October 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2543-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2543-1 Rating: moderate References: #999701 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for Mozilla Thunderbird to version 45.4.0 fixes the following issues: - When using Thunderbird in a browser like context, for rendering HTML e-mail or feeds, it may be affected by vulnerabilities also fixed in Firefox ESR 45.4. (MFSA 2016-86, boo#999701) The following bugs were fixed in this release: - Display name was truncated if no separating space before email address - Recipient addresses were shown in wrong color in some circumstances - Additional spaces were inserted when drafts were edited. - Mail saved as template copied In-Reply-To and References from original email. - Threading broken when editing message draft, due to loss of Message-ID - "Apply columns to..." did not honor special folders Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1195=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-45.4.0-70.89.1 MozillaThunderbird-buildsymbols-45.4.0-70.89.1 MozillaThunderbird-debuginfo-45.4.0-70.89.1 MozillaThunderbird-debugsource-45.4.0-70.89.1 MozillaThunderbird-devel-45.4.0-70.89.1 MozillaThunderbird-translations-common-45.4.0-70.89.1 MozillaThunderbird-translations-other-45.4.0-70.89.1 References: https://bugzilla.suse.com/999701

1 0

openSUSE-SU-2016:2540-1: important: Security update for php5
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2540-1 Rating: important References: #999679 #999680 #999682 #999684 #999685 #999819 #999820 Cross-References: CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for php5 fixes the following security issues: * CVE-2016-7411: php5: Memory corruption when destructing deserialized object * CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field * CVE-2016-7413: Use after free in wddx_deserialize * CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile * CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message * CVE-2016-7417: Missing type check when unserializing SplArray * CVE-2016-7418: Null pointer dereference in php_wddx_push_element This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1193=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-62.1 apache2-mod_php5-debuginfo-5.5.14-62.1 php5-5.5.14-62.1 php5-bcmath-5.5.14-62.1 php5-bcmath-debuginfo-5.5.14-62.1 php5-bz2-5.5.14-62.1 php5-bz2-debuginfo-5.5.14-62.1 php5-calendar-5.5.14-62.1 php5-calendar-debuginfo-5.5.14-62.1 php5-ctype-5.5.14-62.1 php5-ctype-debuginfo-5.5.14-62.1 php5-curl-5.5.14-62.1 php5-curl-debuginfo-5.5.14-62.1 php5-dba-5.5.14-62.1 php5-dba-debuginfo-5.5.14-62.1 php5-debuginfo-5.5.14-62.1 php5-debugsource-5.5.14-62.1 php5-devel-5.5.14-62.1 php5-dom-5.5.14-62.1 php5-dom-debuginfo-5.5.14-62.1 php5-enchant-5.5.14-62.1 php5-enchant-debuginfo-5.5.14-62.1 php5-exif-5.5.14-62.1 php5-exif-debuginfo-5.5.14-62.1 php5-fastcgi-5.5.14-62.1 php5-fastcgi-debuginfo-5.5.14-62.1 php5-fileinfo-5.5.14-62.1 php5-fileinfo-debuginfo-5.5.14-62.1 php5-firebird-5.5.14-62.1 