January 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0223-1: moderate: Recommended update for libverto
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for libverto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0223-1 Rating: moderate References: #958871 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libverto fixes the following issues: - Introduce conflict between libverto-devel and krb5-devel because Kerberos is bundling its libverto source. (boo#958871) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-90=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libverto-debugsource-0.2.6-7.1 libverto-devel-0.2.6-7.1 libverto-glib-devel-0.2.6-7.1 libverto-glib1-0.2.6-7.1 libverto-glib1-debuginfo-0.2.6-7.1 libverto-libev-devel-0.2.6-7.1 libverto-libev1-0.2.6-7.1 libverto-libev1-debuginfo-0.2.6-7.1 libverto-tevent-devel-0.2.6-7.1 libverto-tevent1-0.2.6-7.1 libverto-tevent1-debuginfo-0.2.6-7.1 libverto1-0.2.6-7.1 libverto1-debuginfo-0.2.6-7.1 - openSUSE Leap 42.1 (x86_64): libverto-glib1-32bit-0.2.6-7.1 libverto-glib1-debuginfo-32bit-0.2.6-7.1 libverto-libev1-32bit-0.2.6-7.1 libverto-libev1-debuginfo-32bit-0.2.6-7.1 libverto-tevent1-32bit-0.2.6-7.1 libverto-tevent1-debuginfo-32bit-0.2.6-7.1 libverto1-32bit-0.2.6-7.1 libverto1-debuginfo-32bit-0.2.6-7.1 References: https://bugzilla.suse.com/958871

1 0

openSUSE-RU-2016:0222-1: moderate: Recommended update for mate-menu
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for mate-menu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0222-1 Rating: moderate References: #959024 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-menu fixes the following issues: - Update to 5.6.7: + Fix intends in mate-menu execute.py. + Do not use mate-folder.png that doesn't exist in freedesktop specification. + Fix configurator crash due to changes in Gtk 2.24.29. + Do not crash if lsb_release is not available (boo#959024). - Only recommend lsb-release. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-91=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): mate-menu-5.6.7-7.1 mate-menu-lang-5.6.7-7.1 References: https://bugzilla.suse.com/959024

1 0

openSUSE-RU-2016:0221-1: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0221-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh January 18th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-87=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201601180000-38.1 References:

1 0

openSUSE-RU-2016:0220-1: Recommended update for yast2-slp-server
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for yast2-slp-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0220-1 Rating: low References: #878892 #954494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-slp-server fixes the following issues: - Fix handling of broken options in configuration file. (bsc#878892, bsc#954494) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-88=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-slp-server-3.1.4-5.1 References: https://bugzilla.suse.com/878892 https://bugzilla.suse.com/954494

1 0

openSUSE-RU-2016:0219-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0219-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for calibre fixes the following issues: - Update to 2.49.0: + A new tool to easily export and import all calibre data -- books, settings and plugins. + Get Books: Add plugins for Amazon Australia and Amazon India. Also restore the Amazon EU plugins (lp#1526089). + PDF Input: Fix conversion of PDF documents that contain ASCII control codes in their outlines not working (lp#1527697). + Driver for Energy Ereader Screenlight (lp#1529108). + E-book viewer: Add an option to allow only a single book to be viewed at a time. Trying to view a second book will cause it to replace the currently viewed book (lp#1526504). + Kobo driver: Add support for the new firmware 3.19.5761. + Get Books: Update plugins for various Polish language book stores to handle changes to the website. + Amazon metadata download: Handle a change in the amazon website that prevented review metadata from being downloaded. + Download calibre plugins securely using HTTPS. + MOBI Output: Try to autofix corrupted PNG images in the input document (lp#1531738). + Nook Glowlight Plus: Send files by default to the NOOK/My Files folder (lp#1531394). + E-book viewer: Fix failure to view comic files that contain non-ASCII characters int heir internal filenames (lp#1530517). + And more, for details see http://calibre-ebook.com/whats-new Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-89=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): calibre-2.49.0-14.1 calibre-debuginfo-2.49.0-14.1 calibre-debugsource-2.49.0-14.1 References:

1 0

openSUSE-SU-2016:0218-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0218-1 Rating: moderate References: #948969 #961916 Cross-References: CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to cgit 0.12 fixes the following issues: - CVE-2016-1899: Reflected Cross Site Scripting and Header Injection in Mimetype Query String - CVE-2016-1900: Stored Cross Site Scripting and Header Injection in Filename Parameter - CVE-2016-1901: Integer Overflow resulting in Buffer Overflow The bundled git version was updated to 2.7.0. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-86=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cgit-0.12-11.6.1 cgit-debuginfo-0.12-11.6.1 cgit-debugsource-0.12-11.6.1 References: https://www.suse.com/security/cve/CVE-2016-1899.html https://www.suse.com/security/cve/CVE-2016-1900.html https://www.suse.com/security/cve/CVE-2016-1901.html https://bugzilla.suse.com/948969 https://bugzilla.suse.com/961916

1 0

openSUSE-SU-2016:0217-1: jasper
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0217-1 Rating: low References: #725758 #830803 #881716 #961886 Cross-References: CVE-2014-8138 CVE-2016-1867 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for jasper fixes the following issues: - CVE-2016-1867: Out-of-bounds Read could cause a crash (boo#961886) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-83=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): jasper-1.900.1-160.16.1 jasper-debuginfo-1.900.1-160.16.1 jasper-debugsource-1.900.1-160.16.1 libjasper-devel-1.900.1-160.16.1 libjasper1-1.900.1-160.16.1 libjasper1-debuginfo-1.900.1-160.16.1 - openSUSE 13.1 (x86_64): libjasper1-32bit-1.900.1-160.16.1 libjasper1-debuginfo-32bit-1.900.1-160.16.1 References: https://www.suse.com/security/cve/CVE-2014-8138.html https://www.suse.com/security/cve/CVE-2016-1867.html https://bugzilla.suse.com/725758 https://bugzilla.suse.com/830803 https://bugzilla.suse.com/881716 https://bugzilla.suse.com/961886

