January 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0199-1: important: Security update for bind
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0199-1 Rating: important References: #962189 Cross-References: CVE-2015-8704 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2015-8704: Specific APL data allowed remote attacker to trigger a crash in certain configurations (bsc#962189) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-71=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.16.1 bind-chrootenv-9.9.6P1-2.16.1 bind-debuginfo-9.9.6P1-2.16.1 bind-debugsource-9.9.6P1-2.16.1 bind-devel-9.9.6P1-2.16.1 bind-libs-9.9.6P1-2.16.1 bind-libs-debuginfo-9.9.6P1-2.16.1 bind-lwresd-9.9.6P1-2.16.1 bind-lwresd-debuginfo-9.9.6P1-2.16.1 bind-utils-9.9.6P1-2.16.1 bind-utils-debuginfo-9.9.6P1-2.16.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.16.1 bind-libs-debuginfo-32bit-9.9.6P1-2.16.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.16.1 References: https://www.suse.com/security/cve/CVE-2015-8704.html https://bugzilla.suse.com/962189

1 0

openSUSE-SU-2016:0197-1: important: Security update for bind
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0197-1 Rating: important References: #962189 Cross-References: CVE-2015-8704 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2015-8704: Specific APL data allowed remote attacker to trigger a crash in certain configurations (bsc#962189) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-70=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.6P1-30.1 bind-chrootenv-9.9.6P1-30.1 bind-debuginfo-9.9.6P1-30.1 bind-debugsource-9.9.6P1-30.1 bind-devel-9.9.6P1-30.1 bind-libs-9.9.6P1-30.1 bind-libs-debuginfo-9.9.6P1-30.1 bind-lwresd-9.9.6P1-30.1 bind-lwresd-debuginfo-9.9.6P1-30.1 bind-utils-9.9.6P1-30.1 bind-utils-debuginfo-9.9.6P1-30.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.6P1-30.1 bind-libs-debuginfo-32bit-9.9.6P1-30.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.6P1-30.1 References: https://www.suse.com/security/cve/CVE-2015-8704.html https://bugzilla.suse.com/962189

1 0

openSUSE-SU-2016:0196-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 22 Jan '16

22 Jan '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0196-1 Rating: moderate References: #961916 Cross-References: CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to cgit 0.12 fixes the following issues: - CVE-2016-1899: Reflected Cross Site Scripting and Header Injection in Mimetype Query String - CVE-2016-1900: Stored Cross Site Scripting and Header Injection in Filename Parameter - CVE-2016-1901: Integer Overflow resulting in Buffer Overflow The bundled git version was updated to 2.7.0. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-69=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-69=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cgit-0.12-6.1 cgit-debuginfo-0.12-6.1 cgit-debugsource-0.12-6.1 - openSUSE 13.2 (i586 x86_64): cgit-0.12-13.6.1 cgit-debuginfo-0.12-13.6.1 cgit-debugsource-0.12-13.6.1 References: https://www.suse.com/security/cve/CVE-2016-1899.html https://www.suse.com/security/cve/CVE-2016-1900.html https://www.suse.com/security/cve/CVE-2016-1901.html https://bugzilla.suse.com/961916

1 0

openSUSE-SU-2016:0188-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 21 Jan '16

21 Jan '16

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0188-1 Rating: moderate References: #960674 Cross-References: CVE-2015-8710 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxml2 fixes the following security issue: - CVE-2015-8710: Parsing short unclosed HTML comment could cause uninitialized memory access, which allowed remote attackers to read contents from previous HTTP requests depending on the application (bsc#960674) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-68=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libxml2-2-2.9.1-13.1 libxml2-2-debuginfo-2.9.1-13.1 libxml2-debugsource-2.9.1-13.1 libxml2-devel-2.9.1-13.1 libxml2-tools-2.9.1-13.1 libxml2-tools-debuginfo-2.9.1-13.1 python-libxml2-2.9.1-13.1 python-libxml2-debuginfo-2.9.1-13.1 python-libxml2-debugsource-2.9.1-13.1 - openSUSE Leap 42.1 (x86_64): libxml2-2-32bit-2.9.1-13.1 libxml2-2-debuginfo-32bit-2.9.1-13.1 libxml2-devel-32bit-2.9.1-13.1 - openSUSE Leap 42.1 (noarch): libxml2-doc-2.9.1-13.1 References: https://www.suse.com/security/cve/CVE-2015-8710.html https://bugzilla.suse.com/960674

1 0

openSUSE-SU-2016:0179-1: moderate: Security update for cups-filters
by opensuse-security＠opensuse.org 20 Jan '16

20 Jan '16

openSUSE Security Update: Security update for cups-filters ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0179-1 Rating: moderate References: #957531 Cross-References: CVE-2015-8327 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue: CVE-2015-8327 adds backtick and semicolon to the list of illegal shell escape characters (bsc#957531). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-67=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cups-filters-1.0.58-12.1 cups-filters-cups-browsed-1.0.58-12.1 cups-filters-cups-browsed-debuginfo-1.0.58-12.1 cups-filters-debuginfo-1.0.58-12.1 cups-filters-debugsource-1.0.58-12.1 cups-filters-devel-1.0.58-12.1 cups-filters-foomatic-rip-1.0.58-12.1 cups-filters-foomatic-rip-debuginfo-1.0.58-12.1 cups-filters-ghostscript-1.0.58-12.1 cups-filters-ghostscript-debuginfo-1.0.58-12.1 References: https://www.suse.com/security/cve/CVE-2015-8327.html https://bugzilla.suse.com/957531