php5-firebird-debuginfo-5.5.14-62.1 php5-fpm-5.5.14-62.1 php5-fpm-debuginfo-5.5.14-62.1 php5-ftp-5.5.14-62.1 php5-ftp-debuginfo-5.5.14-62.1 php5-gd-5.5.14-62.1 php5-gd-debuginfo-5.5.14-62.1 php5-gettext-5.5.14-62.1 php5-gettext-debuginfo-5.5.14-62.1 php5-gmp-5.5.14-62.1 php5-gmp-debuginfo-5.5.14-62.1 php5-iconv-5.5.14-62.1 php5-iconv-debuginfo-5.5.14-62.1 php5-imap-5.5.14-62.1 php5-imap-debuginfo-5.5.14-62.1 php5-intl-5.5.14-62.1 php5-intl-debuginfo-5.5.14-62.1 php5-json-5.5.14-62.1 php5-json-debuginfo-5.5.14-62.1 php5-ldap-5.5.14-62.1 php5-ldap-debuginfo-5.5.14-62.1 php5-mbstring-5.5.14-62.1 php5-mbstring-debuginfo-5.5.14-62.1 php5-mcrypt-5.5.14-62.1 php5-mcrypt-debuginfo-5.5.14-62.1 php5-mssql-5.5.14-62.1 php5-mssql-debuginfo-5.5.14-62.1 php5-mysql-5.5.14-62.1 php5-mysql-debuginfo-5.5.14-62.1 php5-odbc-5.5.14-62.1 php5-odbc-debuginfo-5.5.14-62.1 php5-opcache-5.5.14-62.1 php5-opcache-debuginfo-5.5.14-62.1 php5-openssl-5.5.14-62.1 php5-openssl-debuginfo-5.5.14-62.1 php5-pcntl-5.5.14-62.1 php5-pcntl-debuginfo-5.5.14-62.1 php5-pdo-5.5.14-62.1 php5-pdo-debuginfo-5.5.14-62.1 php5-pgsql-5.5.14-62.1 php5-pgsql-debuginfo-5.5.14-62.1 php5-phar-5.5.14-62.1 php5-phar-debuginfo-5.5.14-62.1 php5-posix-5.5.14-62.1 php5-posix-debuginfo-5.5.14-62.1 php5-pspell-5.5.14-62.1 php5-pspell-debuginfo-5.5.14-62.1 php5-readline-5.5.14-62.1 php5-readline-debuginfo-5.5.14-62.1 php5-shmop-5.5.14-62.1 php5-shmop-debuginfo-5.5.14-62.1 php5-snmp-5.5.14-62.1 php5-snmp-debuginfo-5.5.14-62.1 php5-soap-5.5.14-62.1 php5-soap-debuginfo-5.5.14-62.1 php5-sockets-5.5.14-62.1 php5-sockets-debuginfo-5.5.14-62.1 php5-sqlite-5.5.14-62.1 php5-sqlite-debuginfo-5.5.14-62.1 php5-suhosin-5.5.14-62.1 php5-suhosin-debuginfo-5.5.14-62.1 php5-sysvmsg-5.5.14-62.1 php5-sysvmsg-debuginfo-5.5.14-62.1 php5-sysvsem-5.5.14-62.1 php5-sysvsem-debuginfo-5.5.14-62.1 php5-sysvshm-5.5.14-62.1 php5-sysvshm-debuginfo-5.5.14-62.1 php5-tidy-5.5.14-62.1 php5-tidy-debuginfo-5.5.14-62.1 php5-tokenizer-5.5.14-62.1 php5-tokenizer-debuginfo-5.5.14-62.1 php5-wddx-5.5.14-62.1 php5-wddx-debuginfo-5.5.14-62.1 php5-xmlreader-5.5.14-62.1 php5-xmlreader-debuginfo-5.5.14-62.1 php5-xmlrpc-5.5.14-62.1 php5-xmlrpc-debuginfo-5.5.14-62.1 php5-xmlwriter-5.5.14-62.1 php5-xmlwriter-debuginfo-5.5.14-62.1 php5-xsl-5.5.14-62.1 php5-xsl-debuginfo-5.5.14-62.1 php5-zip-5.5.14-62.1 php5-zip-debuginfo-5.5.14-62.1 php5-zlib-5.5.14-62.1 php5-zlib-debuginfo-5.5.14-62.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-62.1 References: https://www.suse.com/security/cve/CVE-2016-7411.html https://www.suse.com/security/cve/CVE-2016-7412.html https://www.suse.com/security/cve/CVE-2016-7413.html https://www.suse.com/security/cve/CVE-2016-7414.html https://www.suse.com/security/cve/CVE-2016-7416.html https://www.suse.com/security/cve/CVE-2016-7417.html https://www.suse.com/security/cve/CVE-2016-7418.html https://bugzilla.suse.com/999679 https://bugzilla.suse.com/999680 https://bugzilla.suse.com/999682 https://bugzilla.suse.com/999684 https://bugzilla.suse.com/999685 https://bugzilla.suse.com/999819 https://bugzilla.suse.com/999820

