November 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2770-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 10 Nov '16

10 Nov '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2770-1 Rating: moderate References: #1000394 #1000399 #1000434 #1000436 #1000686 #1000688 #1000689 #1000690 #1000691 #1000692 #1000693 #1000694 #1000695 #1000696 #1000697 #1000698 #1000699 #1000700 #1000701 #1000702 #1000703 #1000704 #1000706 #1000707 #1000708 #1000709 #1000711 #1000712 #1000713 #1000714 #1000715 #1001066 #1001221 #1002206 #1002209 #1002421 #1002422 #1003629 #1005123 #1005125 #1005127 #1005328 Cross-References: CVE-2014-9907 CVE-2015-8957 CVE-2015-8958 CVE-2015-8959 CVE-2016-6823 CVE-2016-7101 CVE-2016-7513 CVE-2016-7514 CVE-2016-7515 CVE-2016-7516 CVE-2016-7517 CVE-2016-7518 CVE-2016-7519 CVE-2016-7520 CVE-2016-7521 CVE-2016-7522 CVE-2016-7523 CVE-2016-7524 CVE-2016-7525 CVE-2016-7526 CVE-2016-7527 CVE-2016-7528 CVE-2016-7529 CVE-2016-7530 CVE-2016-7531 CVE-2016-7532 CVE-2016-7533 CVE-2016-7534 CVE-2016-7535 CVE-2016-7537 CVE-2016-7538 CVE-2016-7539 CVE-2016-7540 CVE-2016-7799 CVE-2016-7800 CVE-2016-7996 CVE-2016-7997 CVE-2016-8677 CVE-2016-8682 CVE-2016-8683 CVE-2016-8684 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 41 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact. - CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123) - CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127) - CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125) - CVE-2016-8677: Memory allocation failure in AcquireQuantumPixels (bsc#1005328) - CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629) - CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422) - CVE-2016-7799: mogrify global buffer overflow (bsc#1002421) - CVE-2016-7540: writing to RGF format aborts (bsc#1000394) - CVE-2016-7539: Potential DOS by not releasing memory (bsc#1000715) - CVE-2016-7538: SIGABRT for corrupted pdb file (bsc#1000712) - CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711) - CVE-2016-7535: Out of bound access for corrupted psd file (bsc#1000709) - CVE-2016-7534: Out of bound access in generic decoder (bsc#1000708) - CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707) - CVE-2016-7532: fix handling of corrupted psd file (bsc#1000706) - CVE-2016-7531: Pbd file out of bound access (bsc#1000704) - CVE-2016-7530: Out of bound in quantum handling (bsc#1000703) - CVE-2016-7529: Out-of-bound in quantum handling (bsc#1000399) - CVE-2016-7528: Out-of-bound access in xcf file coder (bsc#1000434) - CVE-2016-7527: Out-of-bound access in wpg file coder: (bsc#1000436) - CVE-2016-7526: out-of-bounds write in ./MagickCore/pixel-accessor.h (bsc#1000702) - CVE-2016-7525: Heap buffer overflow in psd file coder (bsc#1000701) - CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700) - CVE-2016-7523: AddressSanitizer:heap-buffer-overflow READ of size 1 meta.c:496 (bsc#1000699) - CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698) - CVE-2016-7521: Heap buffer overflow in psd file handling (bsc#1000697) - CVE-2016-7520: Heap overflow in hdr file handling (bsc#1000696) - CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695) - CVE-2016-7518: Out-of-bounds read in coders/sun.c (bsc#1000694) - CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693) - CVE-2016-7516: Out-of-bounds problem in rle, pict, viff and sun files (bsc#1000692) - CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689) - CVE-2016-7514: Out-of-bounds read in coders/psd.c (bsc#1000688) - CVE-2016-7513: Off-by-one error leading to segfault (bsc#1000686) - CVE-2016-7101: raphicsMagick: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221) - CVE-2016-6823: raphicsMagick: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066) - CVE-2015-8959: dOS due to corrupted DDS files (bsc#1000713) - CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691) - CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690) - CVE-2014-9907: DOS due to corrupted DDS files (bsc#1000714) - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209) - Divide by zero in WriteTIFFImage (bsc#1002206) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-21.1 ImageMagick-debuginfo-6.8.8.1-21.1 ImageMagick-debugsource-6.8.8.1-21.1 ImageMagick-devel-6.8.8.1-21.1 ImageMagick-extra-6.8.8.1-21.1 ImageMagick-extra-debuginfo-6.8.8.1-21.1 libMagick++-6_Q16-3-6.8.8.1-21.