January 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0245-1: Recommended update for clamav-database
by maintenance＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0245-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - database refresh 2016-01-15 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-95=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201601250000-41.1 References:

1 0

openSUSE-RU-2016:0244-1: moderate: Recommended update for samba
by maintenance＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Recommended Update: Recommended update for samba ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0244-1 Rating: moderate References: #960249 #962177 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for samba fixes the following issues: - Add quotes around path of update-apparmor-samba-profile (boo#962177). - Remove autoconf build-time requirement. - Prevent access denied if the share path is "/" (bso#11647, boo#960249). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-96=1 - openSUSE 13.1: zypper in -t patch openSUSE-2016-96=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libdcerpc-atsvc-devel-4.1.22-26.1 libdcerpc-atsvc0-4.1.22-26.1 libdcerpc-atsvc0-debuginfo-4.1.22-26.1 libdcerpc-binding0-4.1.22-26.1 libdcerpc-binding0-debuginfo-4.1.22-26.1 libdcerpc-devel-4.1.22-26.1 libdcerpc-samr-devel-4.1.22-26.1 libdcerpc-samr0-4.1.22-26.1 libdcerpc-samr0-debuginfo-4.1.22-26.1 libdcerpc0-4.1.22-26.1 libdcerpc0-debuginfo-4.1.22-26.1 libgensec-devel-4.1.22-26.1 libgensec0-4.1.22-26.1 libgensec0-debuginfo-4.1.22-26.1 libndr-devel-4.1.22-26.1 libndr-krb5pac-devel-4.1.22-26.1 libndr-krb5pac0-4.1.22-26.1 libndr-krb5pac0-debuginfo-4.1.22-26.1 libndr-nbt-devel-4.1.22-26.1 libndr-nbt0-4.1.22-26.1 libndr-nbt0-debuginfo-4.1.22-26.1 libndr-standard-devel-4.1.22-26.1 libndr-standard0-4.1.22-26.1 libndr-standard0-debuginfo-4.1.22-26.1 libndr0-4.1.22-26.1 libndr0-debuginfo-4.1.22-26.1 libnetapi-devel-4.1.22-26.1 libnetapi0-4.1.22-26.1 libnetapi0-debuginfo-4.1.22-26.1 libpdb-devel-4.1.22-26.1 libpdb0-4.1.22-26.1 libpdb0-debuginfo-4.1.22-26.1 libregistry-devel-4.1.22-26.1 libregistry0-4.1.22-26.1 libregistry0-debuginfo-4.1.22-26.1 libsamba-credentials-devel-4.1.22-26.1 libsamba-credentials0-4.1.22-26.1 libsamba-credentials0-debuginfo-4.1.22-26.1 libsamba-hostconfig-devel-4.1.22-26.1 libsamba-hostconfig0-4.1.22-26.1 libsamba-hostconfig0-debuginfo-4.1.22-26.1 libsamba-policy-devel-4.1.22-26.1 libsamba-policy0-4.1.22-26.1 libsamba-policy0-debuginfo-4.1.22-26.1 libsamba-util-devel-4.1.22-26.1 libsamba-util0-4.1.22-26.1 libsamba-util0-debuginfo-4.1.22-26.1 libsamdb-devel-4.1.22-26.1 libsamdb0-4.1.22-26.1 libsamdb0-debuginfo-4.1.22-26.1 libsmbclient-devel-4.1.22-26.1 libsmbclient-raw-devel-4.1.22-26.1 libsmbclient-raw0-4.1.22-26.1 libsmbclient-raw0-debuginfo-4.1.22-26.1 libsmbclient0-4.1.22-26.1 libsmbclient0-debuginfo-4.1.22-26.1 libsmbconf-devel-4.1.22-26.1 libsmbconf0-4.1.22-26.1 libsmbconf0-debuginfo-4.1.22-26.1 libsmbldap-devel-4.1.22-26.1 libsmbldap0-4.1.22-26.1 libsmbldap0-debuginfo-4.1.22-26.1 libsmbsharemodes-devel-4.1.22-26.1 libsmbsharemodes0-4.1.22-26.1 libsmbsharemodes0-debuginfo-4.1.22-26.1 libtevent-util-devel-4.1.22-26.1 libtevent-util0-4.1.22-26.1 libtevent-util0-debuginfo-4.1.22-26.1 libwbclient-devel-4.1.22-26.1 libwbclient0-4.1.22-26.1 libwbclient0-debuginfo-4.1.22-26.1 samba-4.1.22-26.1 samba-client-4.1.22-26.1 samba-client-debuginfo-4.1.22-26.1 samba-core-devel-4.1.22-26.1 samba-debuginfo-4.1.22-26.1 samba-debugsource-4.1.22-26.1 samba-libs-4.1.22-26.1 samba-libs-debuginfo-4.1.22-26.1 samba-pidl-4.1.22-26.1 samba-python-4.1.22-26.1 samba-python-debuginfo-4.1.22-26.1 samba-test-4.1.22-26.1 samba-test-debuginfo-4.1.22-26.1 samba-test-devel-4.1.22-26.1 samba-winbind-4.1.22-26.1 samba-winbind-debuginfo-4.1.22-26.1 - openSUSE 13.2 (x86_64): libdcerpc-atsvc0-32bit-4.1.22-26.