January 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0213-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0213-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to roundcubemail 1.1.4 fixes the following issues: - CVE-2015-8770: Path traversal vulnerability allowed code execution to remote authenticated users if they were also upload files to the same server through some other method (boo#962067) This update also contains all upstream fixes in 1.1.4. The package was updated to use generic PHP requirements for use with other prefixes than "php5-" Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-80=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): roundcubemail-1.1.4-6.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0

openSUSE-SU-2016:0212-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0212-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-79=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libtiff-devel-4.0.6-10.17.1 libtiff5-4.0.6-10.17.1 libtiff5-debuginfo-4.0.6-10.17.1 tiff-4.0.6-10.17.1 tiff-debuginfo-4.0.6-10.17.1 tiff-debugsource-4.0.6-10.17.1 - openSUSE 13.2 (x86_64): libtiff-devel-32bit-4.0.6-10.17.1 libtiff5-32bit-4.0.6-10.17.1 libtiff5-debuginfo-32bit-4.0.6-10.17.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0

openSUSE-SU-2016:0211-1: Security update for jasper
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0211-1 Rating: low References: #961886 Cross-References: CVE-2016-1867 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jasper fixes the following issues: - CVE-2016-1867: Out-of-bounds Read could cause a crash (boo#961886) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-78=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): jasper-1.900.1-163.16.1 jasper-debuginfo-1.900.1-163.16.1 jasper-debugsource-1.900.1-163.16.1 libjasper-devel-1.900.1-163.16.1 libjasper1-1.900.1-163.16.1 libjasper1-debuginfo-1.900.1-163.16.1 - openSUSE 13.2 (x86_64): libjasper1-32bit-1.900.1-163.16.1 libjasper1-debuginfo-32bit-1.900.1-163.16.1 References: https://www.suse.com/security/cve/CVE-2016-1867.html https://bugzilla.suse.com/961886

1 0

openSUSE-SU-2016:0210-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0210-1 Rating: important References: #962067 Cross-References: CVE-2015-8770 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to roundcubemail 1.0.8 fixes the following issues: - CVE-2015-8770: Path traversal vulnerability allowed code execution to remote authenticated users if they were also upload files to the same server through some other method (boo#962067) This update also contains all upstream fixes in 1.0.8. The package was updated to use generic PHP requirements for use with other prefixes than "php5-" Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-81=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.8-17.1 References: https://www.suse.com/security/cve/CVE-2015-8770.html https://bugzilla.suse.com/962067