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-21.1 libMagick++-devel-6.8.8.1-21.1 libMagickCore-6_Q16-1-6.8.8.1-21.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-21.1 libMagickWand-6_Q16-1-6.8.8.1-21.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-21.1 perl-PerlMagick-6.8.8.1-21.1 perl-PerlMagick-debuginfo-6.8.8.1-21.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-21.1 libMagick++-6_Q16-3-32bit-6.8.8.1-21.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-21.1 libMagick++-devel-32bit-6.8.8.1-21.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-21.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-21.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-21.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-21.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-21.1 References: https://www.suse.com/security/cve/CVE-2014-9907.html https://www.suse.com/security/cve/CVE-2015-8957.html https://www.suse.com/security/cve/CVE-2015-8958.html https://www.suse.com/security/cve/CVE-2015-8959.html https://www.suse.com/security/cve/CVE-2016-6823.html https://www.suse.com/security/cve/CVE-2016-7101.html https://www.suse.com/security/cve/CVE-2016-7513.html https://www.suse.com/security/cve/CVE-2016-7514.html https://www.suse.com/security/cve/CVE-2016-7515.html https://www.suse.com/security/cve/CVE-2016-7516.html https://www.suse.com/security/cve/CVE-2016-7517.html https://www.suse.com/security/cve/CVE-2016-7518.html https://www.suse.com/security/cve/CVE-2016-7519.html https://www.suse.com/security/cve/CVE-2016-7520.html https://www.suse.com/security/cve/CVE-2016-7521.html https://www.suse.com/security/cve/CVE-2016-7522.html https://www.suse.com/security/cve/CVE-2016-7523.html https://www.suse.com/security/cve/CVE-2016-7524.html https://www.suse.com/security/cve/CVE-2016-7525.html https://www.suse.com/security/cve/CVE-2016-7526.html https://www.suse.com/security/cve/CVE-2016-7527.html https://www.suse.com/security/cve/CVE-2016-7528.html https://www.suse.com/security/cve/CVE-2016-7529.html https://www.suse.com/security/cve/CVE-2016-7530.html https://www.suse.com/security/cve/CVE-2016-7531.html https://www.suse.com/security/cve/CVE-2016-7532.html https://www.suse.com/security/cve/CVE-2016-7533.html https://www.suse.com/security/cve/CVE-2016-7534.html https://www.suse.com/security/cve/CVE-2016-7535.html https://www.suse.com/security/cve/CVE-2016-7537.html https://www.suse.com/security/cve/CVE-2016-7538.html https://www.suse.com/security/cve/CVE-2016-7539.html https://www.suse.com/security/cve/CVE-2016-7540.html https://www.suse.com/security/cve/CVE-2016-7799.html https://www.suse.com/security/cve/CVE-2016-7800.html https://www.suse.com/security/cve/CVE-2016-7996.html https://www.suse.com/security/cve/CVE-2016-7997.html https://www.suse.com/security/cve/CVE-2016-8677.html https://www.suse.com/security/cve/CVE-2016-8682.html https://www.suse.com/security/cve/CVE-2016-8683.html https://www.suse.com/security/cve/CVE-2016-8684.html https://bugzilla.suse.com/1000394 https://bugzilla.suse.com/1000399 https://bugzilla.suse.com/1000434 https://bugzilla.suse.com/1000436 https://bugzilla.suse.com/1000686 https://bugzilla.suse.com/1000688 https://bugzilla.suse.com/1000689 https://bugzilla.suse.com/1000690 https://bugzilla.suse.com/1000691 https://bugzilla.suse.com/1000692 https://bugzilla.suse.com/1000693 https://bugzilla.suse.com/1000694 https://bugzilla.suse.com/1000695 https://bugzilla.suse.com/1000696 https://bugzilla.suse.com/1000697 https://bugzilla.suse.com/1000698 https://bugzilla.suse.com/1000699 https://bugzilla.suse.com/1000700 https://bugzilla.suse.com/1000701 https://bugzilla.suse.com/1000702 https://bugzilla.suse.com/1000703 https://bugzilla.suse.com/1000704 https://bugzilla.suse.com/1000706 https://bugzilla.suse.com/1000707 https://bugzilla.suse.com/1000708 https://bugzilla.suse.com/1000709 https://bugzilla.suse.com/1000711 https://bugzilla.suse.com/1000712 https://bugzilla.suse.com/1000713 https://bugzilla.suse.com/1000714 https://bugzilla.suse.com/1000715 https://bugzilla.suse.com/1001066 https://bugzilla.suse.com/1001221 https://bugzilla.suse.com/1002206 https://bugzilla.suse.com/1002209 https://bugzilla.suse.com/1002421 https://bugzilla.suse.com/1002422 https://bugzilla.suse.com/1003629 https://bugzilla.suse.com/1005123 https://bugzilla.suse.com/1005125 https://bugzilla.suse.com/1005127 https://bugzilla.suse.com/1005328