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.22-26.1 libdcerpc-binding0-32bit-4.1.22-26.1 libdcerpc-binding0-debuginfo-32bit-4.1.22-26.1 libdcerpc-samr0-32bit-4.1.22-26.1 libdcerpc-samr0-debuginfo-32bit-4.1.22-26.1 libdcerpc0-32bit-4.1.22-26.1 libdcerpc0-debuginfo-32bit-4.1.22-26.1 libgensec0-32bit-4.1.22-26.1 libgensec0-debuginfo-32bit-4.1.22-26.1 libndr-krb5pac0-32bit-4.1.22-26.1 libndr-krb5pac0-debuginfo-32bit-4.1.22-26.1 libndr-nbt0-32bit-4.1.22-26.1 libndr-nbt0-debuginfo-32bit-4.1.22-26.1 libndr-standard0-32bit-4.1.22-26.1 libndr-standard0-debuginfo-32bit-4.1.22-26.1 libndr0-32bit-4.1.22-26.1 libndr0-debuginfo-32bit-4.1.22-26.1 libnetapi0-32bit-4.1.22-26.1 libnetapi0-debuginfo-32bit-4.1.22-26.1 libpdb0-32bit-4.1.22-26.1 libpdb0-debuginfo-32bit-4.1.22-26.1 libregistry0-32bit-4.1.22-26.1 libregistry0-debuginfo-32bit-4.1.22-26.1 libsamba-credentials0-32bit-4.1.22-26.1 libsamba-credentials0-debuginfo-32bit-4.1.22-26.1 libsamba-hostconfig0-32bit-4.1.22-26.1 libsamba-hostconfig0-debuginfo-32bit-4.1.22-26.1 libsamba-policy0-32bit-4.1.22-26.1 libsamba-policy0-debuginfo-32bit-4.1.22-26.1 libsamba-util0-32bit-4.1.22-26.1 libsamba-util0-debuginfo-32bit-4.1.22-26.1 libsamdb0-32bit-4.1.22-26.1 libsamdb0-debuginfo-32bit-4.1.22-26.1 libsmbclient-raw0-32bit-4.1.22-26.1 libsmbclient-raw0-debuginfo-32bit-4.1.22-26.1 libsmbclient0-32bit-4.1.22-26.1 libsmbclient0-debuginfo-32bit-4.1.22-26.1 libsmbconf0-32bit-4.1.22-26.1 libsmbconf0-debuginfo-32bit-4.1.22-26.1 libsmbldap0-32bit-4.1.22-26.1 libsmbldap0-debuginfo-32bit-4.1.22-26.1 libtevent-util0-32bit-4.1.22-26.1 libtevent-util0-debuginfo-32bit-4.1.22-26.1 libwbclient0-32bit-4.1.22-26.1 libwbclient0-debuginfo-32bit-4.1.22-26.1 samba-32bit-4.1.22-26.1 samba-client-32bit-4.1.22-26.1 samba-client-debuginfo-32bit-4.1.22-26.1 samba-debuginfo-32bit-4.1.22-26.1 samba-libs-32bit-4.1.22-26.1 samba-libs-debuginfo-32bit-4.1.22-26.1 samba-winbind-32bit-4.1.22-26.1 samba-winbind-debuginfo-32bit-4.1.22-26.1 - openSUSE 13.2 (noarch): samba-doc-4.1.22-26.1 - openSUSE 13.1 (i586 x86_64): libdcerpc-atsvc-devel-4.1.22-3.51.1 libdcerpc-atsvc0-4.1.22-3.51.1 libdcerpc-atsvc0-debuginfo-4.1.22-3.51.1 libdcerpc-binding0-4.1.22-3.51.1 libdcerpc-binding0-debuginfo-4.1.22-3.51.1 libdcerpc-devel-4.1.22-3.51.1 libdcerpc-samr-devel-4.1.22-3.51.1 libdcerpc-samr0-4.1.22-3.51.1 libdcerpc-samr0-debuginfo-4.1.22-3.51.1 libdcerpc0-4.1.22-3.51.1 libdcerpc0-debuginfo-4.1.22-3.51.1 libgensec-devel-4.1.22-3.51.1 libgensec0-4.1.22-3.51.1 libgensec0-debuginfo-4.1.22-3.51.1 libndr-devel-4.1.22-3.51.1 libndr-krb5pac-devel-4.1.22-3.51.1 libndr-krb5pac0-4.1.22-3.51.1 libndr-krb5pac0-debuginfo-4.1.22-3.51.1 libndr-nbt-devel-4.1.22-3.51.1 libndr-nbt0-4.1.22-3.51.1 libndr-nbt0-debuginfo-4.1.22-3.51.1 libndr-standard-devel-4.1.22-3.51.1 libndr-standard0-4.1.22-3.51.1 libndr-standard0-debuginfo-4.1.22-3.51.1 libndr0-4.1.22-3.51.1 libndr0-debuginfo-4.1.22-3.51.1 libnetapi-devel-4.1.22-3.51.1 libnetapi0-4.1.22-3.51.1 libnetapi0-debuginfo-4.1.22-3.51.1 libpdb-devel-4.1.22-3.51.1 libpdb0-4.1.22-3.51.1 libpdb0-debuginfo-4.1.22-3.51.1 libregistry-devel-4.1.22-3.51.1 libregistry0-4.1.22-3.51.1 libregistry0-debuginfo-4.1.22-3.51.1 libsamba-credentials-devel-4.1.22-3.51.1 libsamba-credentials0-4.1.22-3.51.1 libsamba-credentials0-debuginfo-4.1.22-3.51.1 libsamba-hostconfig-devel-4.1.22-3.51.1 libsamba-hostconfig0-4.1.22-3.51.1 libsamba-hostconfig0-debuginfo-4.1.22-3.51.1 libsamba-policy-devel-4.1.22-3.51.1 libsamba-policy0-4.1.22-3.51.1 