1 0

openSUSE-SU-2016:2539-1: important: Security update for systemd
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2539-1 Rating: important References: #1000435 #1001765 #954374 #970293 #982210 #982211 #982251 #987173 #987857 #990074 #996269 Cross-References: CVE-2016-7796 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: This update for systemd fixes the following security issue: - CVE-2016-7796: A zero-length message received over systemd's notification socket could make manager_dispatch_notify_fd() return an error and, as a side effect, disable the notification handler completely. As the notification socket is world-writable, this could have allowed a local user to perform a denial-of-service attack against systemd. (bsc#1001765) Additionally, the following non-security fixes are included: - Fix HMAC calculation when appending a data object to journal. (bsc#1000435) - Never accept file descriptors from file systems with mandatory locking enabled. (bsc#954374) - Do not warn about missing install info with "preset". (bsc#970293) - Save /run/systemd/users/UID before starting user@.service. (bsc#996269) - Make sure that /var/lib/systemd/sysv-convert/database is always initialized. (bsc#982211) - Remove daylight saving time handling and tzfile parser. (bsc#990074) - Make sure directory watch is started before cryptsetup. (bsc#987173) - Introduce sd_pid_notify() and sd_pid_notifyf() APIs. (bsc#987857) - Set KillMode=mixed for our daemons that fork worker processes. - Add nosuid and nodev options to tmp.mount. - Don't start console-getty.service when /dev/console is missing. (bsc#982251) - Correct segmentation fault in udev/path_id due to missing NULL check. (bsc#982210) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1194=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgudev-1_0-0-210-98.1 libgudev-1_0-0-debuginfo-210-98.1 libgudev-1_0-devel-210-98.1 libudev-devel-210-98.1 libudev-mini-devel-210-98.1 libudev-mini1-210-98.1 libudev-mini1-debuginfo-210-98.1 libudev1-210-98.1 libudev1-debuginfo-210-98.1 nss-myhostname-210-98.1 nss-myhostname-debuginfo-210-98.1 systemd-210-98.1 systemd-debuginfo-210-98.1 systemd-debugsource-210-98.1 systemd-devel-210-98.1 systemd-journal-gateway-210-98.1 systemd-journal-gateway-debuginfo-210-98.1 systemd-logger-210-98.1 systemd-mini-210-98.1 systemd-mini-debuginfo-210-98.1 systemd-mini-debugsource-210-98.1 systemd-mini-devel-210-98.1 systemd-mini-sysvinit-210-98.1 systemd-sysvinit-210-98.1 typelib-1_0-GUdev-1_0-210-98.1 udev-210-98.1 udev-debuginfo-210-98.1 udev-mini-210-98.1 udev-mini-debuginfo-210-98.1 - openSUSE Leap 42.1 (noarch): systemd-bash-completion-210-98.1 - openSUSE Leap 42.1 (x86_64): libgudev-1_0-0-32bit-210-98.1 libgudev-1_0-0-debuginfo-32bit-210-98.1 libudev1-32bit-210-98.1 libudev1-debuginfo-32bit-210-98.1 nss-myhostname-32bit-210-98.1 nss-myhostname-debuginfo-32bit-210-98.1 systemd-32bit-210-98.1 systemd-debuginfo-32bit-210-98.1 References: https://www.suse.com/security/cve/CVE-2016-7796.html https://bugzilla.suse.com/1000435 https://bugzilla.suse.com/1001765 https://bugzilla.suse.com/954374 https://bugzilla.suse.com/970293 https://bugzilla.suse.com/982210 https://bugzilla.suse.com/982211 https://bugzilla.suse.com/982251 https://bugzilla.suse.com/987173 https://bugzilla.suse.com/987857 https://bugzilla.suse.com/990074 https://bugzilla.suse.com/996269