1 0

openSUSE-SU-2016:2769-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 10 Nov '16

10 Nov '16

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2769-1 Rating: important References: #1005555 #1005557 #1005558 #1005560 #1005561 #1005562 #1005563 #1005566 #1005567 #1005569 #1005570 #1005581 #1005582 #1005583 #1005586 #971456 #977614 #983938 #986251 #989911 #989913 #989914 #989915 #989919 #989921 #989922 #989925 #989926 #990890 #998309 #999666 Cross-References: CVE-2016-2105 CVE-2016-3459 CVE-2016-3477 CVE-2016-3486 CVE-2016-3492 CVE-2016-3501 CVE-2016-3521 CVE-2016-3614 CVE-2016-3615 CVE-2016-5439 CVE-2016-5440 CVE-2016-5507 CVE-2016-5584 CVE-2016-5609 CVE-2016-5612 CVE-2016-5616 CVE-2016-5617 CVE-2016-5626 CVE-2016-5627 CVE-2016-5629 CVE-2016-5630 CVE-2016-6304 CVE-2016-6662 CVE-2016-7440 CVE-2016-8283 CVE-2016-8284 CVE-2016-8288 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 27 vulnerabilities and has four fixes is now available. Description: mysql-community-server was updated to 5.6.34 to fix the following issues: * Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-34.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-33.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-32.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-31.html * fixed CVEs: CVE-2016-6304, CVE-2016-6662, CVE-2016-7440, CVE-2016-5584, CVE-2016-5617, CVE-2016-5616, CVE-2016-5626, CVE-2016-3492, CVE-2016-5629, CVE-2016-5507, CVE-2016-8283, CVE-2016-5609, CVE-2016-5612, CVE-2016-5627, CVE-2016-5630, CVE-2016-8284, CVE-2016-8288, CVE-2016-3477, CVE-2016-2105, CVE-2016-3486, CVE-2016-3501, CVE-2016-3521, CVE-2016-3615, CVE-2016-3614, CVE-2016-3459, CVE-2016-5439, CVE-2016-5440 * fixes SUSE Bugs: [boo#999666], [boo#998309], [boo#1005581], [boo#1005558], [boo#1005563], [boo#1005562], [boo#1005566], [boo#1005555], [boo#1005569], [boo#1005557], [boo#1005582], [boo#1005560], [boo#1005561], [boo#1005567], [boo#1005570], [boo#1005583], [boo#1005586], [boo#989913], [boo#977614], [boo#989914], [boo#989915], [boo#989919], [boo#989922], [boo#989921], [boo#989911], [boo#989925], [boo#989926] - append "--ignore-db-dir=lost+found" to the mysqld options in "mysql-systemd-helper" script if "lost+found" directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql(a)default.service [boo#971456] - replace all occurrences of the string "@sysconfdir@" with "/etc" in mysql-community-server-5.6.3-logrotate.patch as it wasn't expanded properly [boo#990890] - remove '%define _rundir' as 13.1 is out of support scope - run 'usermod -g mysql mysql' only if mysql user is not in mysql group. Run 'usermod -s /bin/false/ mysql' only if mysql user doesn't have '/bin/false' shell set. - re-enable mysql profiling Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1283=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.34-19.2 libmysql56client18-debuginfo-5.6.34-19.2 libmysql56client_r18-5.6.34-19.2 mysql-community-server-5.6.34-19.2 mysql-community-server-bench-5.6.34-19.2 mysql-community-server-bench-debuginfo-5.6.34-19.2 mysql-community-server-client-5.6.34-19.2 mysql-community-server-client-debuginfo-5.6.34-19.2 mysql-community-server-debuginfo-5.6.34-19.2 mysql-community-server-debugsource-5.6.34-19.2 mysql-community-server-errormessages-5.6.34-19.2 mysql-community-server-test-5.6.34-19.2 mysql-community-server-test-debuginfo-5.6.34-19.2 mysql-community-server-tools-5.6.34-19.2 