January 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0272-1: important: Security update for Java7
by opensuse-security＠opensuse.org 28 Jan '16

28 Jan '16

openSUSE Security Update: Security update for Java7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0272-1 Rating: important References: #939523 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Update OpenJDK to 7u95 / IcedTea 2.6.4 including the following fixes: * Security fixes - S8059054, CVE-2016-0402: Better URL processing - S8130710, CVE-2016-0448: Better attributes processing - S8132210: Reinforce JMX collector internals - S8132988: Better printing dialogues - S8133962, CVE-2016-0466: More general limits - S8137060: JMX memory management improvements - S8139012: Better font substitutions - S8139017, CVE-2016-0483: More stable image decoding - S8140543, CVE-2016-0494: Arrange font actions - S8143185: Cleanup for handling proxies - S8143941, CVE-2015-8126, CVE-2015-8472: Update splashscreen displays - S8144773, CVE-2015-7575: Further reduce use of MD5 (SLOTH) - S8142882, CVE-2015-4871: rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed * Import of OpenJDK 7 u95 build 0 - S7167988: PKIX CertPathBuilder in reverse mode doesn't work if more than one trust anchor is specified - S8068761: [TEST_BUG] java/nio/channels/ServerSocketChannel/AdaptServerSocket.java failed with SocketTimeoutException - S8074068: Cleanup in src/share/classes/sun/security/x509/ - S8075773: jps running as root fails after the fix of JDK-8050807 - S8081297: SSL Problem with Tomcat - S8131181: Increment minor version of HSx for 7u95 and initialize the build number - S8132082: Let OracleUcrypto accept RSAPrivateKey - S8134605: Partial rework of the fix for 8081297 - S8134861: XSLT: Extension func call cause exception if namespace URI contains partial package name - S8135307: CompletionFailure thrown when calling FieldDoc.type, if the field's type is missing - S8138716: (tz) Support tzdata2015g - S8140244: Port fix of JDK-8075773 to MacOSX - S8141213: [Parfait]Potentially blocking function GetArrayLength called in JNI critical region at line 239 of jdk/src/share/native/sun/awt/image/jpeg/jpegdecoder.c in function GET_ARRAYS - S8141287: Add MD5 to jdk.certpath.disabledAlgorithms - Take 2 - S8142928: [TEST_BUG] sun/security/provider/certpath/ReverseBuilder/ReverseBuild.java 8u71 failure - S8143132: L10n resource file translation update - S8144955: Wrong changes were pushed with 8143942 - S8145551: Test failed with Crash for Improved font lookups - S8147466: Add -fno-strict-overflow to IndicRearrangementProcessor{,2}.cpp * Backports - S8140244: Port fix of JDK-8075773 to AIX - S8133196, PR2712, RH1251935: HTTPS hostname invalid issue with InetAddress - S8140620, PR2710: Find and load default.sf2 as the default soundbank on Linux Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-110=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-24.27.1 java-1_7_0-openjdk-accessibility-1.7.0.95-24.27.1 java-1_7_0-openjdk-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-debugsource-1.7.0.95-24.27.1 java-1_7_0-openjdk-demo-1.7.0.95-24.27.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-devel-1.7.0.95-24.27.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-headless-1.7.0.95-24.27.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-24.27.1 java-1_7_0-openjdk-src-1.7.0.95-24.27.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.95-24.27.1 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/962743

1 0

openSUSE-SU-2016:0271-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0271-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-109=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-48.0.2564.82-122.1 chromedriver-debuginfo-48.0.2564.82-122.1 chromium-48.0.2564.82-122.1 chromium-debuginfo-48.0.2564.82-122.1 chromium-debugsource-48.0.2564.82-122.1 chromium-desktop-gnome-48.0.2564.82-122.1 chromium-desktop-kde-48.0.2564.82-122.1 chromium-ffmpegsumo-48.0.2564.82-122.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-122.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192