libsamba-policy0-debuginfo-4.1.22-3.51.1 libsamba-util-devel-4.1.22-3.51.1 libsamba-util0-4.1.22-3.51.1 libsamba-util0-debuginfo-4.1.22-3.51.1 libsamdb-devel-4.1.22-3.51.1 libsamdb0-4.1.22-3.51.1 libsamdb0-debuginfo-4.1.22-3.51.1 libsmbclient-devel-4.1.22-3.51.1 libsmbclient-raw-devel-4.1.22-3.51.1 libsmbclient-raw0-4.1.22-3.51.1 libsmbclient-raw0-debuginfo-4.1.22-3.51.1 libsmbclient0-4.1.22-3.51.1 libsmbclient0-debuginfo-4.1.22-3.51.1 libsmbconf-devel-4.1.22-3.51.1 libsmbconf0-4.1.22-3.51.1 libsmbconf0-debuginfo-4.1.22-3.51.1 libsmbldap-devel-4.1.22-3.51.1 libsmbldap0-4.1.22-3.51.1 libsmbldap0-debuginfo-4.1.22-3.51.1 libsmbsharemodes-devel-4.1.22-3.51.1 libsmbsharemodes0-4.1.22-3.51.1 libsmbsharemodes0-debuginfo-4.1.22-3.51.1 libtevent-util-devel-4.1.22-3.51.1 libtevent-util0-4.1.22-3.51.1 libtevent-util0-debuginfo-4.1.22-3.51.1 libwbclient-devel-4.1.22-3.51.1 libwbclient0-4.1.22-3.51.1 libwbclient0-debuginfo-4.1.22-3.51.1 samba-4.1.22-3.51.1 samba-client-4.1.22-3.51.1 samba-client-debuginfo-4.1.22-3.51.1 samba-core-devel-4.1.22-3.51.1 samba-debuginfo-4.1.22-3.51.1 samba-debugsource-4.1.22-3.51.1 samba-libs-4.1.22-3.51.1 samba-libs-debuginfo-4.1.22-3.51.1 samba-pidl-4.1.22-3.51.1 samba-python-4.1.22-3.51.1 samba-python-debuginfo-4.1.22-3.51.1 samba-test-4.1.22-3.51.1 samba-test-debuginfo-4.1.22-3.51.1 samba-test-devel-4.1.22-3.51.1 samba-winbind-4.1.22-3.51.1 samba-winbind-debuginfo-4.1.22-3.51.1 - openSUSE 13.1 (x86_64): libdcerpc-atsvc0-32bit-4.1.22-3.51.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.22-3.51.1 libdcerpc-binding0-32bit-4.1.22-3.51.1 libdcerpc-binding0-debuginfo-32bit-4.1.22-3.51.1 libdcerpc-samr0-32bit-4.1.22-3.51.1 libdcerpc-samr0-debuginfo-32bit-4.1.22-3.51.1 libdcerpc0-32bit-4.1.22-3.51.1 libdcerpc0-debuginfo-32bit-4.1.22-3.51.1 libgensec0-32bit-4.1.22-3.51.1 libgensec0-debuginfo-32bit-4.1.22-3.51.1 libndr-krb5pac0-32bit-4.1.22-3.51.1 libndr-krb5pac0-debuginfo-32bit-4.1.22-3.51.1 libndr-nbt0-32bit-4.1.22-3.51.1 libndr-nbt0-debuginfo-32bit-4.1.22-3.51.1 libndr-standard0-32bit-4.1.22-3.51.1 libndr-standard0-debuginfo-32bit-4.1.22-3.51.1 libndr0-32bit-4.1.22-3.51.1 libndr0-debuginfo-32bit-4.1.22-3.51.1 libnetapi0-32bit-4.1.22-3.51.1 libnetapi0-debuginfo-32bit-4.1.22-3.51.1 libpdb0-32bit-4.1.22-3.51.1 libpdb0-debuginfo-32bit-4.1.22-3.51.1 libregistry0-32bit-4.1.22-3.51.1 libregistry0-debuginfo-32bit-4.1.22-3.51.1 libsamba-credentials0-32bit-4.1.22-3.51.1 libsamba-credentials0-debuginfo-32bit-4.1.22-3.51.1 libsamba-hostconfig0-32bit-4.1.22-3.51.1 libsamba-hostconfig0-debuginfo-32bit-4.1.22-3.51.1 libsamba-policy0-32bit-4.1.22-3.51.1 libsamba-policy0-debuginfo-32bit-4.1.22-3.51.1 libsamba-util0-32bit-4.1.22-3.51.1 libsamba-util0-debuginfo-32bit-4.1.22-3.51.1 libsamdb0-32bit-4.1.22-3.51.1 libsamdb0-debuginfo-32bit-4.1.22-3.51.1 libsmbclient-raw0-32bit-4.1.22-3.51.1 libsmbclient-raw0-debuginfo-32bit-4.1.22-3.51.1 libsmbclient0-32bit-4.1.22-3.51.1 libsmbclient0-debuginfo-32bit-4.1.22-3.51.1 libsmbconf0-32bit-4.1.22-3.51.1 libsmbconf0-debuginfo-32bit-4.1.22-3.51.1 libsmbldap0-32bit-4.1.22-3.51.1 libsmbldap0-debuginfo-32bit-4.1.22-3.51.1 libtevent-util0-32bit-4.1.22-3.51.1 libtevent-util0-debuginfo-32bit-4.1.22-3.51.1 libwbclient0-32bit-4.1.22-3.51.1 libwbclient0-debuginfo-32bit-4.1.22-3.51.1 samba-32bit-4.1.22-3.51.1 samba-client-32bit-4.1.22-3.51.1 samba-client-debuginfo-32bit-4.1.22-3.51.1 samba-debuginfo-32bit-4.1.22-3.51.1 samba-libs-32bit-4.1.22-3.51.1 samba-libs-debuginfo-32bit-4.1.22-3.51.1 samba-winbind-32bit-4.1.22-3.51.1 samba-winbind-debuginfo-32bit-4.1.22-3.51.1 - openSUSE 13.1 (noarch): samba-doc-4.1.22-3.51.1 References: https://bugzilla.suse.com/960249 https://bugzilla.suse.com/962177

