June 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1686-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1686-1 Rating: important References: #961935 #963806 #963810 #970287 #970295 #980904 Cross-References: CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598 CVE-2016-0600 CVE-2016-0606 CVE-2016-0608 CVE-2016-0609 CVE-2016-0616 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0651 CVE-2016-0655 CVE-2016-0666 CVE-2016-0668 CVE-2016-2047 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: mariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed: - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com (bsc#963806). These non-security issues were fixed: - bsc#961935: Remove the leftovers of "openSUSE" string in the '-DWITH_COMMENT' and 'DCOMPILATION_COMMENT' options - bsc#970287: remove ha_tokudb.so plugin and tokuft_logprint and tokuftdump binaries as TokuDB storage engine requires the jemalloc library that isn't present in SLE-12-SP1 - bsc#970295: Fix the leftovers of "logrotate.d/mysql" string in the logrotate error message. Occurrences of this string were changed to "logrotate.d/mariadb" - bsc#963810: Add 'log-error' and 'secure-file-priv' configuration options * add '/etc/my.cnf.d/error_log.conf' that specifies 'log-error = /var/log/mysql/mysqld.log'. If no path is set, the error log is written to '/var/lib/mysql/$HOSTNAME.err', which is not picked up by logrotate. * add '/etc/my.cnf.d/secure_file_priv.conf' which specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD FILE()' will only work with files in the directory specified by 'secure-file-priv' option (='/var/lib/mysql-files'). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-780=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysqlclient-devel-10.0.25-6.1 libmysqlclient18-10.0.25-6.1 libmysqlclient18-debuginfo-10.0.25-6.1 libmysqlclient_r18-10.0.25-6.1 libmysqld-devel-10.0.25-6.1 libmysqld18-10.0.25-6.1 libmysqld18-debuginfo-10.0.25-6.1 mariadb-10.0.25-6.1 mariadb-bench-10.0.25-6.1 mariadb-bench-debuginfo-10.0.25-6.1 mariadb-client-10.0.25-6.1 mariadb-client-debuginfo-10.0.25-6.1 mariadb-debuginfo-10.0.25-6.1 mariadb-debugsource-10.0.25-6.1 mariadb-errormessages-10.0.25-6.1 mariadb-test-10.0.25-6.1 mariadb-test-debuginfo-10.0.25-6.1 mariadb-tools-10.0.25-6.1 mariadb-tools-debuginfo-10.0.25-6.1 - openSUSE Leap 42.1 (x86_64): libmysqlclient18-32bit-10.0.25-6.1 libmysqlclient18-debuginfo-32bit-10.0.25-6.1 libmysqlclient_r18-32bit-10.0.25-6.1 References: https://www.suse.com/security/cve/CVE-2016-0505.html https://www.suse.com/security/cve/CVE-2016-0546.html https://www.suse.com/security/cve/CVE-2016-0596.html https://www.suse.com/security/cve/CVE-2016-0597.html https://www.suse.com/security/cve/CVE-2016-0598.html https://www.suse.com/security/cve/CVE-2016-0600.html https://www.suse.com/security/cve/CVE-2016-0606.html https://www.suse.com/security/cve/CVE-2016-0608.html https://www.suse.com/security/cve/CVE-2016-0609.html https://www.suse.com/security/cve/CVE-2016-0616.html https://www.suse.com/security/cve/CVE-2016-0640.html https://www.suse.com/security/cve/CVE-2016-0641.html https://www.suse.com/security/cve/CVE-2016-0642.html https://www.suse.com/security/cve/CVE-2016-0643.html https://www.suse.com/security/cve/CVE-2016-0644.html https://www.suse.com/security/cve/CVE-2016-0646.html https://www.suse.com/security/cve/CVE-2016-0647.html https://www.suse.com/security/cve/CVE-2016-0648.html https://www.suse.com/security/cve/CVE-2016-0649.html https://www.suse.com/security/cve/CVE-2016-0650.html https://www.suse.com/security/cve/CVE-2016-0651.html https://www.suse.com/security/cve/CVE-2016-0655.html https://www.suse.com/security/cve/CVE-2016-0666.html https://www.suse.com/security/cve/CVE-2016-0668.html https://www.suse.com/security/cve/CVE-2016-2047.html https://bugzilla.suse.com/961935 https://bugzilla.suse.com/963806 https://bugzilla.suse.com/963810 https://bugzilla.suse.com/970287 https://bugzilla.suse.com/970295 https://bugzilla.suse.com/980904