1 0

openSUSE-SU-2016:0270-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0270-1 Rating: critical References: #951376 #960996 #962743 Cross-References: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix several security issues. (bsc#962743) The following vulnerabilities were fixed: - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Includes the following fixes from the October 2015 update: (bsc#951376) - CVE-2015-4734: A remote user can exploit a flaw in the Embedded JGSS component to partially access data - CVE-2015-4803: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4805: A remote user can exploit a flaw in the Embedded Serialization component to gain elevated privileges - CVE-2015-4806: A remote user can exploit a flaw in the Java SE Embedded Libraries component to partially access and partially modify data - CVE-2015-4835: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4842: A remote user can exploit a flaw in the Embedded JAXP component to partially access data - CVE-2015-4843: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4844: A remote user can exploit a flaw in the Embedded 2D component to gain elevated privileges - CVE-2015-4860: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4872: A remote user can exploit a flaw in the JRockit Security component to partially modify data []. - CVE-2015-4881: A remote user can exploit a flaw in the Embedded CORBA component to gain elevated privileges - CVE-2015-4882: A remote user can exploit a flaw in the Embedded CORBA component to cause partial denial of service conditions - CVE-2015-4883: A remote user can exploit a flaw in the Embedded RMI component to gain elevated privileges - CVE-2015-4893: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4902: A remote user can exploit a flaw in the Java SE Deployment component to partially modify data - CVE-2015-4903: A remote user can exploit a flaw in the Embedded RMI component to partially access data - CVE-2015-4911: A remote user can exploit a flaw in the JRockit JAXP component to cause partial denial of service conditions - CVE-2015-4810: A local user can exploit a flaw in the Java SE Deployment component to gain elevated privileges - CVE-2015-4840: A remote user can exploit a flaw in the Embedded 2D component to partially access data - CVE-2015-4868: A remote user can exploit a flaw in the Java SE Embedded Libraries component to gain elevated privileges - CVE-2015-4901: A remote user can exploit a flaw in the JavaFX component to gain elevated privileges - CVE-2015-4906: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4908: A remote user can exploit a flaw in the JavaFX component to partially access data - CVE-2015-4916: A remote user can exploit a flaw in the JavaFX component to partially access data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-106=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.72-6.1 java-1_8_0-openjdk-accessibility-1.8.0.72-6.1 java-1_8_0-openjdk-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-debugsource-1.8.0.72-6.1 java-1_8_0-openjdk-demo-1.8.0.72-6.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-devel-1.8.0.72-6.1 java-1_8_0-openjdk-headless-1.8.0.72-6.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-6.1 java-1_8_0-openjdk-src-1.8.0.72-6.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.72-6.1 References: https://www.suse.com/security/cve/CVE-2015-4734.html https://www.suse.com/security/cve/CVE-2015-4803.html https://www.suse.com/security/cve/CVE-2015-4805.html https://www.suse.com/security/cve/CVE-2015-4806.html https://www.suse.com/security/cve/CVE-2015-4810.html https://www.suse.com/security/cve/CVE-2015-4835.html https://www.suse.com/security/cve/CVE-2015-4840.html https://www.suse.com/security/cve/CVE-2015-4842.html https://www.suse.com/security/cve/CVE-2015-4843.html https://www.suse.com/security/cve/CVE-2015-4844.html https://www.suse.com/security/cve/CVE-2015-4860.html https://www.suse.com/security/cve/CVE-2015-4868.html https://www.suse.com/security/cve/CVE-2015-4872.html https://www.suse.com/security/cve/CVE-2015-4881.html https://www.suse.com/security/cve/CVE-2015-4882.html https://www.suse.com/security/cve/CVE-2015-4883.html https://www.suse.com/security/cve/CVE-2015-4893.html https://www.suse.com/security/cve/CVE-2015-4901.html https://www.suse.com/security/cve/CVE-2015-4902.html https://www.suse.com/security/cve/CVE-2015-4903.html https://www.suse.com/security/cve/CVE-2015-4906.html https://www.suse.com/security/cve/CVE-2015-4908.html https://www.suse.com/security/cve/CVE-2015-4911.html https://www.suse.com/security/cve/CVE-2015-4916.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/951376 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743

1 0

openSUSE-SU-2016:0268-1: critical: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0268-1 Rating: critical References: #939523 #960996 #962743 Cross-References: CVE-2015-4871 CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-4871: Rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions The following bugs were fixed: - bsc#939523: java-1_7_0-openjdk-headless had X dependencies, move libjavagtk to full package Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-107=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.95-16.1 java-1_7_0-openjdk-accessibility-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.95-16.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-debugsource-1.7.0.95-16.1 java-1_7_0-openjdk-demo-1.7.0.95-16.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-devel-1.7.0.95-16.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-headless-1.7.0.95-16.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.95-16.1 java-1_7_0-openjdk-src-1.7.0.95-16.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.95-16.1 References: https://www.suse.com/security/cve/CVE-2015-4871.html https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/939523 https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743

1 0

openSUSE-RU-2016:0264-1: moderate: Recommended update for librecad and libdxfrw
by maintenance＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Recommended Update: Recommended update for librecad and libdxfrw ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0264-1 Rating: moderate References: #962604 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for librecad and libdxfrw fixes the following issues: librecad: - Update to new upstream release 2.0.9 (boo#962604): * Mostly a bug fixing release * Fixed a few crashes due to undo and deleted entities * More at: http://forum.librecad.org/2-0-9-released-td5712809.html libdxfrw was updated to 0.6.3 as a dependency. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-108=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libdxfrw-debugsource-0.6.3-3.1 libdxfrw-devel-0.6.3-3.1 libdxfrw-tools-0.6.3-3.1 libdxfrw-tools-debuginfo-0.6.3-3.1 libdxfrw0-0.6.3-3.1 libdxfrw0-debuginfo-0.6.3-3.1 librecad-2.0.9-3.1 librecad-debuginfo-2.0.9-3.1 librecad-debugsource-2.0.9-3.1 - openSUSE Leap 42.1 (noarch): librecad-parts-2.0.9-3.1 References: https://bugzilla.suse.com/962604