1 0

openSUSE-SU-2016:2538-1: Security update for libreoffice
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2538-1 Rating: low References: #1000102 #987553 Cross-References: CVE-2016-4324 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container. (bsc#987553) - Don't use "nullable" for introspection, as it isn't available on SLE 12's version of gobject-introspection. This prevents a segmentation fault in gnome-documents. (bsc#1000102) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1192=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): libreoffice-branding-upstream-5.1.5.2-11.1 libreoffice-gdb-pretty-printers-5.1.5.2-11.1 libreoffice-glade-5.1.5.2-11.1 libreoffice-icon-theme-breeze-5.1.5.2-11.1 libreoffice-icon-theme-galaxy-5.1.5.2-11.1 libreoffice-icon-theme-hicontrast-5.1.5.2-11.1 libreoffice-icon-theme-oxygen-5.1.5.2-11.1 libreoffice-icon-theme-sifr-5.1.5.2-11.1 libreoffice-icon-theme-tango-5.1.5.2-11.1 libreoffice-l10n-af-5.1.5.2-11.1 libreoffice-l10n-ar-5.1.5.2-11.1 libreoffice-l10n-as-5.1.5.2-11.1 libreoffice-l10n-bg-5.1.5.2-11.1 libreoffice-l10n-bn-5.1.5.2-11.1 libreoffice-l10n-br-5.1.5.2-11.1 libreoffice-l10n-ca-5.1.5.2-11.1 libreoffice-l10n-cs-5.1.5.2-11.1 libreoffice-l10n-cy-5.1.5.2-11.1 libreoffice-l10n-da-5.1.5.2-11.1 libreoffice-l10n-de-5.1.5.2-11.1 libreoffice-l10n-dz-5.1.5.2-11.1 libreoffice-l10n-el-5.1.5.2-11.1 libreoffice-l10n-en-5.1.5.2-11.1 libreoffice-l10n-es-5.1.5.2-11.1 libreoffice-l10n-et-5.1.5.2-11.1 libreoffice-l10n-eu-5.1.5.2-11.1 libreoffice-l10n-fa-5.1.5.2-11.1 libreoffice-l10n-fi-5.1.5.2-11.1 libreoffice-l10n-fr-5.1.5.2-11.1 libreoffice-l10n-ga-5.1.5.2-11.1 libreoffice-l10n-gl-5.1.5.2-11.1 libreoffice-l10n-gu-5.1.5.2-11.1 libreoffice-l10n-he-5.1.5.2-11.1 libreoffice-l10n-hi-5.1.5.2-11.1 libreoffice-l10n-hr-5.1.5.2-11.1 libreoffice-l10n-hu-5.1.5.2-11.1 libreoffice-l10n-it-5.1.5.2-11.1 libreoffice-l10n-ja-5.1.5.2-11.1 libreoffice-l10n-kk-5.1.5.2-11.1 libreoffice-l10n-kn-5.1.5.2-11.1 libreoffice-l10n-ko-5.1.5.2-11.1 libreoffice-l10n-lt-5.1.5.2-11.1 libreoffice-l10n-lv-5.1.5.2-11.1 libreoffice-l10n-mai-5.1.5.2-11.1 libreoffice-l10n-ml-5.1.5.2-11.1 libreoffice-l10n-mr-5.1.5.2-11.1 libreoffice-l10n-nb-5.1.5.2-11.1 libreoffice-l10n-nl-5.1.5.2-11.1 libreoffice-l10n-nn-5.1.5.2-11.1 libreoffice-l10n-nr-5.1.5.2-11.1 libreoffice-l10n-nso-5.1.5.2-11.1 libreoffice-l10n-or-5.1.5.2-11.1 libreoffice-l10n-pa-5.1.5.2-11.1 