1 0

openSUSE-SU-2016:0216-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0216-1 Rating: moderate References: #863933 #875216 #953110 Cross-References: CVE-2015-5313 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: Maintenance update for openSUSE13.1 libvirt package. - Fix cve-2015-5313: directory directory traversal privilege escalation vulnerability. e8643ef6-cve-2015-5313.patch bsc#953110 - qemu: Call qemuSetupHostdevCGroup later during hotplug 05e149f9-call-qemuSetupHostdevCGroup-later.patch qemu: hotplug: Only label hostdev after checking device conflicts ee414b5d-fix-qemu-hotplug-usb-hostdev.patch bsc#863933 - libxl: support virtual sound devices in HVM domains c0d3f608-libxl-soundhw.patch bsc#875216 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-82=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libvirt-1.1.2-2.51.1 libvirt-client-1.1.2-2.51.1 libvirt-client-debuginfo-1.1.2-2.51.1 libvirt-daemon-1.1.2-2.51.1 libvirt-daemon-config-network-1.1.2-2.51.1 libvirt-daemon-config-nwfilter-1.1.2-2.51.1 libvirt-daemon-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-interface-1.1.2-2.51.1 libvirt-daemon-driver-interface-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-lxc-1.1.2-2.51.1 libvirt-daemon-driver-lxc-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-network-1.1.2-2.51.1 libvirt-daemon-driver-network-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-nodedev-1.1.2-2.51.1 libvirt-daemon-driver-nodedev-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-nwfilter-1.1.2-2.51.1 libvirt-daemon-driver-nwfilter-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-qemu-1.1.2-2.51.1 libvirt-daemon-driver-qemu-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-secret-1.1.2-2.51.1 libvirt-daemon-driver-secret-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-storage-1.1.2-2.51.1 libvirt-daemon-driver-storage-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-uml-1.1.2-2.51.1 libvirt-daemon-driver-uml-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-vbox-1.1.2-2.51.1 libvirt-daemon-driver-vbox-debuginfo-1.1.2-2.51.1 libvirt-daemon-lxc-1.1.2-2.51.1 libvirt-daemon-qemu-1.1.2-2.51.1 libvirt-daemon-uml-1.1.2-2.51.1 libvirt-daemon-vbox-1.1.2-2.51.1 libvirt-debugsource-1.1.2-2.51.1 libvirt-devel-1.1.2-2.51.1 libvirt-doc-1.1.2-2.51.1 libvirt-lock-sanlock-1.1.2-2.51.1 libvirt-lock-sanlock-debuginfo-1.1.2-2.51.1 libvirt-login-shell-1.1.2-2.51.1 libvirt-login-shell-debuginfo-1.1.2-2.51.1 libvirt-python-1.1.2-2.51.1 libvirt-python-debuginfo-1.1.2-2.51.1 - openSUSE 13.1 (x86_64): libvirt-client-32bit-1.1.2-2.51.1 libvirt-client-debuginfo-32bit-1.1.2-2.51.1 libvirt-daemon-driver-libxl-1.1.2-2.51.1 libvirt-daemon-driver-libxl-debuginfo-1.1.2-2.51.1 libvirt-daemon-driver-xen-1.1.2-2.51.1 libvirt-daemon-driver-xen-debuginfo-1.1.2-2.51.1 libvirt-daemon-xen-1.1.2-2.51.1 libvirt-devel-32bit-1.1.2-2.51.1 References: https://www.suse.com/security/cve/CVE-2015-5313.html https://bugzilla.suse.com/863933 https://bugzilla.suse.com/875216 https://bugzilla.suse.com/953110

1 0

openSUSE-SU-2016:0215-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0215-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-85=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libtiff-devel-4.0.6-8.13.1 libtiff5-4.0.6-8.13.1 libtiff5-debuginfo-4.0.6-8.13.1 tiff-4.0.6-8.13.1 tiff-debuginfo-4.0.6-8.13.1 tiff-debugsource-4.0.6-8.13.1 - openSUSE 13.1 (x86_64): libtiff-devel-32bit-4.0.6-8.13.1 libtiff5-32bit-4.0.6-8.13.1 libtiff5-debuginfo-32bit-4.0.6-8.13.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0

openSUSE-SU-2016:0214-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0214-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to 1.0.8 - Add workaround for https://bugs.php.net/bug.php?id=70757 (#1490582) - Fix HTML sanitizer to skip  in output (#1490583) - Fix charset encoding of message/rfc822 part bodies (#1490606) - Fix handling of message/rfc822 attachments on replies and forwards (#1490607) - Fix PDF support detection in Firefox > 19 (#1490610) - Fix path traversal vulnerability (CWE-22) in setting a skin (#1490620) [CVE-2015-8770] [bnc#962067] - Fix so drag-n-drop of text (e.g. recipient addresses) on compose page actually works (#1490619) - Fix .htaccess rewrite rules to not block .well-known URIs (#1490615) - Updated apache2 config Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-84=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): roundcubemail-1.0.8-2.27.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0