1 0

openSUSE-SU-2016:1685-1: moderate: Security update for libav
by opensuse-security＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Security Update: Security update for libav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1685-1 Rating: moderate References: #949760 #984487 Cross-References: CVE-2015-5479 CVE-2016-3062 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libav fixes the two following security issues: - CVE-2016-3062: A MP4 memory corruption was fixed that could lead to crashes or code execution. (boo#984487) - CVE-2015-5479: A crash due to a divide by zero was fixed in ff_h263_decode_mba() that could lead to decoder crashes. (boo#949760) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-779=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libav-debugsource-11.4-5.1 libav-tools-11.4-5.1 libav-tools-debuginfo-11.4-5.1 libavcodec-libav-devel-11.4-5.1 libavcodec-libav56-11.4-5.1 libavcodec-libav56-debuginfo-11.4-5.1 libavdevice-libav-devel-11.4-5.1 libavdevice-libav55-11.4-5.1 libavdevice-libav55-debuginfo-11.4-5.1 libavfilter-libav-devel-11.4-5.1 libavfilter-libav5-11.4-5.1 libavfilter-libav5-debuginfo-11.4-5.1 libavformat-libav-devel-11.4-5.1 libavformat-libav56-11.4-5.1 libavformat-libav56-debuginfo-11.4-5.1 libavresample-libav-devel-11.4-5.1 libavresample-libav2-11.4-5.1 libavresample-libav2-debuginfo-11.4-5.1 libavutil-libav-devel-11.4-5.1 libavutil-libav54-11.4-5.1 libavutil-libav54-debuginfo-11.4-5.1 libswscale-libav-devel-11.4-5.1 libswscale-libav3-11.4-5.1 libswscale-libav3-debuginfo-11.4-5.1 References: https://www.suse.com/security/cve/CVE-2015-5479.html https://www.suse.com/security/cve/CVE-2016-3062.html https://bugzilla.suse.com/949760 https://bugzilla.suse.com/984487

1 0

openSUSE-RU-2016:1684-1: Recommended update for clamav-database
by maintenance＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1684-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh June 20th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-775=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201606200004-113.1 References:

1 0

openSUSE-SU-2016:1683-1: moderate: Security update for libtorrent-rasterbar
by opensuse-security＠opensuse.org 26 Jun '16

26 Jun '16

openSUSE Security Update: Security update for libtorrent-rasterbar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1683-1 Rating: moderate References: #983228 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libtorrent-rasterbar fixes the following issues: - CVE-2016-5301: Crash on invalid input in http_parser could have allowed a remote attacker to perform a denial of service attack (boo#983228). In addition, the package was updated to 1.0.9 / 1.16.19, fixing various upstream bugs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-774=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libtorrent-rasterbar-debugsource-0.16.17-2.5.1 libtorrent-rasterbar-devel-0.16.17-2.5.1 libtorrent-rasterbar-doc-0.16.17-2.5.1 libtorrent-rasterbar7-0.16.17-2.5.1 libtorrent-rasterbar7-debuginfo-0.16.17-2.5.1 python-libtorrent-rasterbar-0.16.17-2.5.1 python-libtorrent-rasterbar-debuginfo-0.16.17-2.5.1 References: https://bugzilla.suse.com/983228