libreoffice-l10n-pl-5.1.5.2-11.1 libreoffice-l10n-pt-BR-5.1.5.2-11.1 libreoffice-l10n-pt-PT-5.1.5.2-11.1 libreoffice-l10n-ro-5.1.5.2-11.1 libreoffice-l10n-ru-5.1.5.2-11.1 libreoffice-l10n-si-5.1.5.2-11.1 libreoffice-l10n-sk-5.1.5.2-11.1 libreoffice-l10n-sl-5.1.5.2-11.1 libreoffice-l10n-sr-5.1.5.2-11.1 libreoffice-l10n-ss-5.1.5.2-11.1 libreoffice-l10n-st-5.1.5.2-11.1 libreoffice-l10n-sv-5.1.5.2-11.1 libreoffice-l10n-ta-5.1.5.2-11.1 libreoffice-l10n-te-5.1.5.2-11.1 libreoffice-l10n-th-5.1.5.2-11.1 libreoffice-l10n-tn-5.1.5.2-11.1 libreoffice-l10n-tr-5.1.5.2-11.1 libreoffice-l10n-ts-5.1.5.2-11.1 libreoffice-l10n-uk-5.1.5.2-11.1 libreoffice-l10n-ve-5.1.5.2-11.1 libreoffice-l10n-xh-5.1.5.2-11.1 libreoffice-l10n-zh-Hans-5.1.5.2-11.1 libreoffice-l10n-zh-Hant-5.1.5.2-11.1 libreoffice-l10n-zu-5.1.5.2-11.1 - openSUSE Leap 42.1 (x86_64): libreoffice-5.1.5.2-11.1 libreoffice-base-5.1.5.2-11.1 libreoffice-base-debuginfo-5.1.5.2-11.1 libreoffice-base-drivers-mysql-5.1.5.2-11.1 libreoffice-base-drivers-mysql-debuginfo-5.1.5.2-11.1 libreoffice-base-drivers-postgresql-5.1.5.2-11.1 libreoffice-base-drivers-postgresql-debuginfo-5.1.5.2-11.1 libreoffice-calc-5.1.5.2-11.1 libreoffice-calc-debuginfo-5.1.5.2-11.1 libreoffice-calc-extensions-5.1.5.2-11.1 libreoffice-debuginfo-5.1.5.2-11.1 libreoffice-debugsource-5.1.5.2-11.1 libreoffice-draw-5.1.5.2-11.1 libreoffice-draw-debuginfo-5.1.5.2-11.1 libreoffice-filters-optional-5.1.5.2-11.1 libreoffice-gnome-5.1.5.2-11.1 libreoffice-gnome-debuginfo-5.1.5.2-11.1 libreoffice-gtk3-5.1.5.2-11.1 libreoffice-gtk3-debuginfo-5.1.5.2-11.1 libreoffice-impress-5.1.5.2-11.1 libreoffice-impress-debuginfo-5.1.5.2-11.1 libreoffice-kde4-5.1.5.2-11.1 libreoffice-kde4-debuginfo-5.1.5.2-11.1 libreoffice-mailmerge-5.1.5.2-11.1 libreoffice-math-5.1.5.2-11.1 libreoffice-math-debuginfo-5.1.5.2-11.1 libreoffice-officebean-5.1.5.2-11.1 libreoffice-officebean-debuginfo-5.1.5.2-11.1 libreoffice-pyuno-5.1.5.2-11.1 libreoffice-pyuno-debuginfo-5.1.5.2-11.1 libreoffice-sdk-5.1.5.2-11.1 libreoffice-sdk-debuginfo-5.1.5.2-11.1 libreoffice-sdk-doc-5.1.5.2-11.1 libreoffice-writer-5.1.5.2-11.1 libreoffice-writer-debuginfo-5.1.5.2-11.1 libreoffice-writer-extensions-5.1.5.2-11.1 libreofficekit-5.1.5.2-11.1 libreofficekit-devel-5.1.5.2-11.1 References: https://www.suse.com/security/cve/CVE-2016-4324.html https://bugzilla.suse.com/1000102 https://bugzilla.suse.com/987553