1 0

openSUSE-SU-2016:0209-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0209-1 Rating: moderate References: #953110 Cross-References: CVE-2015-5313 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libvirt fixes the following issues: - CVE-2015-5313: directory directory traversal privilege escalation vulnerability. (boo#953110) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-77=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-77=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvirt-1.2.18.2-5.1 libvirt-client-1.2.18.2-5.1 libvirt-client-debuginfo-1.2.18.2-5.1 libvirt-daemon-1.2.18.2-5.1 libvirt-daemon-config-network-1.2.18.2-5.1 libvirt-daemon-config-nwfilter-1.2.18.2-5.1 libvirt-daemon-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-interface-1.2.18.2-5.1 libvirt-daemon-driver-interface-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-lxc-1.2.18.2-5.1 libvirt-daemon-driver-lxc-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-network-1.2.18.2-5.1 libvirt-daemon-driver-network-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-nodedev-1.2.18.2-5.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-nwfilter-1.2.18.2-5.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-qemu-1.2.18.2-5.1 libvirt-daemon-driver-qemu-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-secret-1.2.18.2-5.1 libvirt-daemon-driver-secret-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-storage-1.2.18.2-5.1 libvirt-daemon-driver-storage-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-uml-1.2.18.2-5.1 libvirt-daemon-driver-uml-debuginfo-1.2.18.2-5.1 libvirt-daemon-driver-vbox-1.2.18.2-5.1 libvirt-daemon-driver-vbox-debuginfo-1.2.18.2-5.1 libvirt-daemon-lxc-1.2.18.2-5.1 libvirt-daemon-qemu-1.2.18.2-5.1 libvirt-daemon-uml-1.2.18.2-5.1 libvirt-daemon-vbox-1.2.18.2-5.1 libvirt-debugsource-1.2.18.2-5.1 libvirt-devel-1.2.18.2-5.1 libvirt-doc-1.2.18.2-5.1 libvirt-lock-sanlock-1.2.18.2-5.1 libvirt-lock-sanlock-debuginfo-1.2.18.2-5.1 libvirt-login-shell-1.2.18.2-5.1 libvirt-login-shell-debuginfo-1.2.18.2-5.1 - openSUSE Leap 42.1 (x86_64): libvirt-client-32bit-1.2.18.2-5.1 libvirt-client-debuginfo-32bit-1.2.18.2-5.1 libvirt-daemon-driver-libxl-1.2.18.2-5.1 libvirt-daemon-driver-libxl-debuginfo-1.2.18.2-5.1 libvirt-daemon-xen-1.2.18.2-5.1 libvirt-devel-32bit-1.2.18.2-5.1 - openSUSE 13.2 (i586 x86_64): libvirt-1.2.9-28.1 libvirt-client-1.2.9-28.1 libvirt-client-debuginfo-1.2.9-28.1 libvirt-daemon-1.2.9-28.1 libvirt-daemon-config-network-1.2.9-28.1 libvirt-daemon-config-nwfilter-1.2.9-28.1 libvirt-daemon-debuginfo-1.2.9-28.1 libvirt-daemon-driver-interface-1.2.9-28.1 libvirt-daemon-driver-interface-debuginfo-1.2.9-28.1 libvirt-daemon-driver-lxc-1.2.9-28.1 libvirt-daemon-driver-lxc-debuginfo-1.2.9-28.1 libvirt-daemon-driver-network-1.2.9-28.1 libvirt-daemon-driver-network-debuginfo-1.2.9-28.1 libvirt-daemon-driver-nodedev-1.2.9-28.1 libvirt-daemon-driver-nodedev-debuginfo-1.2.9-28.1 libvirt-daemon-driver-nwfilter-1.2.9-28.1 libvirt-daemon-driver-nwfilter-debuginfo-1.2.9-28.1 libvirt-daemon-driver-qemu-1.2.9-28.1 libvirt-daemon-driver-qemu-debuginfo-1.2.9-28.1 libvirt-daemon-driver-secret-1.2.9-28.1 libvirt-daemon-driver-secret-debuginfo-1.2.9-28.1 libvirt-daemon-driver-storage-1.2.9-28.1 libvirt-daemon-driver-storage-debuginfo-1.2.9-28.1 libvirt-daemon-driver-uml-1.2.9-28.1 libvirt-daemon-driver-uml-debuginfo-1.2.9-28.1 libvirt-daemon-driver-vbox-1.2.9-28.1 libvirt-daemon-driver-vbox-debuginfo-1.2.9-28.1 libvirt-daemon-lxc-1.2.9-28.1 libvirt-daemon-qemu-1.2.9-28.1 libvirt-daemon-uml-1.2.9-28.1 libvirt-daemon-vbox-1.2.9-28.1 libvirt-debugsource-1.2.9-28.1 libvirt-devel-1.2.9-28.1 libvirt-doc-1.2.9-28.1 libvirt-lock-sanlock-1.2.9-28.1 libvirt-lock-sanlock-debuginfo-1.2.9-28.1 libvirt-login-shell-1.2.9-28.1 libvirt-login-shell-debuginfo-1.2.9-28.1 - openSUSE 13.2 (x86_64): libvirt-client-32bit-1.2.9-28.1 libvirt-client-debuginfo-32bit-1.2.9-28.1 libvirt-daemon-driver-libxl-1.2.9-28.1 libvirt-daemon-driver-libxl-debuginfo-1.2.9-28.1 libvirt-daemon-driver-xen-1.2.9-28.1 libvirt-daemon-driver-xen-debuginfo-1.2.9-28.1 libvirt-daemon-xen-1.2.9-28.1 libvirt-devel-32bit-1.2.9-28.1 References: https://www.suse.com/security/cve/CVE-2015-5313.html https://bugzilla.suse.com/953110

1 0

openSUSE-SU-2016:0207-1: important: Security update for giflib
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0207-1 Rating: important References: #949160 #960319 Cross-References: CVE-2015-7555 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The following patch fixes - a heap overflow in giffix - a memory leak in libgif6 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-76=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): giflib-debugsource-5.0.5-2.3.1 giflib-devel-5.0.5-2.3.1 giflib-progs-5.0.5-2.3.1 giflib-progs-debuginfo-5.0.5-2.3.1 libgif6-5.0.5-2.3.1 libgif6-debuginfo-5.0.5-2.3.1 - openSUSE 13.1 (x86_64): giflib-devel-32bit-5.0.5-2.3.1 libgif6-32bit-5.0.5-2.3.1 libgif6-debuginfo-32bit-5.0.5-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-7555.html https://bugzilla.suse.com/949160 https://bugzilla.suse.com/960319

1 0

openSUSE-RU-2016:0206-1: moderate: Recommended update for snapper
by maintenance＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Recommended Update: Recommended update for snapper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0206-1 Rating: moderate References: #954445 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for snapper ensures a roll-back operation will only be executed for the root file system. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-74=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libsnapper-devel-0.2.9.1-3.1 libsnapper3-0.2.9.1-3.1 libsnapper3-debuginfo-0.2.9.1-3.1 pam_snapper-0.2.9.1-3.1 pam_snapper-debuginfo-0.2.9.1-3.1 snapper-0.2.9.1-3.1 snapper-debuginfo-0.2.9.1-3.1 snapper-debugsource-0.2.9.1-3.1 - openSUSE Leap 42.1 (noarch): snapper-zypp-plugin-0.2.9.1-3.1 References: https://bugzilla.suse.com/954445