1 0

openSUSE-SU-2016:0243-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0243-1 Rating: important References: #961937 Cross-References: CVE-2016-1897 CVE-2016-1898 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to ffmpeg 2.8.5 fixes the following issues: * CVE-2016-1897: Cross-origin issue in URL processing (concat) - local file disclosure (boo#961937) * CVE-2016-1898: Cross-origin issue in URL processing (subfile) - local file disclosure (boo#961937) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-94=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffmpeg-2.8.5-12.1 ffmpeg-debuginfo-2.8.5-12.1 ffmpeg-debugsource-2.8.5-12.1 ffmpeg-devel-2.8.5-12.1 libavcodec-devel-2.8.5-12.1 libavcodec56-2.8.5-12.1 libavcodec56-debuginfo-2.8.5-12.1 libavdevice-devel-2.8.5-12.1 libavdevice56-2.8.5-12.1 libavdevice56-debuginfo-2.8.5-12.1 libavfilter-devel-2.8.5-12.1 libavfilter5-2.8.5-12.1 libavfilter5-debuginfo-2.8.5-12.1 libavformat-devel-2.8.5-12.1 libavformat56-2.8.5-12.1 libavformat56-debuginfo-2.8.5-12.1 libavresample-devel-2.8.5-12.1 libavresample2-2.8.5-12.1 libavresample2-debuginfo-2.8.5-12.1 libavutil-devel-2.8.5-12.1 libavutil54-2.8.5-12.1 libavutil54-debuginfo-2.8.5-12.1 libpostproc-devel-2.8.5-12.1 libpostproc53-2.8.5-12.1 libpostproc53-debuginfo-2.8.5-12.1 libswresample-devel-2.8.5-12.1 libswresample1-2.8.5-12.1 libswresample1-debuginfo-2.8.5-12.1 libswscale-devel-2.8.5-12.1 libswscale3-2.8.5-12.1 libswscale3-debuginfo-2.8.5-12.1 - openSUSE Leap 42.1 (x86_64): libavcodec56-32bit-2.8.5-12.1 libavcodec56-debuginfo-32bit-2.8.5-12.1 libavdevice56-32bit-2.8.5-12.1 libavdevice56-debuginfo-32bit-2.8.5-12.1 libavfilter5-32bit-2.8.5-12.1 libavfilter5-debuginfo-32bit-2.8.5-12.1 libavformat56-32bit-2.8.5-12.1 libavformat56-debuginfo-32bit-2.8.5-12.1 libavresample2-32bit-2.8.5-12.1 libavresample2-debuginfo-32bit-2.8.5-12.1 libavutil54-32bit-2.8.5-12.1 libavutil54-debuginfo-32bit-2.8.5-12.1 libpostproc53-32bit-2.8.5-12.1 libpostproc53-debuginfo-32bit-2.8.5-12.1 libswresample1-32bit-2.8.5-12.1 libswresample1-debuginfo-32bit-2.8.5-12.1 libswscale3-32bit-2.8.5-12.1 libswscale3-debuginfo-32bit-2.8.5-12.1 References: https://www.suse.com/security/cve/CVE-2016-1897.html https://www.suse.com/security/cve/CVE-2016-1898.html https://bugzilla.suse.com/961937

1 0

openSUSE-SU-2016:0239-1: moderate: Security update for ecryptfs-utils
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for ecryptfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0239-1 Rating: moderate References: #962052 Cross-References: CVE-2016-1572 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ecryptfs-utils fixes the following issues: - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-93=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ecryptfs-utils-104-3.1 ecryptfs-utils-debuginfo-104-3.1 ecryptfs-utils-debugsource-104-3.1 - openSUSE 13.2 (x86_64): ecryptfs-utils-32bit-104-3.1 ecryptfs-utils-debuginfo-32bit-104-3.1 References: https://www.suse.com/security/cve/CVE-2016-1572.html https://bugzilla.suse.com/962052

1 0

openSUSE-SU-2016:0226-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0226-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-92=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): compat-libldap-2_3-0-2.3.37-8.9.1 compat-libldap-2_3-0-debuginfo-2.3.37-8.9.1 libldap-2_4-2-2.4.39-8.9.1 libldap-2_4-2-debuginfo-2.4.39-8.9.1 openldap2-2.4.39-8.9.1 openldap2-back-meta-2.4.39-8.9.1 openldap2-back-meta-debuginfo-2.4.39-8.9.1 openldap2-back-perl-2.4.39-8.9.1 openldap2-back-perl-debuginfo-2.4.39-8.9.1 openldap2-back-sql-2.4.39-8.9.1 openldap2-back-sql-debuginfo-2.4.39-8.9.1 openldap2-client-2.4.39-8.9.1 openldap2-client-debuginfo-2.4.39-8.9.1 openldap2-client-debugsource-2.4.39-8.9.1 openldap2-debuginfo-2.4.39-8.9.1 openldap2-debugsource-2.4.39-8.9.1 openldap2-devel-2.4.39-8.9.1 openldap2-devel-static-2.4.39-8.9.1 - openSUSE 13.2 (x86_64): libldap-2_4-2-32bit-2.4.39-8.9.1 libldap-2_4-2-debuginfo-32bit-2.4.39-8.9.1 openldap2-devel-32bit-2.4.39-8.9.1 - openSUSE 13.2 (noarch): openldap2-doc-2.4.39-8.9.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-RU-2016:0223-1: moderate: Recommended update for libverto
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for libverto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0223-1 Rating: moderate References: #958871 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libverto fixes the following issues: - Introduce conflict between libverto-devel and krb5-devel because Kerberos is bundling its libverto source. (boo#958871) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-90=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libverto-debugsource-0.2.6-7.1 libverto-devel-0.2.6-7.1 libverto-glib-devel-0.2.6-7.1 libverto-glib1-0.2.6-7.1 libverto-glib1-debuginfo-0.2.6-7.1 libverto-libev-devel-0.2.6-7.1 libverto-libev1-0.2.6-7.1 libverto-libev1-debuginfo-0.2.6-7.1 libverto-tevent-devel-0.2.6-7.1 libverto-tevent1-0.2.6-7.1 libverto-tevent1-debuginfo-0.2.6-7.1 libverto1-0.2.6-7.1 libverto1-debuginfo-0.2.6-7.1 - openSUSE Leap 42.1 (x86_64): libverto-glib1-32bit-0.2.6-7.1 libverto-glib1-debuginfo-32bit-0.2.6-7.1 libverto-libev1-32bit-0.2.6-7.1 libverto-libev1-debuginfo-32bit-0.2.6-7.1 libverto-tevent1-32bit-0.2.6-7.1 libverto-tevent1-debuginfo-32bit-0.2.6-7.1 libverto1-32bit-0.2.6-7.1 libverto1-debuginfo-32bit-0.2.6-7.1 References: https://bugzilla.suse.com/958871