1 0

openSUSE-SU-2016:2537-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2537-1 Rating: important References: #979475 #982575 #983249 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has four fixes is now available. Description: This update for compat-openssl098 fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Bugs fixed: * update expired S/MIME certs (bsc#979475) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-15.1 libopenssl0_9_8-0.9.8j-15.1 libopenssl0_9_8-debuginfo-0.9.8j-15.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-15.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-15.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668

1 0

openSUSE-SU-2016:2536-1: Security update to go1.4
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update to go1.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2536-1 Rating: low References: #988487 Cross-References: CVE-2016-5386 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: go1.4 was updated to fix the following vulnerabilities: - CVE-2016-5386: Remote attacker could have set the application's HTTP_PROXY environment variable via Proxy headers (boo#988487) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1190=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go1.4-1.4.3-6.1 go1.4-doc-1.4.3-6.1 References: https://www.suse.com/security/cve/CVE-2016-5386.html https://bugzilla.suse.com/988487

1 0

openSUSE-SU-2016:2535-1: moderate: Security update for derby
by opensuse-security＠opensuse.org 14 Oct '16

14 Oct '16

openSUSE Security Update: Security update for derby ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2535-1 Rating: moderate References: #1002763 Cross-References: CVE-2015-1832 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for derby fixes the following issues: - CVE-2015-1832: Remote attackers could have obtained sensitive information via an XML external entity when processing XML (bsc#1002763) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1191=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): derby-10.10.2.0-2.3.1 derby-javadoc-10.10.2.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-1832.html https://bugzilla.suse.com/1002763

1 0

openSUSE-SU-2016:2529-1: Security update for unzip
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2529-1 Rating: low References: #950110 #950111 Cross-References: CVE-2015-7696 CVE-2015-7697 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for unzip fixes the following issues: - CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110) - CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1188=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): unzip-6.00-26.7.1 unzip-debuginfo-6.00-26.7.1 unzip-debugsource-6.00-26.7.1 unzip-doc-6.00-26.7.1 unzip-rcc-6.00-26.7.1 unzip-rcc-debuginfo-6.00-26.7.1 unzip-rcc-debugsource-6.00-26.7.1 References: https://www.suse.com/security/cve/CVE-2015-7696.html https://www.suse.com/security/cve/CVE-2015-7697.html https://bugzilla.suse.com/950110 https://bugzilla.suse.com/950111

1 0

openSUSE-SU-2016:2526-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2526-1 Rating: moderate References: #974449 Cross-References: CVE-2016-3622 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tiff fixes the following security issues: - CVE-2016-3622: A specially crafted TIFF image could trigger a crash in tiff2rgba (boo#974449) - Various out-of-bound write vulnerabilities with unspecified impact (MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1186=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libtiff-devel-4.0.6-10.32.1 libtiff5-4.0.6-10.32.1 libtiff5-debuginfo-4.0.6-10.32.1 tiff-4.0.6-10.32.1 tiff-debuginfo-4.0.6-10.32.1 tiff-debugsource-4.0.6-10.32.1 - openSUSE 13.2 (x86_64): libtiff-devel-32bit-4.0.6-10.32.1 libtiff5-32bit-4.0.6-10.32.1 libtiff5-debuginfo-32bit-4.0.6-10.32.1 References: https://www.suse.com/security/cve/CVE-2016-3622.html https://bugzilla.suse.com/974449

1 0

openSUSE-SU-2016:2525-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2525-1 Rating: moderate References: #974449 #974614 #974618 #975069 #975070 Cross-References: CVE-2016-3622 CVE-2016-3623 CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for tiff fixes the following security issues: - CVE-2016-3622: Specially crafted TIFF images could trigger a crash in tiff2rgba (bsc#974449) - Various out-of-bound write vulnerabilities with unspecified impact (MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098) - CVE-2016-3623: Specially crafted TIFF images could trigger a crash in rgb2ycbcr (bsc#974618) - CVE-2016-3945: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution via tiff2rgba (bsc#974614) - CVE-2016-3990: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution (bsc#975069) - CVE-2016-3991: Specially crafted TIFF images could trigger a crash or allow for arbitrary command execution via the tiffcrop tool (bsc#975070) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1187=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.6-9.1 libtiff5-4.0.6-9.1 libtiff5-debuginfo-4.0.6-9.1 tiff-4.0.6-9.1 tiff-debuginfo-4.0.6-9.1 tiff-debugsource-4.0.6-9.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.6-9.1 libtiff5-32bit-4.0.6-9.1 libtiff5-debuginfo-32bit-4.0.6-9.1 References: https://www.suse.com/security/cve/CVE-2016-3622.html https://www.suse.com/security/cve/CVE-2016-3623.html https://www.suse.com/security/cve/CVE-2016-3945.html https://www.suse.com/security/cve/CVE-2016-3990.html https://www.suse.com/security/cve/CVE-2016-3991.html https://bugzilla.suse.com/974449 https://bugzilla.suse.com/974614 https://bugzilla.suse.com/974618 https://bugzilla.suse.com/975069 https://bugzilla.suse.com/975070

1 0