1 0

openSUSE-SU-2016:0204-1: important: Security update for bind
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0204-1 Rating: important References: #962189 Cross-References: CVE-2015-8704 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2015-8704: Specific APL data allowed remote attacker to trigger a crash in certain configurations (bsc#962189) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-73=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.23.1 bind-chrootenv-9.9.4P2-2.23.1 bind-debuginfo-9.9.4P2-2.23.1 bind-debugsource-9.9.4P2-2.23.1 bind-devel-9.9.4P2-2.23.1 bind-libs-9.9.4P2-2.23.1 bind-libs-debuginfo-9.9.4P2-2.23.1 bind-lwresd-9.9.4P2-2.23.1 bind-lwresd-debuginfo-9.9.4P2-2.23.1 bind-utils-9.9.4P2-2.23.1 bind-utils-debuginfo-9.9.4P2-2.23.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.23.1 bind-libs-debuginfo-32bit-9.9.4P2-2.23.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.23.1 References: https://www.suse.com/security/cve/CVE-2015-8704.html https://bugzilla.suse.com/962189

1 0

openSUSE-RU-2016:0203-1: moderate: Recommended update for kfilemetadata5
by maintenance＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Recommended Update: Recommended update for kfilemetadata5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0203-1 Rating: moderate References: #914316 #927466 #953957 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for poppler and kfilemetadata5 fixes the following issues: - poppler + Graphical issue with a fillable PDF file -fix annotations with transparent color in PDF files (boo#914316) + Poppler die not display standard ligatures correctly (boo#927466) This update also contains the new poppler-qt5 package. This update was imported from the SUSE:SLE-12:Update update project. - kfilemetadata5 + Build against poppler-qt5 on SLE12 and Leap 42 as well, it is available meanwhile (boo#953957) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-75=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kfilemetadata5-5.16.0-6.1 kfilemetadata5-debuginfo-5.16.0-6.1 kfilemetadata5-debugsource-5.16.0-6.1 kfilemetadata5-devel-5.16.0-6.1 libpoppler-cpp0-0.24.4-7.1 libpoppler-cpp0-debuginfo-0.24.4-7.1 libpoppler-devel-0.24.4-7.1 libpoppler-glib-devel-0.24.4-7.1 libpoppler-glib8-0.24.4-7.1 libpoppler-glib8-debuginfo-0.24.4-7.1 libpoppler-qt4-4-0.24.4-7.1 libpoppler-qt4-4-debuginfo-0.24.4-7.1 libpoppler-qt4-devel-0.24.4-7.1 libpoppler-qt5-1-0.24.4-7.1 libpoppler-qt5-1-debuginfo-0.24.4-7.1 libpoppler-qt5-devel-0.24.4-7.1 libpoppler44-0.24.4-7.1 libpoppler44-debuginfo-0.24.4-7.1 poppler-debugsource-0.24.4-7.1 poppler-qt-debugsource-0.24.4-7.1 poppler-qt5-debugsource-0.24.4-7.1 poppler-tools-0.24.4-7.1 poppler-tools-debuginfo-0.24.4-7.1 typelib-1_0-Poppler-0_18-0.24.4-7.1 - openSUSE Leap 42.1 (x86_64): kfilemetadata5-32bit-5.16.0-6.1 kfilemetadata5-debuginfo-32bit-5.16.0-6.1 - openSUSE Leap 42.1 (noarch): kfilemetadata5-lang-5.16.0-6.1 References: https://bugzilla.suse.com/914316 https://bugzilla.suse.com/927466 https://bugzilla.suse.com/953957

1 0

openSUSE-SU-2016:0201-1: moderate: Security update for giflib
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0201-1 Rating: moderate References: #949160 #960319 Cross-References: CVE-2015-7555 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for giflib fixes the following issues: - CVE-2015-7555: Heap overflow in giffix (bsc#960319) - bsc#949160: Fix a memory leak Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-72=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): giflib-debugsource-5.0.5-4.3.1 giflib-devel-5.0.5-4.3.1 giflib-progs-5.0.5-4.3.1 giflib-progs-debuginfo-5.0.5-4.3.1 libgif6-5.0.5-4.3.1 libgif6-debuginfo-5.0.5-4.3.1 - openSUSE 13.2 (x86_64): giflib-devel-32bit-5.0.5-4.3.1 libgif6-32bit-5.0.5-4.3.1 libgif6-debuginfo-32bit-5.0.5-4.3.1 References: https://www.suse.com/security/cve/CVE-2015-7555.html https://bugzilla.suse.com/949160 https://bugzilla.suse.com/960319

1 0