1 0

openSUSE-RU-2016:0222-1: moderate: Recommended update for mate-menu
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for mate-menu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0222-1 Rating: moderate References: #959024 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-menu fixes the following issues: - Update to 5.6.7: + Fix intends in mate-menu execute.py. + Do not use mate-folder.png that doesn't exist in freedesktop specification. + Fix configurator crash due to changes in Gtk 2.24.29. + Do not crash if lsb_release is not available (boo#959024). - Only recommend lsb-release. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-91=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): mate-menu-5.6.7-7.1 mate-menu-lang-5.6.7-7.1 References: https://bugzilla.suse.com/959024

1 0

openSUSE-RU-2016:0221-1: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0221-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh January 18th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-87=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201601180000-38.1 References:

1 0

openSUSE-RU-2016:0220-1: Recommended update for yast2-slp-server
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for yast2-slp-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0220-1 Rating: low References: #878892 #954494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-slp-server fixes the following issues: - Fix handling of broken options in configuration file. (bsc#878892, bsc#954494) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-88=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-slp-server-3.1.4-5.1 References: https://bugzilla.suse.com/878892 https://bugzilla.suse.com/954494

1 0

openSUSE-RU-2016:0219-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0219-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for calibre fixes the following issues: - Update to 2.49.0: + A new tool to easily export and import all calibre data -- books, settings and plugins. + Get Books: Add plugins for Amazon Australia and Amazon India. Also restore the Amazon EU plugins (lp#1526089). + PDF Input: Fix conversion of PDF documents that contain ASCII control codes in their outlines not working (lp#1527697). + Driver for Energy Ereader Screenlight (lp#1529108). + E-book viewer: Add an option to allow only a single book to be viewed at a time. Trying to view a second book will cause it to replace the currently viewed book (lp#1526504). + Kobo driver: Add support for the new firmware 3.19.5761. + Get Books: Update plugins for various Polish language book stores to handle changes to the website. + Amazon metadata download: Handle a change in the amazon website that prevented review metadata from being downloaded. + Download calibre plugins securely using HTTPS. + MOBI Output: Try to autofix corrupted PNG images in the input document (lp#1531738). + Nook Glowlight Plus: Send files by default to the NOOK/My Files folder (lp#1531394). + E-book viewer: Fix failure to view comic files that contain non-ASCII characters int heir internal filenames (lp#1530517). + And more, for details see http://calibre-ebook.com/whats-new Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-89=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): calibre-2.49.0-14.1 calibre-debuginfo-2.49.0-14.1 calibre-debugsource-2.49.0-14.1 References:

1 0

openSUSE-SU-2016:0218-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0218-1 Rating: moderate References: #948969 #961916 Cross-References: CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to cgit 0.12 fixes the following issues: - CVE-2016-1899: Reflected Cross Site Scripting and Header Injection in Mimetype Query String - CVE-2016-1900: Stored Cross Site Scripting and Header Injection in Filename Parameter - CVE-2016-1901: Integer Overflow resulting in Buffer Overflow The bundled git version was updated to 2.7.0. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-86=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cgit-0.12-11.6.1 cgit-debuginfo-0.12-11.6.1 cgit-debugsource-0.12-11.6.1 References: https://www.suse.com/security/cve/CVE-2016-1899.html https://www.suse.com/security/cve/CVE-2016-1900.html https://www.suse.com/security/cve/CVE-2016-1901.html https://bugzilla.suse.com/948969 https://bugzilla.suse.com/961916

1 0

openSUSE-SU-2016:0217-1: jasper
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0217-1 Rating: low References: #725758 #830803 #881716 #961886 Cross-References: CVE-2014-8138 CVE-2016-1867 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for jasper fixes the following issues: - CVE-2016-1867: Out-of-bounds Read could cause a crash (boo#961886) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-83=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): jasper-1.900.1-160.16.1 jasper-debuginfo-1.900.1-160.16.1 jasper-debugsource-1.900.1-160.16.1 libjasper-devel-1.900.1-160.16.1 libjasper1-1.900.1-160.16.1 libjasper1-debuginfo-1.900.1-160.16.1 - openSUSE 13.1 (x86_64): libjasper1-32bit-1.900.1-160.16.1 libjasper1-debuginfo-32bit-1.900.1-160.16.1 References: https://www.suse.com/security/cve/CVE-2014-8138.html https://www.suse.com/security/cve/CVE-2016-1867.html https://bugzilla.suse.com/725758 https://bugzilla.suse.com/830803 https://bugzilla.suse.com/881716 https://bugzilla.suse.com/961886