mysql-community-server-tools-debuginfo-5.6.34-19.2 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.34-19.2 libmysql56client18-debuginfo-32bit-5.6.34-19.2 libmysql56client_r18-32bit-5.6.34-19.2 - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.34-2.23.1 libmysql56client18-debuginfo-5.6.34-2.23.1 libmysql56client_r18-5.6.34-2.23.1 mysql-community-server-5.6.34-2.23.1 mysql-community-server-bench-5.6.34-2.23.1 mysql-community-server-bench-debuginfo-5.6.34-2.23.1 mysql-community-server-client-5.6.34-2.23.1 mysql-community-server-client-debuginfo-5.6.34-2.23.1 mysql-community-server-debuginfo-5.6.34-2.23.1 mysql-community-server-debugsource-5.6.34-2.23.1 mysql-community-server-errormessages-5.6.34-2.23.1 mysql-community-server-test-5.6.34-2.23.1 mysql-community-server-test-debuginfo-5.6.34-2.23.1 mysql-community-server-tools-5.6.34-2.23.1 mysql-community-server-tools-debuginfo-5.6.34-2.23.1 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.34-2.23.1 libmysql56client18-debuginfo-32bit-5.6.34-2.23.1 libmysql56client_r18-32bit-5.6.34-2.23.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-3459.html https://www.suse.com/security/cve/CVE-2016-3477.html https://www.suse.com/security/cve/CVE-2016-3486.html https://www.suse.com/security/cve/CVE-2016-3492.html https://www.suse.com/security/cve/CVE-2016-3501.html https://www.suse.com/security/cve/CVE-2016-3521.html https://www.suse.com/security/cve/CVE-2016-3614.html https://www.suse.com/security/cve/CVE-2016-3615.html https://www.suse.com/security/cve/CVE-2016-5439.html https://www.suse.com/security/cve/CVE-2016-5440.html https://www.suse.com/security/cve/CVE-2016-5507.html https://www.suse.com/security/cve/CVE-2016-5584.html https://www.suse.com/security/cve/CVE-2016-5609.html https://www.suse.com/security/cve/CVE-2016-5612.html https://www.suse.com/security/cve/CVE-2016-5616.html https://www.suse.com/security/cve/CVE-2016-5617.html https://www.suse.com/security/cve/CVE-2016-5626.html https://www.suse.com/security/cve/CVE-2016-5627.html https://www.suse.com/security/cve/CVE-2016-5629.html https://www.suse.com/security/cve/CVE-2016-5630.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6662.html https://www.suse.com/security/cve/CVE-2016-7440.html https://www.suse.com/security/cve/CVE-2016-8283.html https://www.suse.com/security/cve/CVE-2016-8284.html https://www.suse.com/security/cve/CVE-2016-8288.html https://bugzilla.suse.com/1005555 https://bugzilla.suse.com/1005557 https://bugzilla.suse.com/1005558 https://bugzilla.suse.com/1005560 https://bugzilla.suse.com/1005561 https://bugzilla.suse.com/1005562 https://bugzilla.suse.com/1005563 https://bugzilla.suse.com/1005566 https://bugzilla.suse.com/1005567 https://bugzilla.suse.com/1005569 https://bugzilla.suse.com/1005570 https://bugzilla.suse.com/1005581 https://bugzilla.suse.com/1005582 https://bugzilla.suse.com/1005583 https://bugzilla.suse.com/1005586 https://bugzilla.suse.com/971456 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/983938 https://bugzilla.suse.com/986251 https://bugzilla.suse.com/989911 https://bugzilla.suse.com/989913 https://bugzilla.suse.com/989914 https://bugzilla.suse.com/989915 https://bugzilla.suse.com/989919 https://bugzilla.suse.com/989921 https://bugzilla.suse.com/989922 https://bugzilla.suse.com/989925 https://bugzilla.suse.com/989926 https://bugzilla.suse.com/990890 https://bugzilla.suse.com/998309 https://bugzilla.suse.com/999666

