November 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2739-1: important: Security update for bind
by opensuse-security＠opensuse.org 07 Nov '16

07 Nov '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2739-1 Rating: important References: #1007829 #965748 Cross-References: CVE-2016-8864 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). - Fix BIND to return a valid hostname in response to ldapdump queries. (bsc#965748) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.9P1-42.1 bind-chrootenv-9.9.9P1-42.1 bind-debuginfo-9.9.9P1-42.1 bind-debugsource-9.9.9P1-42.1 bind-devel-9.9.9P1-42.1 bind-libs-9.9.9P1-42.1 bind-libs-debuginfo-9.9.9P1-42.1 bind-lwresd-9.9.9P1-42.1 bind-lwresd-debuginfo-9.9.9P1-42.1 bind-utils-9.9.9P1-42.1 bind-utils-debuginfo-9.9.9P1-42.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.9P1-42.1 bind-libs-debuginfo-32bit-9.9.9P1-42.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.9P1-42.1 References: https://www.suse.com/security/cve/CVE-2016-8864.html https://bugzilla.suse.com/1007829 https://bugzilla.suse.com/965748

1 0

openSUSE-SU-2016:2738-1: important: Security update for bind
by opensuse-security＠opensuse.org 07 Nov '16

07 Nov '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2738-1 Rating: important References: #1007829 Cross-References: CVE-2016-8864 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - A defect in BIND's handling of responses containing a DNAME answer had the potential to trigger assertion errors in the server remotely, thereby facilitating a denial-of-service attack. (CVE-2016-8864, bsc#1007829). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1272=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.25.1 bind-chrootenv-9.9.6P1-2.25.1 bind-debuginfo-9.9.6P1-2.25.1 bind-debugsource-9.9.6P1-2.25.1 bind-devel-9.9.6P1-2.25.1 bind-libs-9.9.6P1-2.25.1 bind-libs-debuginfo-9.9.6P1-2.25.1 bind-lwresd-9.9.6P1-2.25.1 bind-lwresd-debuginfo-9.9.6P1-2.25.1 bind-utils-9.9.6P1-2.25.1 bind-utils-debuginfo-9.9.6P1-2.25.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.25.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.25.1 bind-libs-debuginfo-32bit-9.9.6P1-2.25.1 References: https://www.suse.com/security/cve/CVE-2016-8864.html https://bugzilla.suse.com/1007829

1 0

openSUSE-SU-2016:2737-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 05 Nov '16

05 Nov '16

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2737-1 Rating: moderate References: #1005084 #1005090 #1005242 #1006591 #1006593 #1006597 #1006598 #1006599 #1006836 #1006839 #1007009 #941919 Cross-References: CVE-2008-3522 CVE-2011-4516 CVE-2011-4517 CVE-2014-8137 CVE-2014-8138 CVE-2014-8157 CVE-2014-8158 CVE-2014-9029 CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089 CVE-2016-2116 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8880 CVE-2016-8881 CVE-2016-8882 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-8886 CVE-2016-8887 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for jasper to version 1.900.14 fixes several issues. These security issues were fixed: - CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410) - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919). - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553). - CVE-2016-1577: Double free vulnerability in the jas_iccattrval_destroy function in JasPer allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137 (bsc#968373). - CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373) - CVE-2016-8690: Null pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084). - CVE-2016-8691, CVE-2016-8692: Missing range check on XRsiz and YRsiz fields of SIZ marker segment (bsc#1005090). - CVE-2016-8693: The memory stream interface allowed for a buffer size of zero. The case of a zero-sized buffer was not handled correctly, as it could lead to a double free (bsc#1005242). - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591). - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593). - CVE-2016-8882: Null pointer access in jpc_pi_destroy (bsc#1006597). - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode() (bsc#1006598). - CVE-2016-8886: Memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599). For additional change description please have a look at the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): jasper-1.900.14-160.25.1 jasper-debuginfo-1.900.14-160.25.1 jasper-debugsource-1.900.14-160.25.1 libjasper-devel-1.900.14-160.25.1 libjasper1-1.900.14-160.25.1 libjasper1-debuginfo-1.900.14-160.25.1 - openSUSE 13.1 (x86_64): libjasper1-32bit-1.900.14-160.25.1 libjasper1-debuginfo-32bit-1.900.14-160.25.1 References: https://www.suse.com/security/cve/CVE-2008-3522.html https://www.suse.com/security/cve/CVE-2011-4516.html https://www.suse.com/security/cve/CVE-2011-4517.html https://www.suse.com/security/cve/CVE-2014-8137.html https://www.suse.com/security/cve/CVE-2014-8138.html https://www.suse.com/security/cve/CVE-2014-8157.html https://www.suse.com/security/cve/CVE-2014-8158.html https://www.suse.com/security/cve/CVE-2014-9029.html https://www.suse.com/security/cve/CVE-2015-5203.html https://www.suse.com/security/cve/CVE-2015-5221.html https://www.suse.com/security/cve/CVE-2016-1577.html https://www.suse.com/security/cve/CVE-2016-1867.html https://www.suse.com/security/cve/CVE-2016-2089.html https://www.suse.com/security/cve/CVE-2016-2116.html https://www.suse.com/security/cve/CVE-2016-8690.html https://www.suse.com/security/cve/CVE-2016-8691.html https://www.suse.com/security/cve/CVE-2016-8692.html https://www.suse.com/security/cve/CVE-2016-8693.html https://www.suse.com/security/cve/CVE-2016-8880.html https://www.suse.com/security/cve/CVE-2016-8881.html https://www.suse.com/security/cve/CVE-2016-8882.html https://www.suse.com/security/cve/CVE-2016-8883.html https://www.suse.com/security/cve/CVE-2016-8884.html https://www.suse.com/security/cve/CVE-2016-8885.html https://www.suse.com/security/cve/CVE-2016-8886.html https://www.suse.com/security/cve/CVE-2016-8887.html https://bugzilla.suse.com/1005084 https://bugzilla.suse.com/1005090 https://bugzilla.suse.com/1005242 https://bugzilla.suse.com/1006591 https://bugzilla.suse.com/1006593 https://bugzilla.suse.com/1006597 https://bugzilla.suse.com/1006598 https://bugzilla.suse.com/1006599 https://bugzilla.suse.com/1006836 https://bugzilla.suse.com/1006839 https://bugzilla.suse.com/1007009 https://bugzilla.suse.com/941919

