October 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2524-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2524-1 Rating: moderate References: #1001215 #999199 Cross-References: CVE-2016-7044 CVE-2016-7045 CVE-2016-7553 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The IRC client irssi was updated to 0.8.20, fixing various bugs and security issues. * CVE-2016-7044: The unformat_24bit_color function in the format parsing code in Irssi, when compiled with true-color enabled, allowed remote attackers to cause a denial of service (heap corruption and crash) via an incomplete 24bit color code. * CVE-2016-7045: The format_send_to_gui function in the format parsing code in Irssi allowed remote attackers to cause a denial of service (heap corruption and crash) via vectors involving the length of a string. See https://irssi.org/security/irssi_sa_2016.txt for more details. * CVE-2016-7553: A information disclosure vulnerability in irssi buf.pl See https://irssi.org/2016/09/22/buf.pl-update/ for more information. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 5661=1 - openSUSE 13.2: zypper in -t patch 5661=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): irssi-0.8.20-6.1 irssi-debuginfo-0.8.20-6.1 irssi-debugsource-0.8.20-6.1 irssi-devel-0.8.20-6.1 - openSUSE 13.2 (i586 x86_64): irssi-0.8.20-3.4.1 irssi-debuginfo-0.8.20-3.4.1 irssi-debugsource-0.8.20-3.4.1 irssi-devel-0.8.20-3.4.1 References: https://www.suse.com/security/cve/CVE-2016-7044.html https://www.suse.com/security/cve/CVE-2016-7045.html https://www.suse.com/security/cve/CVE-2016-7553.html https://bugzilla.suse.com/1001215 https://bugzilla.suse.com/999199

1 0

openSUSE-SU-2016:2522-1: important: Security update for systemd
by opensuse-security＠opensuse.org 13 Oct '16

13 Oct '16

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2522-1 Rating: important References: #1000435 #1001765 #954374 #970293 #982211 #996269 Cross-References: CVE-2016-7796 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for systemd fixes the following issues: - CVE-2016-7796: A zero-length message received over systemd's notification socket could make manager_dispatch_notify_fd() return an error and, as a side effect, disable the notification handler completely. As the notification socket is world-writable, this could have allowed a local user to perform a denial-of-service attack against systemd. (bsc#1001765) Additionally, the following non-security fixes are included: - Fix HMAC calculation when appending a data object to journal. (bsc#1000435) - Never accept file descriptors from file systems with mandatory locking enabled. (bsc#954374) - Do not warn about missing install info with "preset". (bsc#970293) - Save /run/systemd/users/UID before starting user@.service. (bsc#996269) - Make sure that /var/lib/systemd/sysv-convert/database is always initialized. (bsc#982211) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1184=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgudev-1_0-0-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-0-debuginfo-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-devel-210.1475218254.1e76ce0-25.48.1 libudev-devel-210.1475218254.1e76ce0-25.48.1 libudev-mini-devel-210.1475218254.1e76ce0-25.48.1 libudev-mini1-210.1475218254.1e76ce0-25.48.1 libudev-mini1-debuginfo-210.1475218254.1e76ce0-25.48.1 libudev1-210.1475218254.1e76ce0-25.48.1 libudev1-debuginfo-210.1475218254.1e76ce0-25.48.1 nss-myhostname-210.1475218254.1e76ce0-25.48.1 nss-myhostname-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-210.1475218254.1e76ce0-25.48.1 systemd-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-debugsource-210.1475218254.1e76ce0-25.48.1 systemd-devel-210.1475218254.1e76ce0-25.48.1 systemd-journal-gateway-210.1475218254.1e76ce0-25.48.1 systemd-journal-gateway-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-logger-210.1475218254.1e76ce0-25.48.1 systemd-mini-210.1475218254.1e76ce0-25.48.1 systemd-mini-debuginfo-210.1475218254.1e76ce0-25.48.1 systemd-mini-debugsource-210.1475218254.1e76ce0-25.48.1 systemd-mini-devel-210.1475218254.1e76ce0-25.48.1 systemd-mini-sysvinit-210.1475218254.1e76ce0-25.48.1 systemd-sysvinit-210.1475218254.1e76ce0-25.48.1 typelib-1_0-GUdev-1_0-210.1475218254.1e76ce0-25.48.1 udev-210.1475218254.1e76ce0-25.48.1 udev-debuginfo-210.1475218254.1e76ce0-25.48.1 udev-mini-210.1475218254.1e76ce0-25.48.1 udev-mini-debuginfo-210.1475218254.1e76ce0-25.48.1 - openSUSE 13.2 (noarch): systemd-bash-completion-210.1475218254.1e76ce0-25.48.1 - openSUSE 13.2 (x86_64): libgudev-1_0-0-32bit-210.1475218254.1e76ce0-25.48.1 libgudev-1_0-0-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 libudev1-32bit-210.1475218254.1e76ce0-25.48.1 libudev1-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 nss-myhostname-32bit-210.1475218254.1e76ce0-25.48.1 nss-myhostname-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 systemd-32bit-210.1475218254.1e76ce0-25.48.1 systemd-debuginfo-32bit-210.1475218254.1e76ce0-25.48.1 References: https://www.suse.com/security/cve/CVE-2016-7796.html https://bugzilla.suse.com/1000435 https://bugzilla.suse.com/1001765 https://bugzilla.suse.com/954374 https://bugzilla.suse.com/970293 https://bugzilla.suse.com/982211 https://bugzilla.suse.com/996269