1 0

openSUSE-SU-2016:2768-1: important: Security update for curl
by opensuse-security＠opensuse.org 10 Nov '16

10 Nov '16

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2768-1 Rating: important References: #1005633 #1005634 #1005635 #1005637 #1005638 #1005640 #1005642 #1005643 #1005645 #1005646 #998760 Cross-References: CVE-2016-7167 CVE-2016-8615 CVE-2016-8616 CVE-2016-8617 CVE-2016-8618 CVE-2016-8619 CVE-2016-8620 CVE-2016-8621 CVE-2016-8622 CVE-2016-8623 CVE-2016-8624 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for curl fixes the following security issues: - CVE-2016-8624: invalid URL parsing with '#' (bsc#1005646) - CVE-2016-8623: Use-after-free via shared cookies (bsc#1005645) - CVE-2016-8622: URL unescape heap overflow via integer truncation (bsc#1005643) - CVE-2016-8621: curl_getdate read out of bounds (bsc#1005642) - CVE-2016-8620: glob parser write/read out of bounds (bsc#1005640) - CVE-2016-8619: double-free in krb5 code (bsc#1005638) - CVE-2016-8618: double-free in curl_maprintf (bsc#1005637) - CVE-2016-8617: OOB write via unchecked multiplication (bsc#1005635) - CVE-2016-8616: case insensitive password comparison (bsc#1005634) - CVE-2016-8615: cookie injection for other servers (bsc#1005633) - CVE-2016-7167: escape and unescape integer overflows (bsc#998760) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): curl-7.37.0-16.1 curl-debuginfo-7.37.0-16.1 curl-debugsource-7.37.0-16.1 libcurl-devel-7.37.0-16.1 libcurl4-7.37.0-16.1 libcurl4-debuginfo-7.37.0-16.1 - openSUSE Leap 42.1 (x86_64): libcurl-devel-32bit-7.37.0-16.1 libcurl4-32bit-7.37.0-16.1 libcurl4-debuginfo-32bit-7.37.0-16.1 References: https://www.suse.com/security/cve/CVE-2016-7167.html https://www.suse.com/security/cve/CVE-2016-8615.html https://www.suse.com/security/cve/CVE-2016-8616.html https://www.suse.com/security/cve/CVE-2016-8617.html https://www.suse.com/security/cve/CVE-2016-8618.html https://www.suse.com/security/cve/CVE-2016-8619.html https://www.suse.com/security/cve/CVE-2016-8620.html https://www.suse.com/security/cve/CVE-2016-8621.html https://www.suse.com/security/cve/CVE-2016-8622.html https://www.suse.com/security/cve/CVE-2016-8623.html https://www.suse.com/security/cve/CVE-2016-8624.html https://bugzilla.suse.com/1005633 https://bugzilla.suse.com/1005634 https://bugzilla.suse.com/1005635 https://bugzilla.suse.com/1005637 https://bugzilla.suse.com/1005638 https://bugzilla.suse.com/1005640 https://bugzilla.suse.com/1005642 https://bugzilla.suse.com/1005643 https://bugzilla.suse.com/1005645 https://bugzilla.suse.com/1005646 https://bugzilla.suse.com/998760

1 0

openSUSE-RU-2016:2760-1: Recommended update for clamav-database
by maintenance＠opensuse.org 09 Nov '16

09 Nov '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2760-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Nov 7th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201611070004-179.1 References:

1 0

openSUSE-RU-2016:2759-1: Recommended update for timezone
by maintenance＠opensuse.org 09 Nov '16