1 0

openSUSE-SU-2016:1679-1: Security update for libarchive
by opensuse-security＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1679-1 Rating: low References: #984990 Cross-References: CVE-2016-4809 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libarchive was updated to fix one security issue. This security issue was fixed: - CVE-2016-4809: Memory allocation error with gigantic symbolic links in cpio archives (bsc#984990). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-770=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bsdtar-3.1.2-7.11.1 bsdtar-debuginfo-3.1.2-7.11.1 libarchive-debugsource-3.1.2-7.11.1 libarchive-devel-3.1.2-7.11.1 libarchive13-3.1.2-7.11.1 libarchive13-debuginfo-3.1.2-7.11.1 - openSUSE 13.2 (x86_64): libarchive13-32bit-3.1.2-7.11.1 libarchive13-debuginfo-32bit-3.1.2-7.11.1 References: https://www.suse.com/security/cve/CVE-2016-4809.html https://bugzilla.suse.com/984990

1 0

openSUSE-RU-2016:1678-1: Recommended update for python-dateutil
by maintenance＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Recommended Update: Recommended update for python-dateutil ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1678-1 Rating: low References: #978730 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides python-dateutil 2.4.2, which brings several fixes and enhancements: - Updated zoneinfo to 2015b. - Fixed issue with parsing of tzstr on Python 2.7.x; tzstr will now be decoded if not a unicode type. - Fix a parser issue where AM and PM tokens were showing up in fuzzy date stamps, triggering inappropriate errors. - Missing function 'setcachsize' removed from zoneinfo __all__ list, fixing an issue with wildcard imports of dateutil.zoneinfo. - Added explicit check for valid hours if AM/PM is specified in parser. - Fix error where parser allowed some invalid dates, overwriting existing hours with the last 2-digit number in the string. - Fix and add test for Python 2.x compatibility with boolean checking of relativedelta objects. - Replaced parse() calls with explicit datetime objects in unit tests unrelated to parser. - Changed private _byxxx from sets to sorted tuples and fixed one currently unreachable bug in _construct_byset. - Additional documentation for parser and rrule. - Formatting fixes to documentation of rrule and README.rst. - Fix an issue with relativedelta and freezegun. - Fix minimal version requirement for python-six. - Many rrule changes and fixes, including defusing some infinite loops. - Changed many aspects of dealing with the zone info file. Instead of a cache, all the zones are loaded to memory, but symbolic links are loaded only once, so not much memory is used. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-767=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-dateutil-2.4.2-14.1 References: https://bugzilla.suse.com/978730