1 0

openSUSE-SU-2016:0216-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0216-1 Rating: moderate References: #863933 #875216 #953110 Cross-References: CVE-2015-5313 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: Maintenance update for openSUSE13.1 libvirt package. - Fix cve-2015-5313: directory directory traversal privilege escalation vulnerability. e8643ef6-cve-2015-5313.patch bsc#953110 - qemu: Call qemuSetupHostdevCGroup later during hotplug 05e149f9-call-qemuSetupHostdevCGroup-later.patch qemu: hotplug: Only label hostdev after checking device conflicts ee414b5d-fix-qemu-hotplug-usb-hostdev.patch bsc#863933 - libxl: support virtual sound devices in HVM domains c0d3f608-libxl-soundhw.patch bsc#875216 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-82=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libvirt-1.1.2-2.51.1 libvirt-client-1.1.2-2.51.1 libvirt-client-debuginfo-1.1.2-2.51.1 libvirt-daemon-1.1.2-2.51.1 libvirt-daemon-config-network-1.1.2-2.51.1 libvirt-daemon-config-nwfilter-1.1.2-2.51.1 libvirt-daemon-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-interface-1.1.2-2.51.1 libvirt-daemon-driver-interface-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-lxc-1.1.2-2.51.1 libvirt-daemon-driver-lxc-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-network-1.1.2-2.51.1 libvirt-daemon-driver-network-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-nodedev-1.1.2-2.51.1 libvirt-daemon-driver-nodedev-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-nwfilter-1.1.2-2.51.1 libvirt-daemon-driver-nwfilter-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-qemu-1.1.2-2.51.1 libvirt-daemon-driver-qemu-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-secret-1.1.2-2.51.1 libvirt-daemon-driver-secret-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-storage-1.1.2-2.51.1 libvirt-daemon-driver-storage-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-uml-1.1.2-2.51.1 libvirt-daemon-driver-uml-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-vbox-1.1.2-2.51.1 libvirt-daemon-driver-vbox-debuginfo-1.1.2-2.51.1 libvirt-daemon-lxc-1.1.2-2.51.1 libvirt-daemon-qemu-1.1.2-2.51.1 libvirt-daemon-uml-1.1.2-2.51.1 libvirt-daemon-vbox-1.1.2-2.51.1 libvirt-debugsource-1.1.2-2.51.1 libvirt-devel-1.1.2-2.51.1 libvirt-doc-1.1.2-2.51.1 libvirt-lock-sanlock-1.1.2-2.51.1 libvirt-lock-sanlock-debuginfo-1.1.2-2.51.1 libvirt-login-shell-1.1.2-2.51.1 libvirt-login-shell-debuginfo-1.1.2-2.51.1 libvirt-python-1.1.2-2.51.1 libvirt-python-debuginfo-1.1.2-2.51.1 - openSUSE 13.1 (x86_64): libvirt-client-32bit-1.1.2-2.51.1 libvirt-client-debuginfo-32bit-1.1.2-2.51.1 libvirt-daemon-driver-libxl-1.1.2-2.51.1 libvirt-daemon-driver-libxl-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-xen-1.1.2-2.51.1 libvirt-daemon-driver-xen-debuginfo-1.1.2-2.51.1 libvirt-daemon-xen-1.1.2-2.51.1 libvirt-devel-32bit-1.1.2-2.51.1 References: https://www.suse.com/security/cve/CVE-2015-5313.html https://bugzilla.suse.com/863933 https://bugzilla.suse.com/875216 https://bugzilla.suse.com/953110

1 0

openSUSE-SU-2016:0215-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0215-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-85=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libtiff-devel-4.0.6-8.13.1 libtiff5-4.0.6-8.13.1 libtiff5-debuginfo-4.0.6-8.13.1 tiff-4.0.6-8.13.1 tiff-debuginfo-4.0.6-8.13.1 tiff-debugsource-4.0.6-8.13.1 - openSUSE 13.1 (x86_64): libtiff-devel-32bit-4.0.6-8.13.1 libtiff5-32bit-4.0.6-8.13.1 libtiff5-debuginfo-32bit-4.0.6-8.13.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0

openSUSE-SU-2016:0214-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0214-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to 1.0.8 - Add workaround for https://bugs.php.net/bug.php?id=70757 (#1490582) - Fix HTML sanitizer to skip  in output (#1490583) - Fix charset encoding of message/rfc822 part bodies (#1490606) - Fix handling of message/rfc822 attachments on replies and forwards (#1490607) - Fix PDF support detection in Firefox > 19 (#1490610) - Fix path traversal vulnerability (CWE-22) in setting a skin (#1490620) [CVE-2015-8770] [bnc#962067] - Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#1490619) - Fix .htaccess rewrite rules to not block .well-known URIs (#1490615) - Updated apache2 config Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-84=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): roundcubemail-1.0.8-2.27.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0

openSUSE-SU-2016:0213-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0213-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to roundcubemail 1.1.4 fixes the following issues: - CVE-2015-8770: Path traversal vulnerability allowed code execution to remote authenticated users if they were also upload files to the same server through some other method (boo#962067) This update also contains all upstream fixes in 1.1.4. The package was updated to use generic PHP requirements for use with other prefixes than "php5-" Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-80=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): roundcubemail-1.1.4-6.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0

openSUSE-SU-2016:0212-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0212-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-79=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libtiff-devel-4.0.6-10.17.1 libtiff5-4.0.6-10.17.1 libtiff5-debuginfo-4.0.6-10.17.1 tiff-4.0.6-10.17.1 tiff-debuginfo-4.0.6-10.17.1 tiff-debugsource-4.0.6-10.17.1 - openSUSE 13.2 (x86_64): libtiff-devel-32bit-4.0.6-10.17.1 libtiff5-32bit-4.0.6-10.17.1 libtiff5-debuginfo-32bit-4.0.6-10.17.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0

openSUSE-SU-2016:0211-1: Security update for jasper
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0211-1 Rating: low References: #961886 Cross-References: CVE-2016-1867 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jasper fixes the following issues: - CVE-2016-1867: Out-of-bounds Read could cause a crash (boo#961886) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-78=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): jasper-1.900.1-163.16.1 jasper-debuginfo-1.900.1-163.16.1 jasper-debugsource-1.900.1-163.16.1 libjasper-devel-1.900.1-163.16.1 libjasper1-1.900.1-163.16.1 libjasper1-debuginfo-1.900.1-163.16.1 - openSUSE 13.2 (x86_64): libjasper1-32bit-1.900.1-163.16.1 libjasper1-debuginfo-32bit-1.900.1-163.16.1 References: https://www.suse.com/security/cve/CVE-2016-1867.html https://bugzilla.suse.com/961886

