1-9.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-9.1 libMagick++-devel-32bit-6.8.8.1-9.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-9.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-9.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-9.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3716.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061

1 0

openSUSE-SU-2016:1265-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1265-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-573=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.101-31.1 java-1_7_0-openjdk-accessibility-1.7.0.101-31.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-demo-1.7.0.101-31.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-devel-1.7.0.101-31.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-headless-1.7.0.101-31.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-src-1.7.0.101-31.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.101-31.1 - openSUSE Leap 42.1 (x86_64): java-1_7_0-openjdk-bootstrap-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.101-31.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.101-31.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340

1 0

openSUSE-SU-2016:1264-1: moderate: Security update for subversion
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1264-1 Rating: moderate References: #976849 #976850 #977424 Cross-References: CVE-2016-2167 CVE-2016-2168 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for subversion fixes the following issues: - CVE-2016-2167: mod_authz_svn: DoS in MOVE/COPY authorization check (bsc#976849) - CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm (bsc#976850) The following non-security bugs were fixed: - mod_authz_svn: fix authz with mod_auth_kerb/mod_auth_ntlm (boo#977424) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-571=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.16-2.26.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.16-2.26.1 libsvn_auth_kwallet-1-0-1.8.16-2.26.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.16-2.26.1 subversion-1.8.16-2.26.1 subversion-debuginfo-1.8.16-2.26.1 subversion-debugsource-1.8.16-2.26.1 subversion-devel-1.8.16-2.26.1 subversion-perl-1.8.16-2.26.1 subversion-perl-debuginfo-1.8.16-2.26.1 subversion-python-1.8.16-2.26.1 subversion-python-ctypes-1.8.16-2.26.1 subversion-python-debuginfo-1.8.16-2.26.1 subversion-ruby-1.8.16-2.26.1 subversion-ruby-debuginfo-1.8.16-2.26.1 subversion-server-1.8.16-2.26.1 subversion-server-debuginfo-1.8.16-2.26.1 subversion-tools-1.8.16-2.26.1 subversion-tools-debuginfo-1.8.16-2.26.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.16-2.26.1 References: https://www.suse.com/security/cve/CVE-2016-2167.html https://www.suse.com/security/cve/CVE-2016-2168.html https://bugzilla.suse.com/976849 https://bugzilla.suse.com/976850 https://bugzilla.suse.com/977424

1 0

openSUSE-SU-2016:1263-1: moderate: Security update for subversion
by opensuse-security＠opensuse.org 07 May '16

07 May '16

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1263-1 Rating: moderate References: #911620 #969159 #976849 #976850 Cross-References: CVE-2016-2167 CVE-2016-2168 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for subversion fixes the following issues: - CVE-2016-2167: mod_authz_svn: DoS in MOVE/COPY authorization check (bsc#976849) - CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm (bsc#976850) The following non-security bugs were fixed: - bsc#969159: subversion dependencies did not enforce matching password store - bsc#911620: svnserve could not be started via YaST Service manager This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-570=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): libsvn_auth_gnome_keyring-1-0-1.8.10-9.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.10-9.1 libsvn_auth_kwallet-1-0-1.8.10-9.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.10-9.1 subversion-1.8.10-9.1 subversion-debuginfo-1.8.10-9.1 subversion-debugsource-1.8.10-9.1 subversion-devel-1.8.10-9.1 subversion-perl-1.8.10-9.1 subversion-perl-debuginfo-1.8.10-9.1 subversion-python-1.8.10-9.1 subversion-python-debuginfo-1.8.10-9.1 subversion-ruby-1.8.10-9.1 subversion-ruby-debuginfo-1.8.10-9.1 subversion-server-1.8.10-9.1 subversion-server-debuginfo-1.8.10-9.1 subversion-tools-1.8.10-9.1 subversion-tools-debuginfo-1.8.10-9.1 - openSUSE Leap 42.1 (noarch): subversion-bash-completion-1.8.10-9.1 References: https://www.suse.com/security/cve/CVE-2016-2167.html https://www.suse.com/security/cve/CVE-2016-2168.html https://bugzilla.suse.com/911620 https://bugzilla.suse.com/969159 https://bugzilla.suse.com/976849 https://bugzilla.suse.com/976850

1 0