1 0

openSUSE-SU-2016:0263-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0263-1 Rating: critical References: #960996 #962743 Cross-References: CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-105=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.72-21.1 java-1_8_0-openjdk-accessibility-1.8.0.72-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-debugsource-1.8.0.72-21.1 java-1_8_0-openjdk-demo-1.8.0.72-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-devel-1.8.0.72-21.1 java-1_8_0-openjdk-headless-1.8.0.72-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-src-1.8.0.72-21.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.72-21.1 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743

1 0

openSUSE-SU-2016:0261-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0261-1 Rating: important References: #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment This update adds the following functionality: - fate#319300: SHA2 password hashing module that can be loaded on-demand. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-104=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-libldap-2_3-0-2.3.37-11.1 compat-libldap-2_3-0-debuginfo-2.3.37-11.1 libldap-2_4-2-2.4.41-11.1 libldap-2_4-2-debuginfo-2.4.41-11.1 openldap2-2.4.41-11.1 openldap2-back-meta-2.4.41-11.1 openldap2-back-meta-debuginfo-2.4.41-11.1 openldap2-back-perl-2.4.41-11.1 openldap2-back-perl-debuginfo-2.4.41-11.1 openldap2-back-sql-2.4.41-11.1 openldap2-back-sql-debuginfo-2.4.41-11.1 openldap2-client-2.4.41-11.1 openldap2-client-debuginfo-2.4.41-11.1 openldap2-client-debugsource-2.4.41-11.1 openldap2-debuginfo-2.4.41-11.1 openldap2-debugsource-2.4.41-11.1 openldap2-devel-2.4.41-11.1 openldap2-devel-static-2.4.41-11.1 - openSUSE Leap 42.1 (x86_64): libldap-2_4-2-32bit-2.4.41-11.1 libldap-2_4-2-debuginfo-32bit-2.4.41-11.1 openldap2-devel-32bit-2.4.41-11.1 - openSUSE Leap 42.1 (noarch): openldap2-doc-2.4.41-11.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-RU-2016:0258-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0258-1 Rating: moderate References: #771521 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Fix panning when configured in xorg.conf* (boo#771521). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-103=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-103=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xorg-x11-server-7.6_1.17.2-15.1 xorg-x11-server-debuginfo-7.6_1.17.2-15.1 xorg-x11-server-debugsource-7.6_1.17.2-15.1 xorg-x11-server-extra-7.6_1.17.2-15.1 xorg-x11-server-extra-debuginfo-7.6_1.17.2-15.1 xorg-x11-server-sdk-7.6_1.17.2-15.1 xorg-x11-server-source-7.6_1.17.2-15.1 - openSUSE 13.2 (i586 x86_64): xorg-x11-server-7.6_1.16.1-31.1 xorg-x11-server-debuginfo-7.6_1.16.1-31.1 xorg-x11-server-debugsource-7.6_1.16.1-31.1 xorg-x11-server-extra-7.6_1.16.1-31.1 xorg-x11-server-extra-debuginfo-7.6_1.16.1-31.1 xorg-x11-server-sdk-7.6_1.16.1-31.1 References: https://bugzilla.suse.com/771521

1 0

openSUSE-SU-2016:0255-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0255-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libldap-2_4-2-2.4.33-8.6.1 libldap-2_4-2-debuginfo-2.4.33-8.6.1 openldap2-2.4.33-8.6.1 openldap2-back-meta-2.4.33-8.6.1 openldap2-back-meta-debuginfo-2.4.33-8.6.1 openldap2-back-perl-2.4.33-8.6.1 openldap2-back-perl-debuginfo-2.4.33-8.6.1 openldap2-back-sql-2.4.33-8.6.1 openldap2-back-sql-debuginfo-2.4.33-8.6.1 openldap2-client-2.4.33-8.6.1 openldap2-client-debuginfo-2.4.33-8.6.1 openldap2-client-debugsource-2.4.33-8.6.1 openldap2-debuginfo-2.4.33-8.6.1 openldap2-debugsource-2.4.33-8.6.1 openldap2-devel-2.4.33-8.6.1 openldap2-devel-static-2.4.33-8.6.1 - openSUSE 13.1 (x86_64): libldap-2_4-2-32bit-2.4.33-8.6.1 libldap-2_4-2-debuginfo-32bit-2.4.33-8.6.1 openldap2-devel-32bit-2.4.33-8.6.1 - openSUSE 13.1 (noarch): openldap2-doc-2.4.33-8.6.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-SU-2016:0252-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0252-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.6-3.1 libtiff5-4.0.6-3.1 libtiff5-debuginfo-4.0.6-3.1 tiff-4.0.6-3.1 tiff-debuginfo-4.0.6-3.1 tiff-debugsource-4.0.6-3.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.6-3.1 libtiff5-32bit-4.0.6-3.1 libtiff5-debuginfo-32bit-4.0.6-3.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0