1 0

openSUSE-RU-2016:2521-1: Recommended update for timezone
by maintenance＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2521-1 Rating: low References: #997830 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016g) for your system, including the following changes: - Turkey will remain on UTC+03 after 2016-10-30. (bsc#997830) - Antarctica and nautical time zones now use numeric time zone abbreviations instead of obsolete alphanumeric ones. - Renamed Asia/Rangoon to Asia/Yangon. This release also includes changes affecting past time stamps and documentation. This update was imported from the SUSE:SLE-12:Update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1180=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016g-0.28.1 timezone-debuginfo-2016g-0.28.1 timezone-debugsource-2016g-0.28.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016g-0.28.1 References: https://bugzilla.suse.com/997830

1 0

openSUSE-RU-2016:2520-1: important: Recommended update for timezone
by maintenance＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2520-1 Rating: important References: #1003324 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for timezone fixes the following issues: - boo#1003324: Prevent broken symlinks of /etc/localtime with timezone code version 2016g Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1181=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2016g-55.1 timezone-debuginfo-2016g-55.1 timezone-debugsource-2016g-55.1 - openSUSE 13.2 (noarch): timezone-java-2016g-55.1 References: https://bugzilla.suse.com/1003324

1 0

openSUSE-SU-2016:2519-1: moderate: Security update for flash-player
by opensuse-security＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2519-1 Rating: moderate References: #1003993 #1004019 Cross-References: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for flash-player fixes the following security issues: - CVE-2016-4273: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-4286: Unspecified security bypass vulnerability - CVE-2016-6981: Unspecified use-after-free vulnerability that could lead to code execution - CVE-2016-6982: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6983: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6984: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6985: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6986: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6987: Unspecified use-after-free vulnerability that could lead to code execution - CVE-2016-6989: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6990: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6992: Unspecified type confusion vulnerability that could lead to code execution The EULA was updated to version 23.0 (boo#1003993). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-1179=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.637-2.112.1 flash-player-gnome-11.2.202.637-2.112.1 flash-player-kde4-11.2.202.637-2.112.1 References: https://www.suse.com/security/cve/CVE-2016-4273.html https://www.suse.com/security/cve/CVE-2016-4286.html https://www.suse.com/security/cve/CVE-2016-6981.html https://www.suse.com/security/cve/CVE-2016-6982.html https://www.suse.com/security/cve/CVE-2016-6983.html https://www.suse.com/security/cve/CVE-2016-6984.html https://www.suse.com/security/cve/CVE-2016-6985.html https://www.suse.com/security/cve/CVE-2016-6986.html https://www.suse.com/security/cve/CVE-2016-6987.html https://www.suse.com/security/cve/CVE-2016-6989.html https://www.suse.com/security/cve/CVE-2016-6990.html https://www.suse.com/security/cve/CVE-2016-6992.html https://bugzilla.suse.com/1003993 https://bugzilla.suse.com/1004019