09 Nov '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2759-1 Rating: low References: #1007725 #1007726 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest timezone information (2016i) for your system, including the following changes: - Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on 2017-01-15 at 03:00. (bsc#1007725) - Northern Cyprus is now +03 year round, causing a split in Cyprus time zones starting 2016-10-30 at 04:00. This creates a zone Asia/Famagusta. (bsc#1007726) - Antarctica/Casey switched from +08 to +11 on 2016-10-22. - Asia/Gaza and Asia/Hebron end DST on 2016-10-29 at 01:00, not 2016-10-21 at 00:00. - Asia/Colombo now uses numeric time zone abbreviations. This release also includes changes affecting past time stamps and documentation. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016i-31.1 timezone-debuginfo-2016i-31.1 timezone-debugsource-2016i-31.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016i-0.31.1 References: https://bugzilla.suse.com/1007725 https://bugzilla.suse.com/1007726

1 0

openSUSE-RU-2016:2755-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 09 Nov '16

09 Nov '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2755-1 Rating: moderate References: #1007725 #1007726 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest time zone definitions for your system (2016i), incorporating the following changes: - Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on 2017-01-15 at 03:00. [boo#1007725] - Northern Cyprus is now +03 year round, causing a split in Cyprus time zones starting 2016-10-30 at 04:00. This creates a zone Asia/Famagusta [boo#1007726] - Antarctica/Casey switched from +08 to +11 on 2016-10-22 - Corrections to pre-1975 timestamps in Italy Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch 5747=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2016i-60.1 timezone-debuginfo-2016i-60.1 timezone-debugsource-2016i-60.1 - openSUSE 13.2 (noarch): timezone-java-2016i-60.1 References: https://bugzilla.suse.com/1007725 https://bugzilla.suse.com/1007726

1 0

openSUSE-SU-2016:2752-1: moderate: Security update for nodejs
by opensuse-security＠opensuse.org 09 Nov '16

09 Nov '16

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2752-1 Rating: moderate References: Cross-References: CVE-2016-5180 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs fixes the following issues: - New upstream LTS version 4.6.1 * c-ares: + CVE-2016-5180: fix for single-byte buffer overwrite - Fix nodejs-libpath.patch so ppc doesn't fail to build Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1277=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.6.1-36.1 nodejs-debuginfo-4.6.1-36.1 nodejs-debugsource-4.6.1-36.1 nodejs-devel-4.6.1-36.1 npm-4.6.1-36.1 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.6.1-36.1 - openSUSE 13.2 (i586 x86_64): nodejs-4.6.1-27.1 nodejs-debuginfo-4.6.1-27.1 nodejs-debugsource-4.6.1-27.1 nodejs-devel-4.6.1-27.1 - openSUSE 13.2 (noarch): nodejs-doc-4.6.1-27.1 References: https://www.suse.com/security/cve/CVE-2016-5180.html

1 0

openSUSE-RU-2016:2750-1: Recommended update for mksusecd
by maintenance＠opensuse.org 08 Nov '16

08 Nov '16

openSUSE Recommended Update: Recommended update for mksusecd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2750-1 Rating: low References: #957847 #991935 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mksusecd fixes the following issues: - Extended help text and added some small fixes - Fix choosing an add-on name - Be less restrictive when generating add-on aliases - Support creating add-ons on the target iso (boo#991935) - Catch error when we fail to unpack squashfs images - Handle modules.order and modules.builtin when updating a kernel - tw support: Also sign image files - Sanitize function that removes files from iso - Remove tumbleweed images in 'micro' format - Create missing 'content' file - Adjust list of specially handled initrd modules - Add hashes for license and control file - Support uncompressed initrd (boo#957847) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1276=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): mksusecd-1.42-6.1 References: https://bugzilla.suse.com/957847 https://bugzilla.suse.com/991935

1 0

openSUSE-RU-2016:2749-1: Recommended update for mkdud
by maintenance＠opensuse.org 08 Nov '16

08 Nov '16

openSUSE Recommended Update: Recommended update for mkdud ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2749-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for mkdud fixes the following issues: - Add support for leap and tumbleweed - Remove warning on yast replacement for versions supporting it. - Better public key file detection - Added --obs-keys option to retrieve necessary obs project keys - Use mkpath instead of make_path to be compatible with older perl versions - Suppport adding public pgp keys for rpm verification Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1275=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): mkdud-1.25-6.1 References:

1 0

openSUSE-SU-2016:2746-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 08 Nov '16