1 0

openSUSE-SU-2016:0210-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0210-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to roundcubemail 1.0.8 fixes the following issues: - CVE-2015-8770: Path traversal vulnerability allowed code execution to remote authenticated users if they were also upload files to the same server through some other method (boo#962067) This update also contains all upstream fixes in 1.0.8. The package was updated to use generic PHP requirements for use with other prefixes than "php5-" Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-81=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.8-17.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0

openSUSE-SU-2016:0209-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0209-1 Rating: moderate References: #953110 Cross-References: CVE-2015-5313 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvirt fixes the following issues: - CVE-2015-5313: directory directory traversal privilege escalation vulnerability. (boo#953110) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-77=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-77=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvirt-1.2.18.2-5.1 libvirt-client-1.2.18.2-5.1 libvirt-client-debuginfo-1.2.18.2-5.1 libvirt-daemon-1.2.18.2-5.1 libvirt-daemon-config-network-1.2.18.2-5.1 libvirt-daemon-config-nwfilter-1.2.18.2-5.1 libvirt-daemon-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-interface-1.2.18.2-5.1 libvirt-daemon-driver-interface-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-lxc-1.2.18.2-5.1 libvirt-daemon-driver-lxc-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-network-1.2.18.2-5.1 libvirt-daemon-driver-network-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-nodedev-1.2.18.2-5.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-nwfilter-1.2.18.2-5.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-qemu-1.2.18.2-5.1 libvirt-daemon-driver-qemu-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-secret-1.2.18.2-5.1 libvirt-daemon-driver-secret-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-storage-1.2.18.2-5.1 libvirt-daemon-driver-storage-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-uml-1.2.18.2-5.1 libvirt-daemon-driver-uml-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-vbox-1.2.18.2-5.1 libvirt-daemon-driver-vbox-debuginfo-1.2.18.2-5.1 libvirt-daemon-lxc-1.2.18.2-5.1 libvirt-daemon-qemu-1.2.18.2-5.1 libvirt-daemon-uml-1.2.18.2-5.1 libvirt-daemon-vbox-1.2.18.2-5.1 libvirt-debugsource-1.2.18.2-5.1 libvirt-devel-1.2.18.2-5.1 libvirt-doc-1.2.18.2-5.1 libvirt-lock-sanlock-1.2.18.2-5.1 libvirt-lock-sanlock-debuginfo-1.2.18.2-5.1 libvirt-login-shell-1.2.18.2-5.1 libvirt-login-shell-debuginfo-1.2.18.2-5.1 - openSUSE Leap 42.1 (x86_64): libvirt-client-32bit-1.2.18.2-5.1 libvirt-client-debuginfo-32bit-1.2.18.2-5.1 libvirt-daemon-driver-libxl-1.2.18.2-5.1 libvirt-daemon-driver-libxl-debuginfo-1.2.18.2-5.1 libvirt-daemon-xen-1.2.18.2-5.1 libvirt-devel-32bit-1.2.18.2-5.1 - openSUSE 13.2 (i586 x86_64): libvirt-1.2.9-28.1 libvirt-client-1.2.9-28.1 libvirt-client-debuginfo-1.2.9-28.1 libvirt-daemon-1.2.9-28.1 libvirt-daemon-config-network-1.2.9-28.1 libvirt-daemon-config-nwfilter-1.2.9-28.1 libvirt-daemon-debuginfo-1.2.9-28.1 libvirt-daemon-driver-interface-1.2.9-28.1 libvirt-daemon-driver-interface-debuginfo-1.2.9-28.1 libvirt-daemon-driver-lxc-1.2.9-28.1 libvirt-daemon-driver-lxc-debuginfo-1.2.9-28.1 libvirt-daemon-driver-network-1.2.9-28.1 libvirt-daemon-driver-network-debuginfo-1.2.9-28.1 libvirt-daemon-driver-nodedev-1.2.9-28.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.9-28.1 libvirt-daemon-driver-nwfilter-1.2.9-28.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.9-28.1 libvirt-daemon-driver-qemu-1.2.9-28.1 libvirt-daemon-driver-qemu-debuginfo-1.2.9-28.1 libvirt-daemon-driver-secret-1.2.9-28.1 libvirt-daemon-driver-secret-debuginfo-1.2.9-28.1 libvirt-daemon-driver-storage-1.2.9-28.1 libvirt-daemon-driver-storage-debuginfo-1.2.9-28.1 libvirt-daemon-driver-uml-1.2.9-28.1 libvirt-daemon-driver-uml-debuginfo-1.2.9-28.1 libvirt-daemon-driver-vbox-1.2.9-28.1 libvirt-daemon-driver-vbox-debuginfo-1.2.9-28.1 libvirt-daemon-lxc-1.2.9-28.1 libvirt-daemon-qemu-1.2.9-28.1 libvirt-daemon-uml-1.2.9-28.1 libvirt-daemon-vbox-1.2.9-28.1 libvirt-debugsource-1.2.9-28.1 libvirt-devel-1.2.9-28.1 libvirt-doc-1.2.9-28.1 libvirt-lock-sanlock-1.2.9-28.1 libvirt-lock-sanlock-debuginfo-1.2.9-28.1 libvirt-login-shell-1.2.9-28.1 libvirt-login-shell-debuginfo-1.2.9-28.1 - openSUSE 13.2 (x86_64): libvirt-client-32bit-1.2.9-28.1 libvirt-client-debuginfo-32bit-1.2.9-28.1 libvirt-daemon-driver-libxl-1.2.9-28.1 libvirt-daemon-driver-libxl-debuginfo-1.2.9-28.1 libvirt-daemon-driver-xen-1.2.9-28.1 libvirt-daemon-driver-xen-debuginfo-1.2.9-28.1 libvirt-daemon-xen-1.2.9-28.1 libvirt-devel-32bit-1.2.9-28.1 References: https://www.suse.com/security/cve/CVE-2015-5313.html https://bugzilla.suse.com/953110