1 0

openSUSE-RU-2016:1677-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1677-1 Rating: moderate References: #955382 #970009 #976627 #977654 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for gcc48 fixes the following issues: - Fix internal compiler error specific to the ppc64le architecture. (bsc#976627) - Fix issue with using gcov and #pragma pack. (bsc#977654) - Fix internal compiler error when building samba on aarch64. (bsc#970009) - Fix HTM built-ins on PowerPC. (bsc#955382) - Build without GRAPHITE where cloog-isl is not available. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-772=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cpp48-4.8.5-21.1 cpp48-debuginfo-4.8.5-21.1 gcc48-4.8.5-21.1 gcc48-ada-4.8.5-21.1 gcc48-ada-debuginfo-4.8.5-21.1 gcc48-c++-4.8.5-21.1 gcc48-c++-debuginfo-4.8.5-21.1 gcc48-debuginfo-4.8.5-21.1 gcc48-debugsource-4.8.5-21.1 gcc48-fortran-4.8.5-21.1 gcc48-fortran-debuginfo-4.8.5-21.1 gcc48-gij-4.8.5-21.1 gcc48-gij-debuginfo-4.8.5-21.1 gcc48-java-4.8.5-21.1 gcc48-java-debuginfo-4.8.5-21.1 gcc48-locale-4.8.5-21.1 gcc48-obj-c++-4.8.5-21.1 gcc48-obj-c++-debuginfo-4.8.5-21.1 gcc48-objc-4.8.5-21.1 gcc48-objc-debuginfo-4.8.5-21.1 gcc48-testresults-4.8.5-21.2 libada48-4.8.5-21.1 libada48-debuginfo-4.8.5-21.1 libasan0-4.8.5-21.1 libasan0-debuginfo-4.8.5-21.1 libatomic1-gcc48-4.8.5-21.1 libatomic1-gcc48-debuginfo-4.8.5-21.1 libffi4-gcc48-4.8.5-21.1 libffi4-gcc48-debuginfo-4.8.5-21.1 libffi48-debugsource-4.8.5-21.1 libffi48-devel-4.8.5-21.1 libgcc_s1-gcc48-4.8.5-21.1 libgcc_s1-gcc48-debuginfo-4.8.5-21.1 libgcj48-4.8.5-21.1 libgcj48-debuginfo-4.8.5-21.1 libgcj48-debugsource-4.8.5-21.1 libgcj48-devel-4.8.5-21.1 libgcj48-devel-debuginfo-4.8.5-21.1 libgcj48-jar-4.8.5-21.1 libgcj_bc1-gcc48-4.8.5-21.1 libgfortran3-gcc48-4.8.5-21.1 libgfortran3-gcc48-debuginfo-4.8.5-21.1 libgomp1-gcc48-4.8.5-21.1 libgomp1-gcc48-debuginfo-4.8.5-21.1 libitm1-gcc48-4.8.5-21.1 libitm1-gcc48-debuginfo-4.8.5-21.1 libobjc4-4.8.5-21.1 libobjc4-debuginfo-4.8.5-21.1 libquadmath0-gcc48-4.8.5-21.1 libquadmath0-gcc48-debuginfo-4.8.5-21.1 libstdc++48-devel-4.8.5-21.1 libstdc++6-gcc48-4.8.5-21.1 libstdc++6-gcc48-debuginfo-4.8.5-21.1 libstdc++6-gcc48-locale-4.8.5-21.1 - openSUSE Leap 42.1 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.5-21.2 cross-armv6hl-gcc48-icecream-backend-4.8.5-21.2 cross-armv7hl-gcc48-icecream-backend-4.8.5-21.2 cross-hppa-gcc48-icecream-backend-4.8.5-21.2 cross-i386-gcc48-icecream-backend-4.8.5-21.2 cross-ia64-gcc48-icecream-backend-4.8.5-21.2 cross-ppc-gcc48-icecream-backend-4.8.5-21.2 cross-ppc64-gcc48-icecream-backend-4.8.5-21.2 cross-ppc64le-gcc48-icecream-backend-4.8.5-21.2 cross-s390-gcc48-icecream-backend-4.8.5-21.2 cross-s390x-gcc48-icecream-backend-4.8.5-21.2 gcc48-32bit-4.8.5-21.1 gcc48-ada-32bit-4.8.5-21.1 gcc48-fortran-32bit-4.8.5-21.1 gcc48-gij-32bit-4.8.5-21.1 gcc48-gij-debuginfo-32bit-4.8.5-21.1 gcc48-objc-32bit-4.8.5-21.1 libada48-32bit-4.8.5-21.1 libada48-32bit-debuginfo-4.8.5-21.1 libasan0-32bit-4.8.5-21.1 libasan0-32bit-debuginfo-4.8.5-21.1 libatomic1-gcc48-32bit-4.8.5-21.1 libatomic1-gcc48-32bit-debuginfo-4.8.5-21.1 libffi4-gcc48-32bit-4.8.5-21.1 libffi4-gcc48-32bit-debuginfo-4.8.5-21.1 libffi48-devel-32bit-4.8.5-21.1 libgcc_s1-gcc48-32bit-4.8.5-21.1 libgcc_s1-gcc48-32bit-debuginfo-4.8.5-21.1 libgcj48-32bit-4.8.5-21.1 libgcj48-debuginfo-32bit-4.8.5-21.1 libgcj48-devel-32bit-4.8.5-21.1 libgcj48-devel-debuginfo-32bit-4.8.5-21.1 libgfortran3-gcc48-32bit-4.8.5-21.1 libgfortran3-gcc48-32bit-debuginfo-4.8.5-21.1 libgomp1-gcc48-32bit-4.8.5-21.1 libgomp1-gcc48-32bit-debuginfo-4.8.5-21.1 libitm1-gcc48-32bit-4.8.5-21.1 libitm1-gcc48-32bit-debuginfo-4.8.5-21.1 libobjc4-32bit-4.8.5-21.1 libobjc4-32bit-debuginfo-4.8.5-21.1 libquadmath0-gcc48-32bit-4.8.5-21.1 libquadmath0-gcc48-32bit-debuginfo-4.8.5-21.1 libstdc++48-devel-32bit-4.8.5-21.1 libstdc++6-gcc48-32bit-4.8.5-21.1 libstdc++6-gcc48-32bit-debuginfo-4.8.5-21.1 libtsan0-gcc48-4.8.5-21.1 libtsan0-gcc48-debuginfo-4.8.5-21.1 - openSUSE Leap 42.1 (noarch): gcc48-info-4.8.5-21.1 libstdc++48-doc-4.8.5-21.1 References: https://bugzilla.suse.com/955382 https://bugzilla.suse.com/970009 https://bugzilla.suse.com/976627 https://bugzilla.suse.com/977654