08 Nov '16

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2746-1 Rating: important References: #1003800 #1005561 #1005570 #949520 #971456 #983938 #984858 #986251 #989913 #989919 #989922 #989926 #990890 #998309 Cross-References: CVE-2016-3477 CVE-2016-3521 CVE-2016-3615 CVE-2016-5440 CVE-2016-5612 CVE-2016-5630 CVE-2016-6662 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 7 fixes is now available. Description: This update for mariadb to 10.0.27 fixes the following issues: * release notes: * https://kb.askmonty.org/en/mariadb-10027-release-notes * https://kb.askmonty.org/en/mariadb-10026-release-notes * changelog: * https://kb.askmonty.org/en/mariadb-10027-changelog * https://kb.askmonty.org/en/mariadb-10026-changelog * fixed CVE's 10.0.27: CVE-2016-5612, CVE-2016-5630, CVE-2016-6662 10.0.26: CVE-2016-5440, CVE-2016-3615, CVE-2016-3521, CVE-2016-3477 * fix: [boo#1005561], [boo#1005570], [boo#998309], [boo#989926], [boo#989922], [boo#989919], [boo#989913] - requires devel packages for aio and lzo2 - remove mariadb-10.0.21-mysql-test_main_bootstrap.patch that is no longer needed [boo#984858] - append "--ignore-db-dir=lost+found" to the mysqld options in "mysql-systemd-helper" script if "lost+found" directory is found in $datadir [boo#986251] - remove syslog.target from *.service files [boo#983938] - add systemd to deps to build on leap and friends - replace '%{_libexecdir}/systemd/system' with %{_unitdir} macro - remove useless mysql(a)default.service [boo#971456] - make ORDER BY optimization functions take into account multiple equalities [boo#949520] - adjust mysql-test results in order to take account of a new option (orderby_uses_equalities) added by the optimizer patch [boo#1003800] - replace all occurrences of the string "@sysconfdir@" with "/etc" in mysql-community-server-5.1.46-logrotate.patch as it wasn't expanded properly [boo#990890] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysqlclient-devel-10.0.27-2.27.1 libmysqlclient18-10.0.27-2.27.1 libmysqlclient18-debuginfo-10.0.27-2.27.1 libmysqlclient_r18-10.0.27-2.27.1 libmysqld-devel-10.0.27-2.27.1 libmysqld18-10.0.27-2.27.1 libmysqld18-debuginfo-10.0.27-2.27.1 mariadb-10.0.27-2.27.1 mariadb-bench-10.0.27-2.27.1 mariadb-bench-debuginfo-10.0.27-2.27.1 mariadb-client-10.0.27-2.27.1 mariadb-client-debuginfo-10.0.27-2.27.1 mariadb-debuginfo-10.0.27-2.27.1 mariadb-debugsource-10.0.27-2.27.1 mariadb-errormessages-10.0.27-2.27.1 mariadb-test-10.0.27-2.27.1 mariadb-test-debuginfo-10.0.27-2.27.1 mariadb-tools-10.0.27-2.27.1 mariadb-tools-debuginfo-10.0.27-2.27.1 - openSUSE 13.2 (x86_64): libmysqlclient18-32bit-10.0.27-2.27.1 libmysqlclient18-debuginfo-32bit-10.0.27-2.27.1 libmysqlclient_r18-32bit-10.0.27-2.27.1 References: https://www.suse.com/security/cve/CVE-2016-3477.html https://www.suse.com/security/cve/CVE-2016-3521.html https://www.suse.com/security/cve/CVE-2016-3615.html https://www.suse.com/security/cve/CVE-2016-5440.html https://www.suse.com/security/cve/CVE-2016-5612.html https://www.suse.com/security/cve/CVE-2016-5630.html https://www.suse.com/security/cve/CVE-2016-6662.html https://bugzilla.suse.com/1003800 https://bugzilla.suse.com/1005561 https://bugzilla.suse.com/1005570 https://bugzilla.suse.com/949520 https://bugzilla.suse.com/971456 https://bugzilla.suse.com/983938 https://bugzilla.suse.com/984858 https://bugzilla.suse.com/986251 https://bugzilla.suse.com/989913 https://bugzilla.suse.com/989919 https://bugzilla.suse.com/989922 https://bugzilla.suse.com/989926 https://bugzilla.suse.com/990890 https://bugzilla.suse.com/998309

1 0