1 0

openSUSE-SU-2016:2736-1: moderate: Security update for dbus-1
by opensuse-security＠opensuse.org 05 Nov '16

05 Nov '16

openSUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2736-1 Rating: moderate References: #1003898 #978477 #980928 Cross-References: CVE-2015-0245 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for dbus-1 to version 1.8.22 fixes several issues. This security issue was fixed: - boo#1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. These non-security issues were fixed: - boo#978477: Correctly reset timeouts for pending file descriptors - boo#980928: increase listen() backlog of AF_UNIX sockets to SOMAXCONN - Change the default configuration for the session bus to only allow EXTERNAL authentication (secure kernel-mediated credentials-passing), as was already done for the system bus. - Fix a memory leak when GetConnectionCredentials() succeeds (fdo#91008) - Ensure that dbus-monitor does not reply to messages intended for others (fdo#90952) - Add locking to DBusCounter's reference count and notify function (fdo#89297) - Ensure that DBusTransport's reference count is protected by the corresponding DBusConnection's lock (fdo#90312) - Correctly release DBusServer mutex before early-return if we run out of memory while copying authentication mechanisms (fdo#90021) - Correctly initialize all fields of DBusTypeReader (fdo#90021) - Fix some missing \n in verbose (debug log) messages (fdo#90004) - Clean up some memory leaks in test code (fdo#90021) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dbus-1-1.8.22-4.39.1 dbus-1-debuginfo-1.8.22-4.39.1 dbus-1-debugsource-1.8.22-4.39.1 dbus-1-devel-1.8.22-4.39.1 dbus-1-x11-1.8.22-4.39.1 dbus-1-x11-debuginfo-1.8.22-4.39.1 dbus-1-x11-debugsource-1.8.22-4.39.1 libdbus-1-3-1.8.22-4.39.1 libdbus-1-3-debuginfo-1.8.22-4.39.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.8.22-4.39.1 dbus-1-devel-32bit-1.8.22-4.39.1 libdbus-1-3-32bit-1.8.22-4.39.1 libdbus-1-3-debuginfo-32bit-1.8.22-4.39.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.8.22-4.39.1 References: https://www.suse.com/security/cve/CVE-2015-0245.html https://bugzilla.suse.com/1003898 https://bugzilla.suse.com/978477 https://bugzilla.suse.com/980928

1 0

openSUSE-SU-2016:2735-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 05 Nov '16

05 Nov '16

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2735-1 Rating: important References: #1006475 #1006476 Cross-References: CVE-2016-5287 CVE-2016-5288 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Mozilla Firefox was updated to 49.0.2 to fix two security issues and some bugs. The following vulnerabilities were fixed: * CVE-2016-5287: Crash in nsTArray_base (bsc#1006475) * CVE-2016-5288: Web content can read cache entries (bsc#1006476) The following changes and fixes are included: * Asynchronous rendering of the Flash plugins is now enabled by default * Change D3D9 default fallback preference to prevent graphical artifacts * Network issue prevents some users from seeing the Firefox UI on startup * Web compatibility issue with file uploads * Web compatibility issue with Array.prototype.values * Diagnostic information on timing for tab switching * Fix a Canvas filters graphics issue affecting HTML5 apps Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-49.0.2-128.1 MozillaFirefox-branding-upstream-49.0.2-128.1 MozillaFirefox-buildsymbols-49.0.2-128.1 MozillaFirefox-debuginfo-49.0.2-128.1 MozillaFirefox-debugsource-49.0.2-128.1 MozillaFirefox-devel-49.0.2-128.1 MozillaFirefox-translations-common-49.0.2-128.1 MozillaFirefox-translations-other-49.0.2-128.1 References: https://www.suse.com/security/cve/CVE-2016-5287.html https://www.suse.com/security/cve/CVE-2016-5288.html https://bugzilla.suse.com/1006475 https://bugzilla.suse.com/1006476