1 0

openSUSE-RU-2016:1676-1: Recommended update for libcap1
by maintenance＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Recommended Update: Recommended update for libcap1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1676-1 Rating: low References: #982232 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes building of libcap1 with newer versions of glibc. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-765=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libcap1-1.10-63.1 libcap1-debuginfo-1.10-63.1 libcap1-debugsource-1.10-63.1 - openSUSE Leap 42.1 (x86_64): libcap1-32bit-1.10-63.1 libcap1-debuginfo-32bit-1.10-63.1 References: https://bugzilla.suse.com/982232

1 0

openSUSE-SU-2016:1675-1: moderate: Security update for p7zip
by opensuse-security＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Security Update: Security update for p7zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1675-1 Rating: moderate References: #979823 Cross-References: CVE-2016-2335 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for p7zip fixes one security issue. This security issue was fixed: - CVE-2016-2335: UDF CInArchive::ReadFileItem code execution vulnerability (bsc#979823) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-771=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): p7zip-9.20.1-15.1 p7zip-debuginfo-9.20.1-15.1 p7zip-debugsource-9.20.1-15.1 References: https://www.suse.com/security/cve/CVE-2016-2335.html https://bugzilla.suse.com/979823

1 0

openSUSE-SU-2016:1674-1: moderate: Security update for libtasn1
by opensuse-security＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Security Update: Security update for libtasn1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1674-1 Rating: moderate References: #929414 #961491 #982779 Cross-References: CVE-2015-3622 CVE-2016-4008 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libtasn1 fixes the following issues: - Malformed asn1 definitions could have caused a segmentation fault in the asn1 definition parser (bsc#961491) - CVE-2015-3622: Fixed invalid read in octet string decoding (bsc#929414) - CVE-2016-4008: Fixed infinite loop while parsing DER certificates (bsc#982779) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-773=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libtasn1-3.7-12.1 libtasn1-6-3.7-12.1 libtasn1-6-debuginfo-3.7-12.1 libtasn1-debuginfo-3.7-12.1 libtasn1-debugsource-3.7-12.1 libtasn1-devel-3.7-12.1 - openSUSE Leap 42.1 (x86_64): libtasn1-6-32bit-3.7-12.1 libtasn1-6-debuginfo-32bit-3.7-12.1 libtasn1-devel-32bit-3.7-12.1 References: https://www.suse.com/security/cve/CVE-2015-3622.html https://www.suse.com/security/cve/CVE-2016-4008.html https://bugzilla.suse.com/929414 https://bugzilla.suse.com/961491 https://bugzilla.suse.com/982779

1 0