1 0

openSUSE-RU-2016:0177-1: moderate: Recommended update for efivar
by maintenance＠opensuse.org 20 Jan '16

20 Jan '16

openSUSE Recommended Update: Recommended update for efivar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0177-1 Rating: moderate References: #961664 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for efivar fixes the following issues: - Fix the return value checking of _get_common_guidname(). (boo#961664) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-66=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): efivar-0.20-5.1 efivar-debuginfo-0.20-5.1 efivar-debugsource-0.20-5.1 efivar-devel-0.20-5.1 libefivar0-0.20-5.1 libefivar0-debuginfo-0.20-5.1 References: https://bugzilla.suse.com/961664

1 0

openSUSE-RU-2016:0172-1: Recommended update for suse-xsl-stylesheets
by maintenance＠opensuse.org 19 Jan '16

19 Jan '16

openSUSE Recommended Update: Recommended update for suse-xsl-stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0172-1 Rating: low References: #929630 #954969 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for suse-xsl-stylesheets provides the following fixes: - Fix wrong company name displayed in PDF builds. (bsc#929630) - Make sure that FOP does not cut off long admonitions. - Make sure that the string "Publication Date" is always capitalized. - Add Hungarian translation for "Publication Date" string. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-62=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): suse-xsl-stylesheets-2.0.3.2-9.1 References: https://bugzilla.suse.com/929630 https://bugzilla.suse.com/954969

1 0

openSUSE-RU-2016:0171-1: Recommended update for deltarpm
by maintenance＠opensuse.org 19 Jan '16

19 Jan '16

openSUSE Recommended Update: Recommended update for deltarpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0171-1 Rating: low References: #948504 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for deltarpm provides the following fixes: - Fix off-by-one error in delta generation code which could lead to a segmentation fault in some rare circumstances. (bsc#948504) - Return error rather than crashing if memory allocation fails. - Add newline in missing prelink error. - Do not finish applydeltarpm jobs when in the middle of a request. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-63=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): deltarpm-3.6.1-7.1 deltarpm-debuginfo-3.6.1-7.1 deltarpm-debugsource-3.6.1-7.1 python-deltarpm-3.6.1-7.1 python-deltarpm-debuginfo-3.6.1-7.1 References: https://bugzilla.suse.com/948504

1 0

openSUSE-RU-2016:0170-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 19 Jan '16

19 Jan '16

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0170-1 Rating: moderate References: #960500 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kio fixes the following issues: - Fixed display of file/directory modification time in kio_ftp (boo#960500, kde#354597) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-64=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kio-5.16.0-9.1 kio-core-5.16.0-9.1 kio-core-debuginfo-5.16.0-9.1 kio-debuginfo-5.16.0-9.1 kio-debugsource-5.16.0-9.1 kio-devel-5.16.0-9.1 kio-devel-debuginfo-5.16.0-9.1 - openSUSE Leap 42.1 (x86_64): kio-32bit-5.16.0-9.1 kio-core-32bit-5.16.0-9.1 kio-core-debuginfo-32bit-5.16.0-9.1 kio-debuginfo-32bit-5.16.0-9.1 kio-devel-32bit-5.16.0-9.1 kio-devel-debuginfo-32bit-5.16.0-9.1 - openSUSE Leap 42.1 (noarch): kio-lang-5.16.0-9.1 References: https://bugzilla.suse.com/960500

1 0

openSUSE-SU-2016:0163-1: moderate: Security update for perl-Module-Signature
by opensuse-security＠opensuse.org 19 Jan '16

19 Jan '16

openSUSE Security Update: Security update for perl-Module-Signature ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0163-1 Rating: moderate References: #928382 Cross-References: CVE-2015-3406 CVE-2015-3407 CVE-2015-3408 CVE-2015-3409 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to perl-Module-Signature 0.79 fixes the following security issues: * More protection of @INC from relative paths. (CVE-2015-3409) * Fix GPG signature parsing logic. (CVE-2015-3406) * MANIFEST.SKIP is no longer consulted unless --skip is given. (CVE-2015-3407) * Properly use open() modes to avoid injection attacks. (CVE-2015-3408) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-61=1 - openSUSE 13.1: zypper in -t patch openSUSE-2016-61=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): perl-Module-Signature-0.79-4.4.1 - openSUSE 13.1 (noarch): perl-Module-Signature-0.79-2.4.1 References: https://www.suse.com/security/cve/CVE-2015-3406.html https://www.suse.com/security/cve/CVE-2015-3407.html https://www.suse.com/security/cve/CVE-2015-3408.html https://www.suse.com/security/cve/CVE-2015-3409.html https://bugzilla.suse.com/928382

1 0