1 0

openSUSE-RU-2016:2734-1: Recommended update for clamav-database
by maintenance＠opensuse.org 05 Nov '16

05 Nov '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2734-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh October 31st. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201610311037-176.1 References:

1 0

openSUSE-SU-2016:2733-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Nov '16

04 Nov '16

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2733-1 Rating: important References: #1008274 Cross-References: CVE-2016-5198 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to Chromium 54.0.2840.90: fixes the following security issues: - CVE-2016-5198: out of bounds memory access in v8 (boo#1008274) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1266=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-54.0.2840.90-85.1 chromedriver-debuginfo-54.0.2840.90-85.1 chromium-54.0.2840.90-85.1 chromium-debuginfo-54.0.2840.90-85.1 chromium-debugsource-54.0.2840.90-85.1 chromium-ffmpegsumo-54.0.2840.90-85.1 chromium-ffmpegsumo-debuginfo-54.0.2840.90-85.1 - openSUSE 13.2 (i586 x86_64): chromedriver-54.0.2840.90-134.1 chromedriver-debuginfo-54.0.2840.90-134.1 chromium-54.0.2840.90-134.1 chromium-debuginfo-54.0.2840.90-134.1 chromium-debugsource-54.0.2840.90-134.1 chromium-ffmpegsumo-54.0.2840.90-134.1 chromium-ffmpegsumo-debuginfo-54.0.2840.90-134.1 References: https://www.suse.com/security/cve/CVE-2016-5198.html https://bugzilla.suse.com/1008274

1 0

openSUSE-SU-2016:2732-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Nov '16

04 Nov '16

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2732-1 Rating: important References: #1008274 Cross-References: CVE-2016-5198 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to Chromium 54.0.2840.90: fixes the following security issues: - CVE-2016-5198: out of bounds memory access in v8 (boo#1008274) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1266=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-54.0.2840.90-112.1 chromedriver-debuginfo-54.0.2840.90-112.1 chromium-54.0.2840.90-112.1 chromium-debuginfo-54.0.2840.90-112.1 chromium-debugsource-54.0.2840.90-112.1 chromium-ffmpegsumo-54.0.2840.90-112.1 chromium-ffmpegsumo-debuginfo-54.0.2840.90-112.1 References: https://www.suse.com/security/cve/CVE-2016-5198.html https://bugzilla.suse.com/1008274

1 0

openSUSE-SU-2016:2730-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 04 Nov '16

04 Nov '16

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2730-1 Rating: moderate References: #1005544 Cross-References: CVE-2016-4658 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxml2 fixes the following issues: - CVE-2016-4658: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document (boo#1005544). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1265=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libxml2-2-2.9.4-7.20.1 libxml2-2-debuginfo-2.9.4-7.20.1 libxml2-debugsource-2.9.4-7.20.1 libxml2-devel-2.9.4-7.20.1 libxml2-tools-2.9.4-7.20.1 libxml2-tools-debuginfo-2.9.4-7.20.1 python-libxml2-2.9.4-7.20.1 python-libxml2-debuginfo-2.9.4-7.20.1 python-libxml2-debugsource-2.9.4-7.20.1 - openSUSE 13.2 (x86_64): libxml2-2-32bit-2.9.4-7.20.1 libxml2-2-debuginfo-32bit-2.9.4-7.20.1 libxml2-devel-32bit-2.9.4-7.20.1 - openSUSE 13.2 (noarch): libxml2-doc-2.9.4-7.20.1 References: https://www.suse.com/security/cve/CVE-2016-4658.html https://bugzilla.suse.com/1005544

1 0

openSUSE-SU-2016:2729-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 04 Nov '16

04 Nov '16

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2729-1 Rating: moderate References: #957517 Cross-References: CVE-2015-8367 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libraw fixes the following issues: - CVE-2015-8367: Memory objects are not intialized properly (boo#957517). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libraw-debugsource-0.16.2-4.1 libraw-devel-0.16.2-4.1 libraw-devel-static-0.16.2-4.1 libraw-tools-0.16.2-4.1 libraw-tools-debuginfo-0.16.2-4.1 libraw10-0.16.2-4.1 libraw10-debuginfo-0.16.2-4.1 References: https://www.suse.com/security/cve/CVE-2015-8367.html https://bugzilla.suse.com/957517

1 0