1 0

openSUSE-RU-2016:2518-1: Recommended update for rubygem-puppet
by maintenance＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Recommended Update: Recommended update for rubygem-puppet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2518-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rubygem-puppet fixes the following issues: - Fix sysconfig_filename parameters in %fillup_only macros. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1182=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ruby2.1-rubygem-puppet-3.8.7-15.1 ruby2.1-rubygem-puppet-doc-3.8.7-15.1 ruby2.1-rubygem-puppet-testsuite-3.8.7-15.1 rubygem-puppet-3.8.7-15.1 rubygem-puppet-master-3.8.7-15.1 - openSUSE Leap 42.1 (noarch): rubygem-puppet-emacs-3.8.7-15.1 rubygem-puppet-master-unicorn-3.8.7-15.1 rubygem-puppet-vim-3.8.7-15.1 References:

1 0

openSUSE-SU-2016:2517-1: moderate: Security update for flash-player
by opensuse-security＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2517-1 Rating: moderate References: #1003993 #1004019 Cross-References: CVE-2016-4273 CVE-2016-4286 CVE-2016-6981 CVE-2016-6982 CVE-2016-6983 CVE-2016-6984 CVE-2016-6985 CVE-2016-6986 CVE-2016-6987 CVE-2016-6989 CVE-2016-6990 CVE-2016-6992 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for flash-player fixes the following security issues: - CVE-2016-4273: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-4286: Unspecified security bypass vulnerability - CVE-2016-6981: Unspecified use-after-free vulnerability that could lead to code execution - CVE-2016-6982: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6983: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6984: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6985: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6986: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6987: Unspecified use-after-free vulnerability that could lead to code execution - CVE-2016-6989: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6990: Unspecified memory corruption vulnerability that could lead to code execution - CVE-2016-6992: Unspecified type confusion vulnerability that could lead to code execution The EULA was updated to version 23.0 (boo#1003993). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-1183=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.637-174.1 flash-player-gnome-11.2.202.637-174.1 flash-player-kde4-11.2.202.637-174.1 References: https://www.suse.com/security/cve/CVE-2016-4273.html https://www.suse.com/security/cve/CVE-2016-4286.html https://www.suse.com/security/cve/CVE-2016-6981.html https://www.suse.com/security/cve/CVE-2016-6982.html https://www.suse.com/security/cve/CVE-2016-6983.html https://www.suse.com/security/cve/CVE-2016-6984.html https://www.suse.com/security/cve/CVE-2016-6985.html https://www.suse.com/security/cve/CVE-2016-6986.html https://www.suse.com/security/cve/CVE-2016-6987.html https://www.suse.com/security/cve/CVE-2016-6989.html https://www.suse.com/security/cve/CVE-2016-6990.html https://www.suse.com/security/cve/CVE-2016-6992.html https://bugzilla.suse.com/1003993 https://bugzilla.suse.com/1004019

1 0

openSUSE-SU-2016:2516-1: moderate: Security update for python-suds-jurko
by opensuse-security＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Security Update: Security update for python-suds-jurko ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2516-1 Rating: moderate References: #827568 Cross-References: CVE-2013-2217 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-suds-jurko fixes the following issues: - CVE-2013-2217: A temporary directory was used in an insecure fashion when initializing file-based URL cache. (boo#827568) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1178=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-suds-jurko-0.6-4.1 References: https://www.suse.com/security/cve/CVE-2013-2217.html https://bugzilla.suse.com/827568

1 0

openSUSE-RU-2016:2504-1: Recommended update for dom4j
by maintenance＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Recommended Update: Recommended update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2504-1 Rating: low References: #998531 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dom4j fixes the following issues: - Include the STAXEventReader and STAXEventWriter classes (bsc#998531) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1175=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): dom4j-1.6.1-28.1 dom4j-demo-1.6.1-28.1 dom4j-javadoc-1.6.1-28.1 dom4j-manual-1.6.1-28.1 References: https://bugzilla.suse.com/998531

1 0

openSUSE-RU-2016:2503-1: moderate: Recommended update for puppet
by maintenance＠opensuse.org 12 Oct '16

12 Oct '16

openSUSE Recommended Update: Recommended update for puppet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2503-1 Rating: moderate References: #995975 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for puppet fixes the following issue: - Replace the greps with %fillup-only macros to update the sysconfig files properly [boo#995975] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1176=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): puppet-3.8.5-15.1 puppet-server-3.8.5-15.1 - openSUSE 13.2 (noarch): puppet-vim-3.8.5-15.1 References: https://bugzilla.suse.com/995975

1 0