1 0

openSUSE-SU-2016:0207-1: important: Security update for giflib
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0207-1 Rating: important References: #949160 #960319 Cross-References: CVE-2015-7555 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The following patch fixes - a heap overflow in giffix - a memory leak in libgif6 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-76=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): giflib-debugsource-5.0.5-2.3.1 giflib-devel-5.0.5-2.3.1 giflib-progs-5.0.5-2.3.1 giflib-progs-debuginfo-5.0.5-2.3.1 libgif6-5.0.5-2.3.1 libgif6-debuginfo-5.0.5-2.3.1 - openSUSE 13.1 (x86_64): giflib-devel-32bit-5.0.5-2.3.1 libgif6-32bit-5.0.5-2.3.1 libgif6-debuginfo-32bit-5.0.5-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-7555.html https://bugzilla.suse.com/949160 https://bugzilla.suse.com/960319

1 0

openSUSE-RU-2016:0206-1: moderate: Recommended update for snapper
by maintenance＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Recommended Update: Recommended update for snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0206-1 Rating: moderate References: #954445 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for snapper ensures a roll-back operation will only be executed for the root file system. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-74=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libsnapper-devel-0.2.9.1-3.1 libsnapper3-0.2.9.1-3.1 libsnapper3-debuginfo-0.2.9.1-3.1 pam_snapper-0.2.9.1-3.1 pam_snapper-debuginfo-0.2.9.1-3.1 snapper-0.2.9.1-3.1 snapper-debuginfo-0.2.9.1-3.1 snapper-debugsource-0.2.9.1-3.1 - openSUSE Leap 42.1 (noarch): snapper-zypp-plugin-0.2.9.1-3.1 References: https://bugzilla.suse.com/954445

1 0

openSUSE-SU-2016:0204-1: important: Security update for bind
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0204-1 Rating: important References: #962189 Cross-References: CVE-2015-8704 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2015-8704: Specific APL data allowed remote attacker to trigger a crash in certain configurations (bsc#962189) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-73=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.23.1 bind-chrootenv-9.9.4P2-2.23.1 bind-debuginfo-9.9.4P2-2.23.1 bind-debugsource-9.9.4P2-2.23.1 bind-devel-9.9.4P2-2.23.1 bind-libs-9.9.4P2-2.23.1 bind-libs-debuginfo-9.9.4P2-2.23.1 bind-lwresd-9.9.4P2-2.23.1 bind-lwresd-debuginfo-9.9.4P2-2.23.1 bind-utils-9.9.4P2-2.23.1 bind-utils-debuginfo-9.9.4P2-2.23.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.23.1 bind-libs-debuginfo-32bit-9.9.4P2-2.23.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.23.1 References: https://www.suse.com/security/cve/CVE-2015-8704.html https://bugzilla.suse.com/962189

1 0

openSUSE-RU-2016:0203-1: moderate: Recommended update for kfilemetadata5
by maintenance＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Recommended Update: Recommended update for kfilemetadata5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0203-1 Rating: moderate References: #914316 #927466 #953957 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for poppler and kfilemetadata5 fixes the following issues: - poppler + Graphical issue with a fillable PDF file -fix annotations with transparent color in PDF files (boo#914316) + Poppler die not display standard ligatures correctly (boo#927466) This update also contains the new poppler-qt5 package. This update was imported from the SUSE:SLE-12:Update update project. - kfilemetadata5 + Build against poppler-qt5 on SLE12 and Leap 42 as well, it is available meanwhile (boo#953957) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-75=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kfilemetadata5-5.16.0-6.1 kfilemetadata5-debuginfo-5.16.0-6.1 kfilemetadata5-debugsource-5.16.0-6.1 kfilemetadata5-devel-5.16.0-6.1 libpoppler-cpp0-0.24.4-7.1 libpoppler-cpp0-debuginfo-0.24.4-7.1 libpoppler-devel-0.24.4-7.1 libpoppler-glib-devel-0.24.4-7.1 libpoppler-glib8-0.24.4-7.1 libpoppler-glib8-debuginfo-0.24.4-7.1 libpoppler-qt4-4-0.24.4-7.1 libpoppler-qt4-4-debuginfo-0.24.4-7.1 libpoppler-qt4-devel-0.24.4-7.1 libpoppler-qt5-1-0.24.4-7.1 libpoppler-qt5-1-debuginfo-0.24.4-7.1 libpoppler-qt5-devel-0.24.4-7.1 libpoppler44-0.24.4-7.1 libpoppler44-debuginfo-0.24.4-7.1 poppler-debugsource-0.24.4-7.1 poppler-qt-debugsource-0.24.4-7.1 poppler-qt5-debugsource-0.24.4-7.1 poppler-tools-0.24.4-7.1 poppler-tools-debuginfo-0.24.4-7.1 typelib-1_0-Poppler-0_18-0.24.4-7.1 - openSUSE Leap 42.1 (x86_64): kfilemetadata5-32bit-5.16.0-6.1 kfilemetadata5-debuginfo-32bit-5.16.0-6.1 - openSUSE Leap 42.1 (noarch): kfilemetadata5-lang-5.16.0-6.1 References: https://bugzilla.suse.com/914316 https://bugzilla.suse.com/927466 https://bugzilla.suse.com/953957

1 0

openSUSE-SU-2016:0201-1: moderate: Security update for giflib
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0201-1 Rating: moderate References: #949160 #960319 Cross-References: CVE-2015-7555 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for giflib fixes the following issues: - CVE-2015-7555: Heap overflow in giffix (bsc#960319) - bsc#949160: Fix a memory leak Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-72=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): giflib-debugsource-5.0.5-4.3.1 giflib-devel-5.0.5-4.3.1 giflib-progs-5.0.5-4.3.1 giflib-progs-debuginfo-5.0.5-4.3.1 libgif6-5.0.5-4.3.1 libgif6-debuginfo-5.0.5-4.3.1 - openSUSE 13.2 (x86_64): giflib-devel-32bit-5.0.5-4.3.1 libgif6-32bit-5.0.5-4.3.1 libgif6-debuginfo-32bit-5.0.5-4.3.1 References: https://www.suse.com/security/cve/CVE-2015-7555.html https://bugzilla.suse.com/949160 https://bugzilla.suse.com/960319

1 0