December 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:3280-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3280-1 Rating: moderate References: #1009434 #1011377 #1011390 #1011395 #1011398 #1011404 #1011406 #1011411 #1011417 #943216 #956365 #981252 #988028 #992038 #992606 Cross-References: CVE-2015-5219 CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 5 fixes is now available. Description: This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: Null pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed: - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in "trap" (bsc#981252). - Reduce the number of netlink groups to listen on for changes to the local network setup (bsc#992606). - Fix segfault in "sntp -a" (bsc#1009434). - Silence an OpenSSL version warning (bsc#992038). - Make the resolver task change user and group IDs to the same values as the main task. (bsc#988028) - Simplify ntpd's search for its own executable to prevent AppArmor warnings (bsc#956365). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1525=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1525=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ntp-4.2.8p9-27.1 ntp-debuginfo-4.2.8p9-27.1 ntp-debugsource-4.2.8p9-27.1 ntp-doc-4.2.8p9-27.1 - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p9-27.1 ntp-debuginfo-4.2.8p9-27.1 ntp-debugsource-4.2.8p9-27.1 ntp-doc-4.2.8p9-27.1 References: https://www.suse.com/security/cve/CVE-2015-5219.html https://www.suse.com/security/cve/CVE-2016-7426.html https://www.suse.com/security/cve/CVE-2016-7427.html https://www.suse.com/security/cve/CVE-2016-7428.html https://www.suse.com/security/cve/CVE-2016-7429.html https://www.suse.com/security/cve/CVE-2016-7431.html https://www.suse.com/security/cve/CVE-2016-7433.html https://www.suse.com/security/cve/CVE-2016-7434.html https://www.suse.com/security/cve/CVE-2016-9310.html https://www.suse.com/security/cve/CVE-2016-9311.html https://bugzilla.suse.com/1009434 https://bugzilla.suse.com/1011377 https://bugzilla.suse.com/1011390 https://bugzilla.suse.com/1011395 https://bugzilla.suse.com/1011398 https://bugzilla.suse.com/1011404 https://bugzilla.suse.com/1011406 https://bugzilla.suse.com/1011411 https://bugzilla.suse.com/1011417 https://bugzilla.suse.com/943216 https://bugzilla.suse.com/956365 https://bugzilla.suse.com/981252 https://bugzilla.suse.com/988028 https://bugzilla.suse.com/992038 https://bugzilla.suse.com/992606

1 0

openSUSE-RU-2016:3279-1: Recommended update for ninja
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Recommended Update: Recommended update for ninja ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3279-1 Rating: low References: #1014177 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ninja fixes the following issues: - boo#1014177: backported rpm macros were added to the package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1522=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1522=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ninja-1.6.0-7.1 ninja-debuginfo-1.6.0-7.1 ninja-debugsource-1.6.0-7.1 - openSUSE 13.2 (i586 x86_64): ninja-1.5.1-3.1 ninja-debuginfo-1.5.1-3.1 ninja-debugsource-1.5.1-3.1 References: https://bugzilla.suse.com/1014177

1 0

openSUSE-RU-2016:3278-1: Recommended update for ninja
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Recommended Update: Recommended update for ninja ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3278-1 Rating: low References: #1014177 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ninja fixes the following issues: - boo#1014177: backported rpm macros were added to the package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1522=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ninja-1.7.2-7.1 ninja-debuginfo-1.7.2-7.1 ninja-debugsource-1.7.2-7.1 References: https://bugzilla.suse.com/1014177

1 0

openSUSE-OU-2016:3277-1: Initial update for docker-compose
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Optional Update: Initial update for docker-compose ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3277-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update provides docker-compose for the SUSE Linux Enterprise Package Hub 12. Compose is a tool for defining and running complex applications with Docker. With Compose, you define a multi-container application in a single file, then spin your application up in a single command which does everything that needs to be done to get it running. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1523=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): docker-compose-1.8.1-2.1 References:

1 0

openSUSE-OU-2016:3276-1: moderate: Add a number of Ruby Gems to the SUSE Package Hub
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Optional Update: Add a number of Ruby Gems to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3276-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This updates makes available the following ruby gems: - rubygem-addressable 2.4.0 - rubygem-cleanroom 1.0.0 - rubygem-diff-lcs 1.2.5 - rubygem-erubis 2.7.0 - rubygem-json 2.0.2 - rubygem-multipart-post 2.0.0 - rubygem-nio4r 1.2.1 Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1524=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ruby2.1-rubygem-addressable-2.4.0-2.1 ruby2.1-rubygem-addressable-doc-2.4.0-2.1 ruby2.1-rubygem-addressable-testsuite-2.4.0-2.1 ruby2.1-rubygem-cleanroom-1.0.0-2.1 ruby2.1-rubygem-cleanroom-doc-1.0.0-2.1 ruby2.1-rubygem-cleanroom-testsuite-1.0.0-2.1 ruby2.1-rubygem-diff-lcs-1.2.5-2.1 ruby2.1-rubygem-diff-lcs-doc-1.2.5-2.1 ruby2.1-rubygem-diff-lcs-testsuite-1.2.5-2.1 ruby2.1-rubygem-erubis-2.7.0-2.1 ruby2.1-rubygem-erubis-doc-2.7.0-2.1 ruby2.1-rubygem-erubis-testsuite-2.7.0-2.1 ruby2.1-rubygem-json-2.0.2-2.1 ruby2.1-rubygem-json-debuginfo-2.0.2-2.1 ruby2.1-rubygem-json-doc-2.0.2-2.1 ruby2.1-rubygem-multipart-post-2.0.0-2.1 ruby2.1-rubygem-multipart-post-doc-2.0.0-2.1 ruby2.1-rubygem-multipart-post-testsuite-2.0.0-2.1 ruby2.1-rubygem-nio4r-1.2.1-2.1 ruby2.1-rubygem-nio4r-debuginfo-1.2.1-2.1 ruby2.1-rubygem-nio4r-doc-1.2.1-2.1 ruby2.1-rubygem-nio4r-testsuite-1.2.1-2.1 rubygem-json-debugsource-2.0.2-2.1 rubygem-nio4r-debugsource-1.2.1-2.1 References:

1 0

openSUSE-RU-2016:3263-1: important: Recommended update for tar
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3263-1 Rating: important References: #1012633 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar fixes the following issues: - the previous version of tar fixed a security issue "POINTYFEATHER" (CVE-2016-6321, boo#1007188). This fix introduced a regression in functionality. It was not possible any more to add files an archive that contained '..' components (boo#1012633). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1518=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tar-1.28-2.22.1 tar-backup-scripts-1.28-2.22.1 tar-debuginfo-1.28-2.22.1 tar-debugsource-1.28-2.22.1 tar-tests-1.28-2.22.1 tar-tests-debuginfo-1.28-2.22.1 - openSUSE 13.2 (noarch): tar-lang-1.28-2.22.1 References: https://bugzilla.suse.com/1012633

1 0

openSUSE-RU-2016:3262-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3262-1 Rating: moderate References: #1014151 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key extends the lifetime of the build(a)suse.de GPG key that is signing the SUSE Linux Enterprise 12 repositories. (bsc#1014151) UID: pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build(a)suse.de> This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1521=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1521=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): suse-build-key-12.0-10.1 - openSUSE Leap 42.1 (noarch): suse-build-key-12.0-9.1 References: https://bugzilla.suse.com/1014151

1 0

openSUSE-RU-2016:3261-1: important: Recommended update for tar
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3261-1 Rating: important References: #1012633 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar fixes a regression caused by the previous security update (bsc#1007188), which limited append and create operations (bsc#1012633) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1517=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1517=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tar-1.27.1-11.1 tar-backup-scripts-1.27.1-11.1 tar-debuginfo-1.27.1-11.1 tar-debugsource-1.27.1-11.1 tar-tests-1.27.1-11.1 tar-tests-debuginfo-1.27.1-11.1 - openSUSE Leap 42.2 (noarch): tar-lang-1.27.1-11.1 - openSUSE Leap 42.1 (i586 x86_64): tar-1.27.1-12.1 tar-backup-scripts-1.27.1-12.1 tar-debuginfo-1.27.1-12.1 tar-debugsource-1.27.1-12.1 tar-tests-1.27.1-12.1 tar-tests-debuginfo-1.27.1-12.1 - openSUSE Leap 42.1 (noarch): tar-lang-1.27.1-12.1 References: https://bugzilla.suse.com/1012633

1 0

openSUSE-RU-2016:3260-1: moderate: Recommended update for shim
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for shim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3260-1 Rating: moderate References: #985568 #999818 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for shim fixes the following issues: - Update shim-install to support "--no-nvram" and improve removable media and fallback mode handling. (boo#985568, boo#999818) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1519=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): shim-0.9-13.1 shim-debuginfo-0.9-13.1 shim-debugsource-0.9-13.1 References: https://bugzilla.suse.com/985568 https://bugzilla.suse.com/999818

1 0

openSUSE-RU-2016:3259-1: important: Recommended update for JHBuild
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for JHBuild ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3259-1 Rating: important References: #1015410 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to JHBuild fixes the following issues: - JHBuild would not work correctly with libdir being /usr/lib64 (bsc#1015410) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1520=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): jhbuild-3.16.0~20150323-7.1 jhbuild-debuginfo-3.16.0~20150323-7.1 jhbuild-debugsource-3.16.0~20150323-7.1 jhbuild-recommended-deps-3.16.0~20150323-7.1 - openSUSE Leap 42.2 (noarch): jhbuild-lang-3.16.0~20150323-7.1 References: https://bugzilla.suse.com/1015410

1 0